Privacy Policy
Last updated: 2026-09-15
This policy explains what personal data Cheapchilli collects, why, and your rights. The data controller is Cheapchilli, Lithuania, contact: r.ankudovicius@gmail.com.
In short: We collect only what the app needs to work: your account, your region, shop and cooking preferences, favorites, subscription status and support messages. We do not sell your data and do not use it for third-party advertising. You can delete your account and data at any time.
- 1. Data we collect
- 2. Why we use it
- 3. Automated content, not automated decisions
- 4. Service providers
- 5. Retention
- 6. Deleting your account and data
- 7. Your rights
- 8. Children
- 9. Security
- 10. Changes
- 11. Contact
1. Data we collect
Account data: email address, name (if provided), sign-in method (email, Google or Apple) and a Firebase user id.
Preferences: region, language, the shop you shop at, how often you shop and cook, favorite recipes and shopping-list items you create.
Subscription data: subscription status, product id and provider (Apple, Google or Stripe). We never see or store your card number.
Support data: messages and the email you send through the Help center.
Technical data: app version, platform (iOS/Android) and basic request logs (including IP address) needed to run and secure the service.
Data stored on your device only: a local copy of recipes for your region and your last chosen filters, so the app opens quickly. This never leaves your device.
2. Why we use it
To create and secure your account, show recipes and prices for your region, shop and language, remember your favorites, provide paid features you bought, answer support requests, and keep the service working and safe.
Aggregated, non-identifying statistics (for example how many users chose a shop) may be used to improve the service.
Legal bases (GDPR): performance of a contract (providing the app), our legitimate interest (security, support, improvement) and your consent where required.
3. Automated content, not automated decisions
Recipes and product matches are generated automatically, including by artificial-intelligence models, from retailer data. Your personal data is not sent to those models and is not used to train them. We do not make decisions with legal or similarly significant effects about you by automated means.
4. Service providers
We use trusted processors to run the service: Google Firebase (authentication), MongoDB Atlas (database), Render (API hosting), Backblaze (image storage), Apple App Store, Google Play and Stripe (payments). Product images may be loaded directly from the retailer that lists the product. Providers process data on our behalf under their own security and privacy commitments. Some may process data outside the EU under standard contractual clauses or equivalent safeguards.
We do not sell your personal data and do not use it for third-party advertising.
5. Retention
We keep your data while your account exists. Support messages and payment records may be kept longer where accounting or legal obligations require. Technical logs are kept for a short period for security purposes.
6. Deleting your account and data
In the app: open Profile, then Login & security, then Delete account. This permanently removes your account, preferences, favorites, lists and subscription records from our database and deletes your Firebase authentication account.
By email: send a request from the email address of your account to r.ankudovicius@gmail.com with the subject "Delete my account". We will delete the account within 30 days and confirm by email.
Deleting the account does not cancel a store subscription. Cancel it in your Apple or Google account settings to stop renewals.
7. Your rights
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Most of this you can do directly in the app (edit profile, change region, shop or language, delete account). For anything else contact us at the address below.
You also have the right to complain to your local data protection authority (in Lithuania: Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).
8. Children
The service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has provided data, contact us and we will delete it.
9. Security
Data is transmitted over encrypted connections and stored with access controls. No system is perfectly secure; please keep your login credentials safe.
10. Changes
We may update this policy. The current version is always available on this website and in the app; material changes will be announced in the app.
11. Contact
Privacy questions and requests: r.ankudovicius@gmail.com