Privacy Policy

Cabas ("we", "us", or "our") is a collaborative shopping list application published by NGames, based in France. This privacy policy explains how we collect, use, share, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French data protection laws.

The data controller is NGames, contactable at contact@ngames.fr. You may direct all data protection inquiries to this email address.

Account information: When you sign in with Google or Apple, we receive your email address, display name, and profile picture. We do not access your Google or Apple password.

Shopping data: Shopping lists you create, items you add (names, quantities, categories), and collaborative actions (sharing, checking off items).

Usage data: We record pseudonymous usage events, meaning they are linked to your account (for example "item added" or "list created"), which may include the name of the item or list involved, to improve the service. If you use Premium AI features, the requests sent to our AI provider and its responses, which contain item names, are also recorded. We do not track your location or browsing activity outside the app.

Website analytics: On our marketing website (getcabas.com), we use Google Analytics 4 to collect anonymized usage data such as pages visited, referral sources, and interactions with the site. This data helps us understand how visitors discover and engage with Cabas. Google Analytics uses cookies only with your consent (see Cookies section below). Within the Cabas application itself (app.getcabas.com), we use separate in-product analytics as described above.

Subscription data: If you subscribe to Cabas Premium, purchase and subscription status information is processed through RevenueCat.

Push notifications: If you allow notifications in the iOS app, we store your device's push token to tell you about activity on your shared lists (a member updated a list, someone joined one of yours). A notification contains only the member's display name and the list name.

We process your data on the following legal bases under GDPR Article 6:

Contract performance (Art. 6(1)(b)): Processing your account data and shopping lists is necessary to provide the Cabas service you signed up for.

Legitimate interest (Art. 6(1)(f)): We collect analytics data to improve the service, fix bugs, and understand usage patterns. You can object to this processing by writing to contact@ngames.fr.

Legitimate interest, after account deletion (Art. 6(1)(f)): We keep subscription history for 5 years to manage billing and to be able to answer any claim within the limitation period.

Consent (Art. 6(1)(a)): On our marketing website, we use Google Analytics cookies only with your explicit consent, collected via a cookie banner. Push notifications are sent only if you allow them when iOS asks, and you can turn them off at any time in the iOS Settings. For any other optional processing beyond what is necessary for the service, we will ask for your explicit consent.

Your shopping lists are shared only with users you explicitly invite, and with AI assistants you connect yourself (see the AI assistants section). We use the following third-party processors to operate the service:

Supabase (Supabase Inc.) — Database hosting, authentication, and serverless functions. Your data is hosted on Supabase infrastructure in the EU.

RevenueCat (RevenueCat Inc.) — Subscription and in-app purchase management. Processes purchase tokens and subscription status.

Google (Google LLC) — Authentication provider. Receives only the OAuth authentication flow; we do not share your shopping data with Google.

Apple (Apple Inc.) — Authentication provider on iOS. Receives only the Sign in with Apple authentication flow. Also delivers push notifications (Apple Push Notification service), receiving your device's push token and the notification text.

Stripe (Stripe Inc.) — Payment processing for web subscriptions. Processes payment card details and transaction data. We do not store your card information directly.

Anthropic (Anthropic PBC) — AI provider for Premium features (item categorization, seasonal suggestions). Receives the item names involved and does not use them to train its models.

Sentry (Functional Software Inc.) — Technical error tracking. Receives the error message and your user ID.

Google Analytics (Google LLC) — Website analytics on our marketing site (getcabas.com). Collects anonymized page views and interaction data. Subject to your cookie consent. Data may be transferred to the US under Google's Standard Contractual Clauses.

We do not sell your personal data to third parties. We do not use your data for advertising.

You can connect Cabas to an AI assistant, such as ChatGPT (OpenAI) or Claude (Anthropic), through our connector at https://app.getcabas.com/mcp. This connection is optional: it exists only if you add Cabas in the assistant yourself, then allow it on the Cabas sign-in page.

Authorization: The connection uses the OAuth protocol. You sign in to Cabas with Apple or Google; the assistant never receives your password, only an access token for that connection. You can remove access at any time in Cabas on the web (app.getcabas.com), under Settings › Connected apps: access stops at once, and the assistant can no longer read or change your lists. Signing out of Cabas on a device does not remove an assistant's access. Deleting your account ends every connection.

Data the assistant can access: Once connected, the assistant acts on your behalf, with the same rights as you on your lists. It can read the lists you are a member of (name, items, quantities, categories, notes, checked items), the display name and role of those lists' members, and your purchase history when it suggests items. It can add, edit, check off and remove items, create, rename, archive, restore and delete lists (deleting asks for your confirmation), and create invite links. Members of your lists see its changes as yours.

Your account details: When you connect Cabas to an assistant, the sign-in tokens Cabas gives it contain your Cabas user ID and email address; your name and the link to your profile picture, if your account has them; and the sign-in details Apple or Google provides, such as which of the two you use, your account ID with it, and whether your email address is verified or hidden. The assistant's provider (OpenAI for ChatGPT, Anthropic for Claude) therefore receives them, and processes them under its own privacy policy (see below).

Data it cannot access: The connector does not give the assistant your payment information or your subscription status. The assistant cannot manage your subscription, make a payment, delete your account, manage your lists' members, or see lists you are not a member of.

Shared lists: If another member of a shared list connects their own assistant, that assistant can read the list, including the items you added and your display name.

