Privacy Policy
Data protection declaration pursuant to the General Data Protection Regulation (GDPR / DSGVO) & § 25 TDDDG.
Last updated: October 2026
Data Controller (Art. 4 Nr. 7 DSGVO)
The controller responsible for data processing on this platform in accordance with the General Data Protection Regulation (GDPR) is:
Colin Ziegler
Kieferngartenstr. 12
80939 München
Deutschland
Email: colin.ziegler@tum.de
Authentication & Data Minimization
kartli strictly adheres to the principle of data minimization (Art. 5(1)(c) GDPR). Registering and using kartli requires no email address, phone number, or real name. Accounts are established solely via a freely chosen handle/username and a cryptographically hashed password (bcrypt).
The legal basis for this processing is Art. 6(1)(b) GDPR (performance of a contract or provision of the requested service).
Cookies & Local Storage (§ 25 Abs. 2 Nr. 2 TDDDG)
No consent banner required under § 25 (2) No. 2 TDDDG
We use zero third-party tracking, advertising cookies, analytics pixels, or cross-site fingerprinting.
Pursuant to § 25 (2) No. 2 TDDDG, no user consent is required for storing or reading end-device information if it is strictly necessary in order to provide a digital service explicitly requested by the user.
| Key / Cookie | Storage | Purpose | Duration |
|---|---|---|---|
| authjs.session-token | HTTP-Only Cookie | Session authentication token | Session / 30 days |
| kartli_locale | Cookie & LocalStorage | Remembers selected locale (de / en) | 1 year |
| kartli-theme | Cookie & LocalStorage | Remembers culinary color theme | Persistent |
| kartli_pending_invite | HTTP Cookie | Holds pending kitchen invite during sign-up | 1 hour |
Ledger Expenses & Accounting Integrity
kartli coordinates shared grocery expenses and pantries for flatshares and households. When recording purchases or expenses, transaction totals, items, and your kitchen nickname are recorded in the shared kitchen ledger.
Accounting Integrity: To preserve mathematical balance integrity and settlement tracking across flatmates, historical ledger expense rows and totals remain available to kitchen members even after a roommate departs or deletes their account (legitimate interest pursuant to Art. 6(1)(f) GDPR).
Right to Erasure & Account Deletion (Art. 17 DSGVO)
Pursuant to Art. 17 GDPR (Right to Erasure / "Right to be Forgotten"), you have the right to obtain the erasure of personal data concerning you without undue delay.
Self-service account deletion directly in user settings:
- Your username and password hash are permanently scrambled and deactivated (e.g. deleted_user_UUID).
- Push notification tokens and active sessions are immediately erased.
- Historical expense rows are fully anonymized (user_id = NULL, suffix '(deleted)'). Financial balances remain accurate without preserving personal links to your credentials.
Your Rights as a Data Subject & Server Hosting & Security
Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
All communications are guarded with state-of-the-art TLS encryption and strict security headers (HSTS, No-Sniff, SameOrigin). Uploaded receipts are systematically deleted after automated AI item extraction.