Privacy policy

MultiMarket · Last updated: 8 October 2026

MultiMarket is a free, open-source app for organising your shopping across several supermarkets. This policy explains what data it handles, why, and the control you have. There are no ads, no analytics, no trackers, and we never sell or share data.

Controller

The data controller is the developer of the MultiMarket open-source project. To exercise your rights or ask anything, write to multimarket@uverse.es. Many rights can be exercised directly in the app (see “Your rights”).

What is stored and where

Only on your device (if you don't use shared features, nothing leaves your phone except the lookups to open databases described below):

Your shopping list, priorities, chosen stores, prices you enter, and offers.
Your settings, your approximate location (only to find nearby supermarkets) and any product photos you take.
Your purchase history and the quantity of each product.

On our server, only if you use shared lists, share a photo or propose a new product:

An anonymous device account: created automatically with a random identifier and a random password (kept in your device's secure keychain). We do not ask for your name, e-mail or phone.
A display name (alias) you choose, so other members of your lists know who added what.
The content of shared lists: products, priority, store, price, bought status, who added it, offers and, where applicable, that list's purchase history. Only list members can see it.
Contributions to the common database: new products and photos you send. They wait for review and, if approved, become public and freely reusable, with no restrictions and no derivative licences. They are linked to a random internal identifier, not to your identity. Once approved they are permanent in the common database and you cannot withdraw them; while pending you can. Only pure product photos are accepted (the packaging): no receipts, faces, fingers or people in the background; the administrator may crop them when reviewing. You can report a published photo that is wrongly assigned or should not be there. Photo metadata (such as location) is removed on your device before saving or sending.
Technical server logs (IP address, time and request) for security and abuse limiting, kept for a few days.

Prices from your receipts (optional)

If you import a receipt, the app may contribute to the shared catalog, anonymously, the product name as printed on the receipt, the chain, the shelf price and the day. The receipt, the image, your name, the specific store, payment details and personal discounts are not sent. The app processes the receipt on your device and deletes the image when done. You can turn this contribution off on the import screen itself. Prices are aggregated (median) so other users can compare; if you delete your account, your contributions are left unlinked from it.

Error reports (optional)

They are off by default. If you turn them on in Settings, when the app crashes it sends our server the app version, the system, the error message and its technical trace, linked to your anonymous device account. They do not include the content of your lists, although an error message could occasionally contain some text. Only the administrator sees them, they are used only to fix bugs, and they are deleted after 90 days (or when you delete your account). You can turn them off at any time.

Moderation and sanctions

Photos and products you contribute to the shared catalog are reviewed before publication. If an account deliberately uploads inappropriate content, it may lose the ability to share new content temporarily (7 days, 30 days) or indefinitely; it can keep using the app and reading the shared catalog. For this purpose the sanction level and date are stored against your anonymous account.

Third-party services contacted from your device

Open Food Facts and Open Prices: the text you search for and product barcodes, to get open names, photos and prices.
OpenStreetMap (Overpass API): approximate coordinates of the search point, to find nearby supermarkets. Only when you tap search near me and have granted location permission.
Map apps (Google Maps, Waze, Apple Maps, OpenStreetMap): only if you choose to open a store location; they apply their own policies.

These services necessarily see your IP address. See their own policies for details.

Device permissions

Location: optional, to find and sort nearby supermarkets. The app works without it.
Camera and photos: optional, to scan barcodes and photograph products. Barcodes are read on the device.
Notifications: optional, for local alerts (cold-chain timer, expiring offers). They are generated on your device.

Legal basis and retention

We process data for shared features to provide the service you request (GDPR Art. 6(1)(b)) and contributions to the common database on your consent (Art. 6(1)(a)), which is asked for on each submission or in Settings. We keep data while your account exists; server backups rotate automatically and are kept for a few days.

Your rights

Delete your account and server data: in the app, Settings → Privacy → Delete my account. Your account, list memberships and still-pending contributions are removed. Lists you created pass to the next member, or are deleted if you were alone. Contributions already approved and public remain, unlinked from you.
Delete local data: the same screen can also wipe everything stored on your device.
Withdraw a photo or product you contributed, while it is pending. If an already published photo contains your personal data, request its removal by writing to multimarket@uverse.es and it will be handled.
Access, rectification, restriction, objection and portability: by writing to multimarket@uverse.es. You may also complain to your data protection authority (in Spain, aepd.es).

Children

The app is not directed at children under 14 (the age from which a person in Spain can consent to data processing on their own). If you are under 14, you need the consent of a parent or guardian to use it. We do not knowingly collect data from children under that age without that authorization; if you believe this has happened, write to us and we will delete the account.

Security

Communications use HTTPS. Device passwords are stored in the system's secure keychain and administrator access requires two-factor verification.

Changes

If this policy changes, the new version and date will be published here.