Privacy Policy

Controller

General information

In accordance with our legal obligation, we would like to inform you about the collection and use of your personal data.

When you use our website, personal data about you is collected. This may happen because you enter the data yourself — for example your email address. Our system also collects data from you automatically, such as your visit to our website. This occurs regardless of which device or software you use to access our website.

Any entry of data by you on our website is voluntary; you suffer no disadvantage if you do not provide your data. However, without certain data we are unable to provide services or conclude contracts. We will point out such mandatory information to you in each case.

On this website, the user's personal data is collected only within the framework of applicable data protection law, in particular the General Data Protection Regulation (DSGVO). The technical terms used in this text are explained in greater detail in Art. 4 of the DSGVO.

Under the DSGVO, data processing is permitted in particular in three cases:

• under Art. 6 Abs. 1 lit. a and 7 DSGVO, if you have consented to data processing by us; in each case we will inform you in advance in this privacy policy and at the time of consent in accordance with Art. 4 Nr. 11 DSGVO exactly for what purpose and under what circumstances your data will be processed by us;
• under Art. 6 Abs. 1 lit. b DSGVO, if the processing of your personal data is necessary for initiating, concluding or performing a contractual relationship;
• under Art. 6 Abs. 1 lit. f DSGVO, if, after a balancing of interests, processing is necessary to safeguard our legitimate interests.

Master data

We collect master data to the extent necessary for establishing, defining the content of, or amending a contractual relationship (including a free-of-charge one) between us and the user.

This may include: customer data (e.g. name, address), contact data (e.g. email address, telephone number), service data (e.g. service ordered, term, fee).

Hosting provider

Our website is made available on the internet by a service provider. For this we use the service of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland.

We have concluded a data processing agreement with our provider. Under this agreement, our provider is obliged to process your data only on our behalf and in accordance with our instructions.

Further information on data processing by our provider can be found in its privacy policy at https://www.hetzner.com/rechtliches/datenschutz/.

The legal basis for this data processing is our legitimate interests pursuant to Art. 6 Abs. 1 lit. f DSGVO in providing and using our website on the internet.

Our provider processes information on each use of this website known as server log files, which are automatically transmitted by your browser on every call to websites on the internet. These are:

• your IP address
• type and version of your browser
• hostname
• time of visit
• the website from which you visited our website
• name of the website accessed
• exact time of the call
• the amount of data transferred

This data is used only for statistical purposes and does not enable us to identify you as a user.

Cookies

Our website uses only technically necessary cookies. These are required for the site to function (e.g. to store your language setting during a visit). No consent is required for this, and your behaviour is not evaluated for advertising or statistical purposes.

Fonts

The fonts used on this website are served from our own server. There is no connection to third-party servers, and your IP address is not transmitted to third parties in the process.

Initial contact by electronic enquiry

If you contact us electronically (e.g. by email or telephone), we store and process the data you have provided to us (e.g. name, contact information, content of the enquiry). The legal basis for this is our legitimate interest in effective customer communication pursuant to Art. 6 Abs. 1 lit. f DSGVO and, where the enquiry concerns initiating or fulfilling a contract, also Art. 6 Abs. 1 lit. b DSGVO.

Use of our apps

The following sections apply to our mobile applications, not to this website.

Account and sign-in

You can use Sworca Shopping as a guest without choosing a Google or Apple sign-in. When Firebase is available, the app automatically attempts anonymous authentication, creating a Firebase user identifier without requiring your name or email. If this connection is unavailable, guest use continues locally. Anonymous authentication is not the same as signing in to enable account backup.

If you choose Google or Apple sign-in, we process the user identifier, email address and display name supplied by that provider. Apple may supply a relay email address. Firebase Authentication, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, handles authentication and account management and processes technical connection information, including IP addresses, for security and abuse prevention. The legal basis is Art. 6 Abs. 1 lit. b DSGVO.

Content entered by you

Sworca Shopping stores your lists, baskets, custom products, quantities, prices, notes and labels on your device. This content may contain personal information that you choose to enter. When you sign in with Google or Apple, the account backup functionality uploads shopping content to Cloud Firestore and can restore saved content when signing in. Guest shopping content is not uploaded by this backup functionality. The current version does not provide continuous two-way synchronisation between devices.

Cloud backup uses Cloud Firestore of Google Ireland Limited, server location Frankfurt am Main. The legal basis is Art. 6 Abs. 1 lit. b DSGVO. We do not use your shopping content for advertising or sell it. Local statistics and prioritisation are described below.

Data stored on your device

Language, colour scheme, currency and similar preferences are stored locally. Sworca Shopping also keeps a local history of adding an item to a list and moving it between the two list sections, including rapid back-and-forth movements. Records contain timestamps and event, item, list and, where available, catalogue identifiers. This raw event history is not uploaded by the current account backup functionality.

The app uses local data to show statistics and estimate recurring needs and item priority. These estimates do not establish that an actual purchase occurred. If anonymous Firebase authentication is unavailable, a local guest identifier is used; online anonymous authentication is described in the account section above.