Processing by the assistant's provider: What the assistant reads from Cabas, and anything you write in the conversation, is processed by the assistant's provider under its own privacy policy, not by Cabas. That provider is not our processor: you choose to share this data with it. For ChatGPT, see OpenAI's policy: https://openai.com/policies/privacy-policy/. For Claude, see Anthropic's: https://www.anthropic.com/legal/privacy.

What Cabas records: We do not keep your conversations. Cabas only receives the actions the assistant requests (for example "add 2 l of milk") and carries them out as if you were using the app; they are recorded like any action taken in the app (see Information We Collect). For each connected assistant, we keep its name and the date you connected it, shown in Settings › Connected apps. When a connector request is refused, we log the error code, the request type, the protocol version, the client's technical identifier (its "user agent") and the error message. Technical errors are reported to our error tracking tool (Sentry), with your user ID. Our technical logs contain neither your access token nor the content of your lists, and are kept for at most 90 days.

Cabas AI features: If you subscribe to Premium, items added through the assistant can be categorized, and seasonal ideas suggested, by the same AI feature as in the app: the item names involved are then sent to our AI provider, Anthropic, as our processor. Anthropic does not use this data to train its models.

No selling, no training: We do not sell the data that goes through the connector and do not use it for advertising. Cabas does not use your lists to train AI models.

Legal basis: This processing is necessary to provide the service you ask for (GDPR Art. 6(1)(b)): it only happens when you connect an assistant and ask it to act.

Contact: For any question or request about your data and AI assistants, email us at contact@ngames.fr or use our contact form: https://getcabas.com/en/contact.

We retain your data for as long as your account is active, with the following specific retention periods:

Account and profile data: Retained until you delete your account.

Shopping lists and items: Active lists are retained indefinitely. Deleted items are kept for 90 days (to allow recovery) then permanently erased.

Push tokens: Kept until you sign out on that device, uninstall the app, or delete your account.

Connected apps: The connection (assistant name and date) is kept until you remove access or delete your account. Technical logs are kept for at most 90 days.

Usage events: Automatically deleted 90 days after they are created, or as soon as you delete your account. Subscription events received after deletion (renewal, cancellation, expiry) are deleted 90 days after they are created. Aggregated, anonymized statistics may be retained indefinitely.

Subscription and billing: If you subscribed to Cabas Premium, your subscription history (plan, period, status, price, start, expiry and cancellation dates) is kept after you delete your account for 5 years after the subscription ends. We use it to manage billing and to answer any claim within the 5-year limitation period (French Civil Code art. 2224, Commercial Code art. L110-4). It is no longer linked to your profile, email or lists, which are deleted. Until the subscription has ended with the store, RevenueCat notifications (renewal, cancellation, expiry) keep updating this history. The payment records themselves are kept by Apple, Stripe and RevenueCat, under their own policies.

When you delete your account, all your personal data is permanently deleted within 30 days, including profile information, shopping lists, items, usage events and AI assistant connections, except your subscription and billing history (see above).

Under the General Data Protection Regulation, you have the following rights:

Right of access: You can request a copy of all personal data we hold about you.

Right to rectification: You can request correction of inaccurate personal data.

Right to erasure: You can request deletion of your account and all associated data by contacting us by email or via our contact form (select "GDPR request").

Right to restrict processing: You can request that we limit how we use your data.

Right to object: You can object to processing based on legitimate interest, including analytics.

Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@ngames.fr or use our contact form at https://getcabas.com/en/contact. We will respond within 30 days.

Cabas is not intended for children under the age of 15 (in France) or 16 (in other EU countries). We do not knowingly collect personal data from children under these ages. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

Your data is primarily hosted in the European Union via Supabase. Some of our processors (RevenueCat, Stripe, Google, Apple, Anthropic, Sentry) are based in the United States. Transfers to these processors are governed by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, in compliance with GDPR Chapter V.

We implement industry-standard security measures including: encrypted data transmission (TLS/HTTPS), row-level security policies ensuring users can only access their own data, rate limiting on API endpoints, and secure token handling.

Marketing website (getcabas.com): We use Google Analytics 4 with Google Consent Mode v2. When you first visit our website, a cookie banner asks for your consent. If you accept, Google Analytics sets cookies to measure page views and interactions. If you decline, Google Analytics operates in cookieless mode — no cookies are set on your device, but basic anonymized measurement data (without personal identifiers) may still be collected. You can change your preference at any time by clearing your browser's local storage for getcabas.com.

Cabas application (app.getcabas.com): The application does not use advertising or tracking cookies.

We use the following local storage mechanisms, which are essential to the functioning of the service:

Authentication session: An HTTP-only cookie managed by Supabase is used to maintain your login session. This cookie is strictly necessary and cannot be disabled.

User preferences: We store your theme preference (light/dark), language choice, and cookie consent decision in your browser's local storage. This data never leaves your device.

Offline data: The web app caches your shopping lists and items locally (via IndexedDB) so the app works offline. This data syncs with the server when you are back online.

We may update this privacy policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "Last updated" date. For material changes affecting your rights, we will make reasonable efforts to notify you via the app or email. Continued use of Cabas after changes constitutes acceptance of the updated policy.

If you are not satisfied with how we handle your data or your rights request, you have the right to lodge a complaint with your local data protection authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.

For any questions about this privacy policy, to exercise your data protection rights, or for any data-related concern, please contact us at contact@ngames.fr.