Basket

1. Overview

TezStudio ("the Studio") respects user privacy in Basket ("the App") and handles personal data in accordance with applicable laws including South Korea's Personal Information Protection Act.

The App's core features run on the device without any sign-in. Sign-in is required only for family sharing and cross-device sync; shopping items, purchase history, and family group information of signed-in users are stored on Firebase.

2. Information We Collect

2-1. User-entered data (device-only when signed out)

• Shopping items: name, price, quantity, checked status
• Purchase records: date, item list (name, price, quantity), total amount, creation time
• Monthly budget, onboarding and app-review flags (stored only on device, never sent to servers)

When you are not signed in, the above is stored only in the device's AsyncStorage and is not transmitted to any server.

2-2. Account data (Firebase Authentication on sign-in)

• Apple ID or Google ID — Firebase Authentication identifier
• Email address and display name — provided by Apple/Google sign-in (Sign in with Apple requests email and name)
• Profile photo URL (photoURL) — when provided by Google sign-in

2-3. Server-stored data on sign-in (Firestore basket-db)

Once signed in, the following is stored in Firestore and synced across devices — regardless of whether you also use family sharing. On your first sign-in, any shopping items and purchase records that were on your device are uploaded once.

• users/{uid}: email, displayName, photoURL, provider (apple/google), updatedAt, familyId. Server-only fields hasRemovedAds and removeAdsPurchasedAt (the app can read, only the server writes)
• users/{uid}/cartItems: shopping items (name, price, quantity, checked status, author uid and display name, creation/update timestamps)
• users/{uid}/purchaseRecords: purchase records (date, items, total, buyer uid and display name, creation time)
• families/{id}: group name, owner uid, member list (uid, display name, role, join time, provider), 6-digit invite code (valid for 24 hours)
• families/{id}/cartItems, families/{id}/purchaseRecords: when you belong to a family, shopping items and purchase records are stored under families rather than under users/{uid}.

2-4. Advertising identifiers

• iOS: the IDFA is used by Google Mobile Ads (AdMob) only when App Tracking Transparency (ATT) is granted.
• Android: the Advertising ID (AAID) is used. You can reset the Advertising ID or opt out of personalized ads in device settings.
• Device info and IP address — processed by AdMob to serve ads

2-5. Firebase Analytics (GA4) events

• Feature events such as usage, screen views, shopping completion (item count and total amount), monthly budget amount, ad-removal purchase (transaction ID, currency, amount), and UMP/ATT consent results
• When signed in, the Firebase uid is set as the Analytics user ID (setUserId) and is cleared on sign-out.
• Free-text input such as item names or memos is never sent as event parameters. Amounts (shopping totals, monthly budget, payment amounts) are sent.
• Not collected on the Simulator. On real devices, development builds are also collected.

3. Data Storage and Location

• Device-local storage (AsyncStorage) — all data when signed out, and device-only settings such as monthly budget when signed in
• Google Firebase — Firestore (database name basket-db), Authentication, Analytics (GA4), Remote Config. Operated on Google Cloud infrastructure.
• All transport is encrypted via HTTPS/TLS.

4. Advertising (UMP, ATT, AdMob)

• Right after onboarding, the following sequence runs: UMP consent → iOS ATT → ad SDK initialization. No ad is requested before this flow completes. On iOS, if the ATT prompt receives no response for 30 seconds, ad requests proceed; the Advertising Identifier (IDFA) is not used unless you allow tracking.
• The UMP consent dialog is shown only in regions that require it (EEA, UK, etc.), based on AdMob console settings. If UMP does not permit ad requests, no ads are requested at all.
• Users in the EEA and UK choose their personalized-ads consent on first launch and can change or withdraw it any time from Settings > App Info > Ad privacy settings inside the App (the menu row is shown only in regions where consent is required). If consent is declined, non-personalized ads are shown.
• Declining iOS ATT does not disable ads; personalization status is handled by the Google SDK based on consent and ATT. However, if UMP consent status cannot be determined (for example, the consent check times out or fails and no previously stored consent can be confirmed), the App does not request ads until consent status can be confirmed.
• In regions that require consent (EEA, etc.), the three ad-related Firebase Analytics Consent Mode signals (ad_storage, ad_personalization, ad_user_data) default to denied before consent is confirmed, and follow the user's ad consent choices afterward. Analytics collection is handled separately from ad consent.
• Ad formats: banner, interstitial, and app open (no rewarded or native). Ads are shown identically regardless of sign-in state.
• House promo card: not served through an ad network. Based on the Remote Config value house_promo, it may appear once a day in the banner slot. Tapping it opens an HTTPS marketing-tracking link in the external browser. Only the icon image is fetched from an external URL.

