Privacy Policy

Last updated: 6 October 2026

Your ordinary shopping lists stay on your device by default. Connected sharing and other optional features only apply when you choose to use them.

Cartlea is developed and published by Veritware Pty Ltd (“Veritware”). This policy covers the app, its optional connected Household service, support communications and these product webpages. Features can differ between Android and iPhone, app versions and regions. Sections about optional features apply where those features are available and used.

Your local shopping data

Ordinary Cartlea use does not require a Veritware account. Lists, item names, quantities, sizes, categories, notes, priorities, checked status, prices and totals are stored locally. Local history, favourites, templates, preferences and any saved loyalty-card details also remain on your device unless you use a feature that sends or exports them.

Cartlea does not include advertising or behavioural analytics. We do not sell your shopping data or use it for advertising.

Plain-text sharing sends the content you select to the app or recipient you choose. Exporting a backup creates a file at your chosen destination, which might be a cloud drive. Those copies are then handled by you and the receiving service. Device backups and device-to-device transfers may also be managed by your operating system and its settings.

Optional voice and barcode features

Voice entry

If you start voice entry, Cartlea uses your device’s speech-recognition service and asks for the required microphone or speech permission. Depending on your device, language and speech provider, recognition may use an online service. That provider may process audio under its own privacy terms.

Cartlea receives recognised text as an editable draft. Cartlea does not save audio recordings, create audio files, log recognised words or send audio to a Veritware server. Text becomes part of your list when you add it; if that list is shared through Household, the added text is shared with it.

Barcode scanning and product lookup

Camera access is used when you choose to scan a barcode. Scanning reads the code on your device; Cartlea does not upload camera images to its servers. Local barcode matches can be used without an external lookup.

If you choose an online lookup, Cartlea sends the barcode, requested language and app version to Open Food Facts. As with other internet requests, that service receives technical connection information such as your IP address. Cartlea does not send your shopping lists, Household account details or camera images with the lookup.

You can turn off camera, microphone and speech permissions in your device settings and continue using typed entry.

Optional Household accounts and shared lists

When you choose Household, Veritware processes information needed to provide the connected service:

Your email address, display name, account identifier and authentication information, to create and protect your account.
Household identifiers, membership, roles, invitations and account actions, to control access and manage the Household.
Lists you deliberately share, their items and associated details, plus change identifiers, timestamps and sync state, to keep members’ copies up to date.
Subscription product, transaction and purchase-verification information, renewal status and service-access records, to manage paid Household access.
Service, security and delivery records needed to investigate failures, prevent misuse and deliver account or subscription notices.

Creating a Household account does not automatically upload every local list. Other authorised members can see and change content in the shared lists they can access. Membership and display information is used to identify people within the Household. Choose carefully what you share and whom you invite.

Household service messages concern account, billing or sharing activity. They are not advertising. Support staff may access information needed to investigate a request or operate and protect the service.

Purchases

Apple or Google processes store payments under its own terms. Cartlea uses purchase status to recognise Unlocked features. Optional Household subscriptions additionally use server-side transaction and subscription records to verify access and handle renewal, recovery and expiry. Veritware does not receive your payment-card number from these purchases.

Service providers and international processing

Supabase provides Household authentication, database hosting and synchronisation infrastructure.
Resend delivers Household service emails using the recipient address and message information needed for delivery.
Google and Apple provide their app stores, billing and relevant device services. Google Cloud also supports Apple subscription verification where that service is used.
Open Food Facts provides optional product lookups; your chosen speech provider processes optional voice recognition.
Cloudflare hosts and protects these webpages. Hosting services can process IP addresses, browser details, request times and security logs. Email providers process messages you send to support.

These providers can process information in countries other than your own, including Australia and the United States, depending on the service. A provider’s hosting location does not mean all support, email or billing processing stays in that country. Providers’ own policies apply to their independent services.

We use information to provide the features you request, manage purchases, answer support enquiries and protect the service. Where applicable, the legal bases are performing our agreement with you, legitimate interests in support and security, complying with law, and consent where required. We may disclose information when required by law or necessary to protect legal rights.

Storage, retention and deletion

Local data remains until you remove it, clear the app’s storage or delete the app, subject to your device’s backup behaviour. Exported files and copies you send elsewhere must be deleted separately. Veritware cannot recover local data that has not been shared with the service or included in a backup you control.

Household data is held while needed to provide sharing and account access. After a verified subscription expiry, the service has a 30-day recovery period before final expiry and removal of live connected list content. The app shows the applicable recovery deadline. Cancelling renewal is different from final expiry.

Deleting a Household account removes its sign-in account, ends its connected access and replaces its membership display name with “Former member”. Content previously shared with a continuing Household can remain available to its other members. Local copies and exports held by you or other people are not remotely erased.

Some account, membership, deletion, transaction and security records can remain after deletion or final expiry to verify completed actions, prevent deleted sharing records from being recreated, resolve billing and meet legal obligations. Backup copies may remain until replaced or removed through the provider’s backup cycle. We retain support correspondence and these remaining records only for the purposes for which they are needed, including any applicable legal requirement.

Use Delete Household account in the Household area, or follow the web account-deletion request instructions. If you own a Household with other members, transfer ownership first. Any unresolved subscription sponsorship must also be addressed. If a step prevents deletion, contact us for help; you do not need to reinstall the app to make a request.

Connected requests use encrypted connections and account-based access controls. No storage or transmission method is completely secure. Protect your device, account credentials and backup files, and share only information you intend other members to receive.

Access, correction and privacy questions

Email privacy@cartlea.com to ask about your information, request access, correction or deletion, or raise a privacy complaint. Depending on your location and applicable law, you may also have rights to a copy of your data, restriction of processing, objection or withdrawal of consent.

We may need to verify your identity before acting on an account request. Please do not email passwords or payment-card details. We will explain the outcome and any information we must retain. You may also contact your local privacy regulator, including the Office of the Australian Information Commissioner in Australia where applicable.

For app help, contact support@cartlea.com. We will update this policy as practices change and revise the date above; significant changes will also be brought to your attention where required.