PoolThis' Privacy Policy

What we collect on the website

Analytics

If you accept analytics cookies, we collect limited usage data using PostHog:

• Which pages you open, and how far down the homepage you read
• A short, fixed list of actions: submitting the signup form or having it blocked, and opening the footer and social media links
• A pseudonymous visitor identifier
• Your IP address, which PostHog is set to discard rather than store
• Your browser, operating system, device type, screen and window size, language and time zone
• Basic measurements of how quickly the page loaded
• Interaction data used for heatmaps and session replays

We do not record everything you click. Automatic click tracking is switched off, so the only actions measured are the ones listed above, each added deliberately. Web addresses are shortened to the page path before they are stored, so anything after it — a code in a link, for example — is discarded; the campaign labels used in marketing links are kept separately. If you arrive from another website, we record which website, not which of its pages.

Before you answer the banner, and if you reject analytics cookies, PostHog runs in cookieless mode: no identifier is stored on your device and no cookie is set, but a reduced, non-identifying record of page views is still processed. Your IP address reaches PostHog with the request, because it cannot be served without one, but PostHog is configured to discard it rather than store it on the event. Heatmaps and session replays are not part of that reduced record — those start only if you accept.

Newsletter and waiting list

If you submit the signup form, your email address is stored in our self-hosted Listmonk instance so we can email you about the launch. We do not sell or share it. Every email includes an unsubscribe link, and you can also unsubscribe by writing to us. A newsletter_submitted analytics event records only which form was used, never your email address.

To keep automated sign-ups out, the form runs a short anti-spam check (ALTCHA) once you click into the email field: your browser fetches a puzzle from our own Listmonk server and solves it locally. This sets no cookies, stores nothing on your device and involves no third party.

Server logs

We keep no request logs for this website. Access logging is switched off on the web server, and the reverse proxy in front of it writes none either, so there is no stored record of which address requested which page. Our servers still write technical error messages when something goes wrong, which can incidentally include the IP address of the request that failed; these are held in a small rolling buffer and overwritten as new ones arrive.

We do not use any of this for advertising, and we do not sell personal data.

Session recordings & heatmaps

We use PostHog heatmaps and session replays on this website only, to understand how visitors interact with it and to identify usability and performance issues. There are no session recordings in the app.

• Enabled only after you give consent
• Text inputs are automatically masked
• No intentional capture of form contents
• Recordings are kept for 30 days

What we collect in the app

Creating an account and placing orders involves further data, collected to provide the service rather than for analytics. The app contains no advertising or crash-reporting software of any kind, and the analytics it does use are described below.

Account data

• Your email address.
• If you sign in with email and password: a cryptographically hashed version of your password, never the password itself.
• If you sign in with Google: your email address, full name, and a copy of your Google profile picture, which we download and store on our server. We receive nothing else from your Google account and never see your Google password.
• Login tokens stored on your device to keep you signed in, and session records on our server. These are strictly necessary for the app to work.

Basket and order data

The items and quantities in your basket, which stay private to you; and, when you place an order, the products, quantities and prices in it together with your share of the delivery fee.

Saved lists

If you save a shopping list, its name and the products and quantities on it. Lists stay private to your account and hold no prices: adding one to your basket uses the current ones.

Payment data

When you pay, you are sent to Stripe's own hosted checkout page. We never see or store your card details. We receive and store confirmation that a payment succeeded, its amount and currency, and the identifier of the Stripe Checkout session, linked to your order.

Emails

We send account verification codes, password reset codes, and order/payment emails — including your itemised order and the amount due — from our own mail server.

Analytics

The app uses PostHog, the same analytics service as this website, to see which parts of it are used and where people get stuck. It records events such as: signing in and failed sign-in attempts, your answer to the consent prompt, adding an item to a basket, saving a product to a list, submitting a checkout, starting a payment, completing or skipping the product tour, and errors shown to you — along with which screen you are on, and which version and build number of the app you are running. Those two numbers describe our software, not you or your device: everyone using the same release sends the same pair. Our own server adds the steps it alone can see: account creation, rejected sign-ups, orders placed, payments completed, and delivery cycles opening, locking and closing. Screens used only by pool admins are not tracked.

What is never sent: your email address, name or address; the products you buy or save, and the names of your lists; exact amounts, which are reduced to coarse ranges; the text of your messages; and full web addresses. There is no automatic capture of everything you tap, no session recording and no surveys.

Analytics in the app are off until you turn them on. You are asked on the login screen and again after signing in, and you can change your answer at any time under Profile. Until you allow it — and after you decline — nothing identifies you or your device: events are cookieless and anonymous. This is a separate question from the cookie banner on this website, because the two collect different things; each asks for itself.

If you do allow it, your events are labelled with a random identifier that we generate and keep on our server. It is not your email address and not your account number, and it means nothing outside our analytics. Withdrawing your consent, or deleting your account, deletes the analytics profile held under that identifier and replaces it with a new one.

What we do not collect

Your home address, phone number, location, contacts, or any advertising identifier. There is a single shared pickup address set by us, so you never enter one.

Photo access, for pool admins only

If you are an admin adding a product to the catalogue, the app asks for a photo from your device's gallery through the system photo picker, and that image is uploaded to our server as the product image. No other photos are accessed.