Crash reports

In production builds of Sworca Shopping, Firebase Crashlytics of Google Ireland Limited automatically collects technical crash and diagnostic reports when Firebase is available, including reports of handled errors. Reports may include error messages, stack traces, app and operating system versions, device information and installation identifiers. Collection also applies in guest mode; the current version has no in-app switch to disable it. We do not deliberately attach your account identifier to these reports. The legal basis is our legitimate interest in a functional and secure application pursuant to Art. 6 Abs. 1 lit. f DSGVO.

Abuse protection

To protect against abusive access to our servers, we use Firebase App Check. This service checks whether a request actually originates from an unmodified installation of our app. The legal basis is Art. 6 Abs. 1 lit. f DSGVO.

Subscriptions and purchases

Sworca Shopping currently has no active paid subscription or purchase feature, and RevenueCat is not configured for this version. The following information applies only to other Sworca apps or versions in which paid features are actually offered.

Paid features are processed through the respective app store: Google Play of Google Ireland Limited or the App Store of Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Irland. We do not receive your payment data.

To manage subscriptions we use RevenueCat, Inc., 700 Larkspur Landing Circle, Larkspur, CA 94939, USA. Transmitted are your user identifier and the status of your subscription. We do not transmit your name or email address. Transfer to the USA is based on the Standard Contractual Clauses of the European Commission. The legal basis is Art. 6 Abs. 1 lit. b DSGVO.

Product catalogue

The current Sworca Shopping product catalogue and its illustrations are bundled with the app and are available offline. Browsing this bundled catalogue does not request catalogue content from our Hetzner server. Catalogue updates are delivered through app updates.

No analytics, no advertising

Sworca Shopping does not use a behavioural analytics service or display advertising. Its shopping statistics and learned priorities are calculated locally from the data described above. Technical error diagnosis through Crashlytics is separate from this local analysis. We do not sell your data or create advertising profiles.

Deletion of your account

You can request account deletion in the app settings. Sworca Shopping requires an internet connection and may require you to sign in again. The deletion flow removes account backup content, local shopping data and history on the requesting device, and the authentication account. If an error occurs, follow the message in the app; starting the request is not confirmation that deletion completed. Alternatively, you can request deletion at https://sworca.com/delete-account.

Not deleted in the process are your purchase history with the respective app store and technical crash reports already submitted that are not linked to your account.

Storage period

As a rule, your data is stored only as long as required for the purpose of the respective data processing. Further storage may in particular be considered if this is still necessary for legal enforcement by us or for our other legitimate interests.

In addition, we store your data where we are legally obliged to do so. These are in particular tax retention periods, which are generally 6 or even 10 years.

Disclosure of data

We will not disclose your data to third parties unless this is permitted by law.

Disclosure of your data may either

• be necessary for the performance of a contract and then permitted under Art. 6 Abs. 1 lit. b DSGVO, or
• be permitted on the basis of our legitimate interest in effective service delivery pursuant to Art. 6 Abs. 1 lit. f DSGVO,
• be covered by consent you have given, or
• become necessary if we are lawfully required by a state or authority to disclose your data pursuant to Art. 6 Abs. 1 lit. c DSGVO.

Where your data is disclosed to third parties, this is set out in this privacy policy.

Data transfer outside the EU

Where we transfer personal data to countries outside the European Union, in particular to the USA, in accordance with the above provisions, we do so only if an adequate level of data protection, appropriate safeguards or your consent and thus a transfer permitted under the DSGVO are in place.

Rights of users

You may request information from us at any time free of charge about the personal data we store about you. To prevent abuse, identification of your person is required.

Deletion, rectification, restriction

You may request from us at any time the rectification (including completion) of incorrect data as well as restriction of its processing or deletion of your data. This applies in particular if the purpose of processing has ceased, required consent has been withdrawn and no other legal basis exists, or our data processing is unlawful.

Objection

You may object at any time to any processing of your personal data that we base on a balancing with your interests under Art. 6 Abs. 1 lit. f DSGVO, if reasons exist arising from your particular personal situation.

We will then no longer process your data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves the assertion, exercise or defence of legal claims on our part.

Data portability

You may request from us the transfer of the data stored relating to you in machine-readable form.

Complaint

If you feel that our data processing violates your rights, you may lodge a complaint with the competent supervisory authority. The competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf.

Consent

Where we ask for your consent to process your data, we will inform you in clear language and in an easily accessible manner for which cases you are giving your consent. Every consent we request is voluntary.

For every consent, you have the right to withdraw consent you have given us for the processing of your personal data at any time. This may be done by informal notification, e.g. an email to the address given in the Impressum. Your withdrawal does not affect the lawfulness of processing carried out until then.

Changes to the privacy policy

If a change to the privacy policy becomes necessary for legal or factual reasons, we will update this page accordingly. No changes will be made to consents given by the user.

Stand: 10.10.2026