Privacy
Last updated 1 October 2026 · Basket, com.baddevelopergames.basket · wersja polska
The short version
Basket stores your shopping lists so they can appear on the phones you share them with. It is paid for by ads, and a one-off purchase called Basket Pro removes them. We do not sell your data, and nothing you type into a list is ever used to choose an ad. You can use the whole app without an account.
Who we are
Basket is made by Bad Developer Games, which is the controller of the personal data described here. Write to baddevelopergames@gmail.com about anything on this page, including a request to see or delete your data.
What is stored, and where
Your lists, the items on them and your shop names are stored on your device and, once you are signed in or sharing, in Google Firebase Realtime Database (Google Ireland Limited, acting as our processor). An item is a short text record: its name, an optional quantity, note, link and shop label, whether it has been bought, and which member added or bought it.
Your search history and suggestions never leave your device. The list of things you buy often, which powers the suggestions under the add field, is stored only in the app's local database.
Accounts
On first launch the app signs in anonymously, which creates an identifier with no name, email or contact details attached. If you choose to share a list, you sign in with Google and we receive your Google account identifier and, if you have set one, your display name. We ask for nothing else and we do not read your Google contacts, calendar or files.
The optional name you type in Settings is used to greet you and to show the other members of a shared list who added an item. Anyone on a list you share can see that name.
Sharing
A share link contains a random eight-character code and no personal information. Anyone with the link can join that one list until the link expires after seven days. Joining a list gives that person access to that list only — never to your other lists or your account.
Ads
Basket shows ads supplied by Google AdMob. To request one, the Google Mobile Ads SDK inside the app sends Google your device's advertising ID — a resettable identifier Android gives the device, not your name and not your email — along with the technical shape of the request: device model, operating system version, language, screen size, and the IP address it came from, which tells Google your approximate location. Google uses that data as an independent controller under its own policy for sites and apps that use its services. None of it comes back to us.
What is on your lists plays no part in this. The ads SDK cannot read your items, notes, links, shop names or list names, and we send none of them with an ad request. An ad for a supermarket is a coincidence, not a consequence of something you wrote down.
If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your choice before it requests its first ad, using Google's consent form. You can accept personalised ads or refuse them, and you can change your mind at any time from the privacy options in Settings. Refusing does not remove the ads — it means they are chosen without building a profile of you.
The advertising ID belongs to the device, not to Basket: you can reset or delete it for every app at once in Android's Settings, under Privacy → Ads.
Basket Pro
Basket Pro is a one-off purchase and not a subscription: you pay once, nothing renews, and there is nothing to cancel. It removes the ads and unlocks the full shopping history. Google Play handles the payment in full. We never see and never store your card number, your billing address, or the email on your Google account. One fact reaches us from Google Play: whether the Google account signed in on your phone owns Basket Pro.
We keep that fact on your device and nowhere else. It is not attached to your Basket account, it is not stored on our side, and it does not travel through our database — which is why Basket Pro works whether or not you are signed in to Basket at all. It still follows you to a new phone, because Google Play remembers the purchase against your Google account: install Basket, open Basket Pro and tap Restore purchases, and Play tells the app what you own. While Basket Pro is on, the app requests no ads at all, so no advertising ID is read for advertising.
Refunds are Google's process, not ours. If Google refunds you, Play stops reporting the purchase as owned and the app switches Basket Pro off the next time it asks — nobody tells us separately, and we hold nothing of yours to delete.
Diagnostics
Release builds send crash reports (Firebase Crashlytics) and usage counters (Firebase Analytics). Debug builds send neither.
The counters never carry the text of your items, your lists, your shops, your notes, your links or your name. They record that something happened and its shape: that an item was added and whether it had a quantity, a link or a shop; that one was ticked off, by tap or by swipe, and roughly how long it had been on the list; that a shop filter was used, by its position in the row rather than by its name; that undo was used; that a list was created, shared, joined or left; that a sign-in succeeded, was cancelled or failed; and that a sync write or listener did not get through. Alongside them we store a few slow-moving facts about the installation: how many lists and shops you have, how many are shared, your theme, and whether you are signed in.
