Privacy Policy
Last updated: October 13 2026
1. Data We Collect
- Account Data: Email address, display name, and profile picture (if provided), collected during account registration via Firebase Authentication.
- Product Data: Barcodes scanned, product names, expiration dates, and nutritional information (calories, macronutrients) entered into your Pantry.
- Device & Notification Data: Device push notification token (FCM token) used to deliver expiration alerts and household sync notifications. This identifier is stored on our servers and processed by Google Firebase Cloud Messaging.
- Usage and Diagnostic Data: Pseudonymous interaction and diagnostic data collected through Firebase Analytics and Firebase Crashlytics (for example, feature usage, screen views, app version, device model, operating system version, and crash logs). This data is linked to pseudonymous identifiers (such as an app-instance identifier or your internal Korgo user ID) rather than to your name or email address, and is used to improve the service and fix errors.
- Payment Data: Payments are processed entirely by the Apple App Store (iOS) and Google Play (Android), which remain the sole processors of your payment instrument. We do not store your credit card or payment details on our servers, and neither does RevenueCat. Receipt validation and subscription-state management are carried out on our behalf by RevenueCat, which receives purchase and transaction data (product identifier, price, currency, purchase and expiry dates, subscription status, store, and sandbox-vs-production environment) together with a pseudonymous account identifier, but never payment card or bank details. See Section 3.
2. Purposes and Legal Bases for Processing
We process your personal data only for the purposes below. For users in the EEA and the UK, each purpose relies on the legal basis shown under Article 6 of the GDPR (or the UK GDPR).
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account; providing pantry tracking, expiration tracking, shopping and task lists, nutritional insights, analytics, and recipe suggestions | Performance of a contract (Art. 6(1)(b)) |
| Real-time synchronisation of shared data between members of a Group you create or join | Performance of a contract (Art. 6(1)(b)) |
| Managing and validating subscription entitlements | Performance of a contract (Art. 6(1)(b)) |
| Sending push notifications for expiration alerts and household activity | Consent (Art. 6(1)(a)), given through your device's notification permission |
| Crash reporting, usage analytics to improve the service, and anti-abuse protection (App Check) | Legitimate interests (Art. 6(1)(f)) in keeping the app secure, stable, and useful |
| Retaining transaction records where required by tax or accounting law | Legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time (see Section 4). Withdrawing consent does not affect processing carried out before withdrawal.
3. Third-Party Service Providers (Sub-processors)
We use the following third-party services that may process your data as part of delivering the Korgo service:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Google Firebase (Authentication, Cloud Messaging, Analytics, Crashlytics, Cloud Storage, App Check) | Authentication, push notifications, usage analytics, crash reporting, storage of user-uploaded images, anti-abuse attestation | policies.google.com/privacy |
| RevenueCat, Inc. (United States) | Subscription receipt validation and subscription-state management across the app stores | revenuecat.com/privacy |
| Apple App Store | iOS subscription billing and validation | apple.com/legal/privacy |
| Google Play | Android subscription billing and validation | policies.google.com/privacy |
- Service Providers: We use third-party service providers to operate the app, including Google Firebase for authentication, push notifications, usage analytics, crash reporting, storage of user-uploaded images, and anti-abuse attestation. These providers process data on our behalf under their respective data processing terms.
- Subscription Management: RevenueCat, Inc. (United States) sits between the app and the app stores. It validates purchase receipts, normalises your subscription status across the Apple App Store and Google Play, and notifies our backend of subscription changes. RevenueCat receives a pseudonymous account identifier (your internal Korgo user ID — not your email, name, or store account ID), purchase and transaction data (product identifier, price, currency, purchase and expiry dates, subscription status, store, and sandbox-vs-production environment), and standard SDK diagnostics (app version, SDK version, country). RevenueCat does not receive your name, email address, payment card or bank details, pantry or grocery contents, task lists, photos, or any other app content. RevenueCat declares no tracking and collects purchase history for app functionality only. Apple and Google remain the merchant of record and the only parties that process payment instruments.
- Product Reference Data: Product and nutritional information is derived from the Open Food Facts open database, used as a local snapshot. Open Food Facts does not receive or process any personal data of Korgo users. See our Terms and Conditions for licensing and attribution details.
All providers are contractually bound to process data only as instructed and in compliance with applicable privacy laws.
Data in shared Pantry or shared Task lists is visible only to household members you explicitly invite. We do not sell your personal data to third parties.
4. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the data we hold about you.
- Rectification: Request correction of inaccurate data.
- Erasure ("Right to be Forgotten"): Delete your account and all associated data at any time from the Profile screen in the app (Profile → Delete Account). Deletion is immediate and permanent. Residual copies held by our service providers (for example, analytics data and crash reports) are removed in line with their own retention schedules.
- Restriction: Request that we limit how we process your data in certain circumstances.
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw Consent: Where processing is based on consent (e.g., push notifications), you may withdraw at any time via your device settings.
To exercise any of these rights, contact us at support@korgo.app. We will respond within 30 days.
5. Data Storage, Retention and International Transfers
- Data is stored on secure servers with encryption in transit (TLS) and at rest. Your data is retained for the duration of your active account. Upon account deletion, personal data is deleted immediately and permanently, except where retention is required by law (e.g., transaction records for tax purposes, retained up to 7 years). Residual copies held by our service providers (for example, analytics data and crash reports) are removed in line with their own retention schedules.
- Korgo is operated from the Republic of Belarus, which is not covered by a European Commission adequacy decision. Where personal data of users in the European Economic Area is transferred outside the EEA, we rely on the Standard Contractual Clauses adopted by the European Commission as the transfer mechanism, together with supplementary technical measures including encryption and access controls.
- You may request further information about these safeguards by contacting us at support@korgo.app.
6. Children and Age Requirements
- Korgo is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13, we will delete it promptly.
- If you are under the age of digital consent in your country (in the EEA and the UK this ranges from 13 to 16), any processing that relies on your consent, such as push notifications, requires the consent or authorisation of your parent or legal guardian.
- Parents or legal guardians may contact us at support@korgo.app to review or delete their child's personal data.
7. Contact Us
-
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:
Email: support@korgo.app
Controller: Dzmitry Lashkevich, Republic of Belarus
8. Governing Law
- This Privacy Policy is governed by the laws of the Republic of Belarus. For users in the European Union or EEA, personal data is processed in accordance with the General Data Protection Regulation (GDPR). For California residents, this policy complies with the California Consumer Privacy Act (CCPA).