Who can see your order

The admin of your pool can see, for each participant in an ordering cycle, the email address on your account, the items and quantities you ordered, the amounts, and whether you have paid. This is necessary to place the combined bulk order and settle the money. Admins cannot see your basket before you place an order, and cannot see your saved lists at all.

Third parties and transfers

• PostHog, Inc. — website and app analytics, acting as our data processor, on servers in the EU (Frankfurt, Germany).
• Stripe — our payment processor, and an independent controller for the payment details you enter on their page. See Stripe's privacy policy.
• Google — if you choose to sign in with Google, your authentication is handled by Google as an independent controller. See Google's privacy policy.
• Hetzner Online GmbH — the hosting provider for our own servers, which run in Finland, acting as our data processor. Everything not listed above stays on those servers and on our own mail server, which runs on separate hardware with the same provider in the same country.

Transfers outside the EU/EEA. PostHog, Inc. and Stripe, Inc. are US-headquartered. Where support or administrative access from the US occurs, it is covered by the EU Standard Contractual Clauses in our agreements with them. Google sign-in data is handled under Google's own transfer safeguards.

Google user data. PoolThis' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in only to authenticate you and create your account. We do not transfer this data to others, use it for advertising, or allow humans to read it except with your consent, for security purposes, or as required by law.

Legal basis

• Website analytics set through cookies: your consent, Article 6(1)(a) GDPR. You may withdraw it at any time via the cookie settings.
• Analytics in the app: your consent, Article 6(1)(a) GDPR, asked separately from the website's cookie banner. You may withdraw it at any time under Profile.
• Cookieless website analytics, before and after you answer the banner, plus error logs and app server activity records: our legitimate interest in operating, debugging and securing the service, Article 6(1)(f) GDPR. The measurement itself stores nothing on your device and reads nothing from it, so it needs no cookie consent.
• Newsletter: your consent, Article 6(1)(a) GDPR.
• Spam protection on the signup form: our legitimate interest in keeping automated sign-ups out, Article 6(1)(f) GDPR.
• App account, basket, saved list, order and payment data: necessary to provide the service you sign up for, Article 6(1)(b) GDPR. This data isn't optional the way analytics cookies are, since the app cannot function without it.
• Keeping order and payment records: our legal obligation under the Swedish Bookkeeping Act (bokföringslagen 1999:1078), Article 6(1)(c) GDPR.

Cookies and device storage

• Website: a single optional analytics cookie set by PostHog, placed only if you consent, plus a strictly necessary cookie remembering your consent choice. Nothing is stored on your device before you choose. If you decline, the only thing kept is that choice itself — the consent cookie, and a matching entry in your browser's local storage that PostHog reads to keep to your refusal. Neither identifies you or records your visit.
• That analytics cookie is set for poolthis.com and its subdomains, so the same anonymous identifier is used on this website and in the web app. That is what lets a visit made before you sign in be counted as the same person afterwards, rather than as two. It is still placed only if you consent here.
• App: no tracking cookies of its own, and none at all in the Android app. The app stores a login token and cached app data on your device, which is strictly necessary to keep you signed in.

Retention

• Analytics: website session replays are deleted after 30 days — there are no app session replays. Event data from the website and the app alike is kept by PostHog for one year, which is set by our plan with them rather than chosen per record.
• Newsletter: until you unsubscribe, or until the waiting list is closed.
• Server logs: we keep no request logs for the website; error logs are overwritten as new ones arrive.
• App server logs, which record which part of the service was called and by which account, so we can operate and debug it: up to 30 days.
• Account data and saved lists: as long as your account exists, then deleted.
• Order and payment records: seven years from the end of the financial year in which they arose, as required by the Swedish Bookkeeping Act. After account deletion these records are kept in a form no longer linked to your name or email address.

Security

Traffic between your device and our servers is encrypted with TLS. Passwords are stored only as salted hashes. Card details never reach our systems. Access to the production database is restricted to the operator of the service.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or your local supervisory authority

To exercise any of these, email info@poolthis.com. We respond within one month.

Deleting your account and data

You can delete your account and its data in two ways:

• In the app: account menu → Profile → Delete account. This permanently deletes, straight away:
  • your profile, including your name and any Google profile picture
  • your email address and sign-in credentials, which signs you out on every device
  • your basket and your saved lists
  • your product tour progress and your answer on analytics
  • an unpaid order in a cycle that is still open for ordering
• On the web: follow the instructions on our delete account page, or email us from your account's email address. We complete deletion within 30 days and confirm by email.

If you have an unpaid order from a cycle that has closed for ordering, you'll need to complete payment before you can delete your account. We keep that record while the payment is outstanding, in order to establish and pursue a legal claim (Article 17(3)(e) GDPR). For a few minutes right after ordering closes, while orders are being finalised, deletion is paused: please try again in a few minutes.

If you had allowed analytics in the app, the analytics profile held under the random identifier described above is deleted shortly afterwards.

Your paid orders — the products, quantities and prices, your share of the delivery fee, and the payment confirmation — are kept in our accounting records for seven years from the end of the financial year in which they arose, as required by Swedish bookkeeping law, and are no longer linked to your name or email address. App server logs that name your account are kept for up to 30 days. Everything else is deleted.

Children

The service is not directed at children. You must be at least 18 years old to create an account and place orders.

Changes

We may update this policy from time to time. The current version is always available on this page, and material changes will be announced by email to registered users.