Crash reports carry the same kind of context so a crash can be diagnosed: whether the device was online, how many changes were waiting to sync, how big the list on screen was, and a short trail of the actions leading up to it. Crash reports are not linked to your account — we do not attach your user identifier to them.
If you want the exact list, it is in the source: every event and every parameter is declared
in one file, Analytics.kt, with a test that fails if a value outside a fixed set
could ever reach it.
Why we are allowed to do each of these
If you are in the EEA or the UK, these are the legal bases we rely on under the GDPR:
| What | Basis |
|---|---|
| Storing and syncing your lists, running a shared list, sign-in | Performance of a contract — it is the service you asked for (Art. 6(1)(b)) |
| Personalised ads | Your consent, given in the form the app shows before the first ad, and withdrawable at any time in Settings (Art. 6(1)(a)) |
| Non-personalised ads, which fund the free version | Our legitimate interest in being paid for the app (Art. 6(1)(f)) |
| Crash reports and usage counters | Our legitimate interest in an app that works and does not crash (Art. 6(1)(f)) |
| Whether your Google Play account owns Basket Pro | Performance of a contract — you cannot get an ad-free app without it (Art. 6(1)(b)) |
Your rights
You can ask us to show you the data we hold about you, correct it, delete it, hand it over in a portable form, or stop processing it — and you can object to anything we do on the basis of legitimate interest. Where we rely on consent, you can withdraw it without giving a reason, and withdrawing is as easy as giving it.
- The fastest route for deletion is in the app: Settings → Account → Delete account. It takes effect immediately and needs no request to us.
- For anything else, write to baddevelopergames@gmail.com. We answer within 30 days.
- If you think we have handled your data badly, you can complain to your data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).
Where the data goes
Basket has no servers of its own. Everything it stores lives in Google services — Firebase Realtime Database, Firebase Authentication, Crashlytics, Analytics, AdMob and Google Play — and Google may process it outside the European Economic Area, under the safeguards described in Google's data processing terms, which include the European Commission's standard contractual clauses. We add no other recipients: no advertising network other than AdMob, no analytics vendor, no data broker, and nobody who buys data.
How long it is kept
Clearing the basket moves the bought items into History, where everyone on the list can still see them. They are deleted automatically about 30 days after that, and you can empty History yourself at any time. An item you delete outright is gone immediately. Everything else is kept until you delete it, leave the list, or delete your account.
We store no advertising ID ourselves; it goes out with the ad request and is kept by Google under Google's retention rules. Firebase Analytics reads it too, to count installations and users rather than to choose an ad — and that is its only use while Basket Pro is on, because no ad is then requested at all. Whether you own Basket Pro is kept on your phone until the app's data is cleared, and by Google Play for as long as Google keeps the purchase; we keep no copy of it ourselves. Crash reports are kept by Crashlytics for up to 90 days.
Deleting everything
In the app: Settings → Account → Delete account. That removes you from every shared list, deletes the lists you created, deletes your account and wipes the app's data on your device. You can also request deletion at this page.
Deleting your Basket account does not take Basket Pro away from you, and there is nothing to cancel. The purchase belongs to your Google account, not to your Basket account. Deleting the account does wipe this phone's record that you own it, along with the rest of the app's data — Restore purchases asks Google Play again and brings it back.
Children
Basket is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
Changes to this policy
When the app changes what it does with your data, this page changes with it, and the date at the top changes too. If a change is one you would want to know about rather than discover, we will say so in the app before it takes effect. The version you are reading is the current one; there is no archive, because there has been nothing to archive yet.
Contact
Questions, a rights request, or a deletion request: baddevelopergames@gmail.com.