Last updated: 22 June 2026

1. Data Controller

The data controller is Marco Marani (“we”, “us”, “the Developer”), developer of the SpesaCondivisa application (the “App”), distributed internationally as ShoppingShared. For any privacy-related request you may contact us at: app@marcomarani.com

2. Overview

SpesaCondivisa is a shared shopping list app designed to work primarily on your device and, optionally, to sync via iCloud. We do not require you to create an account: synchronisation features rely on the Apple ID already configured on your device. We do not operate our own backend servers for user data.

3. Data We Process

3.1 Shopping List Content

List names, items, quantities, prices, brands, categories, notes, and budget limits that you enter into the App. This data is created by you and remains under your control.

3.2 iCloud Synchronisation (CloudKit)

If your device is signed into iCloud, shopping list content is stored in your private iCloud space (container iCloud.com.marcomarani.SpesaCondivisa) so it can sync automatically across your devices (iPhone, iPad, Mac, Apple Watch). This data is managed by Apple under Apple’s own Privacy Policy (https://www.apple.com/legal/privacy/) and is not accessible to us.

3.3 List Sharing

When you share a list with other people (via a link or exported file generated by the App), the list content becomes accessible to the recipient of the link/file. Any email addresses you optionally enter to track who you have invited are stored only locally on your device and/or in your iCloud space alongside the list; they are not transmitted to any third-party servers operated by us.

3.4 Notifications

The App may send you local notifications (budget alerts, weekly reminders, sharing confirmations). These notifications are generated and managed entirely on your device using Apple’s system APIs; we do not use push servers to send advertising or marketing content.

3.5 In-App Purchases

The “Premium” upgrade (a one-time purchase, not a subscription) is handled entirely by Apple via StoreKit. We do not receive or store any payment data; Apple manages the transaction under its own Privacy Policy.

3.6 Apple Watch and Widget

Data displayed on Apple Watch is transferred directly from your iPhone via WatchConnectivity, without passing through any external server. Home Screen widgets read a snapshot stored in a local shared container (App Group) on your own device.

3.7 Siri and App Intents

If you use Siri voice commands or Shortcuts (“Add to shopping list”, etc.), voice processing is handled by Apple under its Privacy Policy; the App only receives the already-interpreted command to carry out the requested action.

3.8 Face ID / Touch ID

If you enable biometric lock for the App, authentication is handled through Apple’s system APIs (LocalAuthentication). We have no access to your biometric data, which always remains on-device (Secure Enclave).

4. What We Do NOT Do

• We do not use advertising SDKs or display ads.
• We do not use cross-app or cross-site tracking or profiling tools.
• We do not sell or share your data with third parties for marketing purposes.
• We do not collect data on servers we own: content stays on your device and, if enabled, in your iCloud space.

5. Legal Basis for Processing

We process data on the basis of performing the service you have requested (App functionality) and, for optional notifications, on the basis of the consent you provide by enabling the system-level permission.

6. Data Retention

Data is stored on your device and, if sync is active, in your private iCloud space, until you delete it. You can delete individual items, entire lists, or all App data via Settings → “Delete All Data”.

7. Recipients of Data

The only party that may have contact with your data is:

• Apple Inc., as the provider of iCloud/CloudKit services, StoreKit, and system APIs (notifications, Siri, biometric authentication), under Apple’s own Privacy Policy.

We do not share your data with any other third-party providers or services.

8. International Data Transfers

Data synced via iCloud is stored on Apple’s servers, which may be located outside the European Economic Area, subject to the guarantees provided by Apple’s Privacy Policy.

9. Security

We adopt the security measures provided by the Apple platform (iCloud encryption, Secure Enclave for biometric data) to protect your content.

10. Your Rights

If you are located in the European Economic Area, you have the right to request access to, rectification, erasure, restriction of processing, or portability of your personal data, and to object to processing. Since most data resides on your device and in your personal iCloud account, you can exercise most of these rights directly within the App or via your device’s iCloud settings. For any other request, please write to appsupport@marcomarani.com. You also have the right to lodge a complaint with your local data protection authority.

California Residents (CCPA/CPRA): We do not sell or share your personal information. For requests to know, delete, or correct your data, contact us at app@marcomarani.com.

11. Children

SpesaCondivisa / ShoppingShared is not directed at children under 13 (or under 16 in the EEA) and we do not knowingly collect identifying data from minors.

12. Changes to This Policy

We may update this policy periodically. The “Last updated” date at the top of the document reflects the most recent revision. Material changes will, where possible, be communicated within the App.

13. Contact

For questions about this Privacy Policy: app@marcomarani.com