This policy covers every OffByOne app. What applies to all of them is stated first; anything specific to an individual app follows under its own heading.
Last updated 12 September 2026
The short version. OffByOne apps have no accounts, no analytics, no advertising and no tracking of any kind. OffByOne operates no servers and receives no data from any of them.
What an app stores stays on your device, or syncs through your own iCloud account, which only you can read. Nothing is sold, shared or sent anywhere except where an app plainly needs to look something up — and where that happens, it is described below.
The controller for the purposes of the General Data Protection Regulation is OffByOne, sole proprietor Carsten Whimster, Berlin, Germany. The full postal address is given in the Impressum.
Questions about this policy, or about information held about you, can be sent to support@offbyone.biz.
Information stays on your device for as long as the app is installed. Deleting the app removes what is stored on that device.
Anything synced through iCloud is held in your own Apple account and managed there, under Settings → your name → iCloud. OffByOne cannot see it and cannot delete it for you.
OffByOne apps are not directed at children and collect no information from anyone, of any age.
Under the General Data Protection Regulation and comparable legislation you have rights of access, rectification, erasure, restriction, objection and portability in respect of personal data held about you.
In practice OffByOne holds no personal data about you, so there is nothing to produce, correct or erase. The information an app creates is under your control, on your own device and in your own iCloud account. If you contact support by email, that correspondence is held in the support mailbox until it is no longer needed, and you may ask for it to be deleted at support@offbyone.biz.
If an app changes in a way that affects this policy, the policy will be updated and the date at the top changed with it.
for iPhone
The stores you create, the items on your lists, quantities, the order the app has learned for each store, item-naming corrections and your app settings are stored on your device.
If you are signed in to iCloud, this information also syncs through your own iCloud account, in the private database of your Apple ID. That syncing is operated by Apple under Apple's own privacy policy. OffByOne cannot read it, and has no means of accessing it.
If you give a store a location so the app can detect when you leave it, the coordinates of that store are saved alongside the rest of your list data and sync in the same way. They are the coordinates of a shop, not a record of your movements.
ShoppingList uses location to notice when you have left a store you have given a location to, so it can offer to tick off what you bought.
Your position is used entirely on your device, by iOS, to trigger that one event. It is not recorded, not stored as a history, not sent to OffByOne, and not sent to anyone else. No location information leaves your device.
Location access can be withdrawn at any time under Settings → Privacy & Security → Location Services → ShoppingList. The rest of the app continues to work without it; only the leaving-a-store prompt stops.
The camera is used to read barcodes. Decoding happens on your device as the camera runs. No photograph is taken, stored, or transmitted.
When you scan a barcode, that barcode is sent to Open Food Facts, a collaborative public food database, to retrieve the product's name, ingredients, nutritional values and photograph.
The barcode is the only thing sent. No list contents, no location, no device identifier and nothing identifying you accompanies it. There is no account, so the request cannot be tied to a person by the app.
As with any request to a website, the Open Food Facts server will see the network address the request came from. Open Food Facts is an independent organisation and handles that under its own terms, published at world.openfoodfacts.org/terms-of-use.
Products you have scanned are kept in a file on your device so that scanning the same item again works without a network connection. That file stays on the device and is not synced or transmitted.