5. Ad Removal (one-time in-app purchase)

• Product ID: kr.tez.shopping.basket.removeads, non-consumable, restore supported
• The authoritative price is the amount shown in the Apple App Store or Google Play.
• After purchase, the three ad formats, the house promo card, and the Fridge-Butler install toast shown after shopping is finished are all disabled. Firebase Analytics and Remote Config continue to operate.

6. Remote Config

• Managed keys: a single key house_promo (house-promo card content)
• No user identifier is sent to the server; values are fetched at one-hour intervals.

7. Sending Items to Fridge Butler

• This runs only when you explicitly tap "Send to Fridge Butler."
• If Fridge Butler is installed, the item is passed on-device app-to-app via the custom URL scheme fridge://import. What is passed: item name (up to 60 characters) and quantity, with a cap of 50 items. Nothing is sent to the Studio's servers or any external server.
• If Fridge Butler is not installed, https://go.tez.kr/fr/basket (a marketing-tracking link to the app store) opens in the external browser. Typical web-request information (IP, User-Agent, etc.) is transmitted, but item names and quantities are not included.

8. Third Parties and Sub-Processors

We do not share personal data with third parties except for the following sub-processors:

• Google LLC — Firebase Authentication, Firestore (basket-db), Firebase Analytics (GA4), Remote Config, Google Mobile Ads (AdMob)
• Apple Inc. — Sign in with Apple
• Expo (650 Industries, Inc.) — app updates via expo-updates (u.expo.dev). User-entered data is not transmitted.

No user-entered data is sent to any external AI service (the App has no AI feature).

9. Retention and Deletion

• Local data: removed immediately when you delete items in-app or uninstall the App.
• Sign-out: the device's shopping items and purchase records are cleared. Server-side user data is retained and restored on next sign-in.
• Account deletion: your server-side users/{uid} document and its shopping items and purchase records are deleted, the Firebase Auth account is deleted, and device data is cleared. To revoke the Sign in with Apple link, open iPhone Settings → [your name] → Sign in with Apple, select this app, and tap Stop Using Apple ID.
• If a family group owner leaves: the group is dissolved, all family-shared data is deleted, and other members' familyId is cleared.
• If a non-owner member leaves or deletes their account: that member is removed from the roster, but items and purchase records they added to the shared list (including their display name and uid) remain in the family data.
• Backups: kept for disaster recovery — point-in-time recovery for 7 days and weekly backups for 14 weeks — then deleted automatically. Deleted data may remain in backups for this period and is used only for recovery

10. User Rights

• Edit or delete items and records directly in the App.
• Sign out — device data is cleared; server data is retained.
• Account deletion — Settings → Account Deletion removes server and device data together.
• Email requests: supports@tez.kr

11. OS Permissions

• iOS: only App Tracking Transparency (ATT) is actively requested from the user. Camera, Photos, Contacts, Notifications, and Location are not requested.
• Android: no runtime permissions are requested from the user. The manifest includes internet, billing, and vibrate for the app itself, plus Advertising ID, ad measurement (Privacy Sandbox), and install-referrer permissions used by the ad SDK. External storage and "Display over other apps" were removed in 1.6.0.
• The clipboard is used only to copy a family invite code (write-only).

12. Children's Privacy

The App is not directed to children under 14 and does not knowingly collect personal data from them.

13. Security

• TLS 1.2+ encryption in transit
• Firestore Security Rules isolate per-user and per-family data access.
• Server-only fields (hasRemovedAds, removeAdsPurchasedAt) are read-only from the client; writes occur only on the server.

14. Policy Changes

We will provide advance notice via the App or this page before any material change to this policy.

15. Contact

For privacy inquiries or to exercise your rights, contact supports@tez.kr.