Skip to content
Mango & Dill
Language: DEEN
← Back to the home page

Legal

Privacy policy

Last updated: 22 August 2026

In short

The app has no server of its own. Your lists, dishes and plans live in your private iCloud — the developer has no access to them. No ads, no tracking, no analytics services in the app.

This is a convenience translation. In any legal dispute the German version of this privacy policy is the authoritative one.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Felix Barth[PLATZHALTER: street and number][PLATZHALTER: postcode and town]GermanyEmail: support@mangodill.app

2. The essentials

Mango & Dill is deliberately built to collect as little as possible:

  • No user account. The app has no account system of its own, no sign-up and no login.
  • No server of its own. The developer runs no backend. All content lives solely on your device and — if you use iCloud — in your private iCloud.
  • No analytics, tracking or advertising services. The app contains no third-party analytics, crash-reporting or advertising SDKs and builds no usage profiles.
  • No developer access to your content. Your data is stored in the private CloudKit database of your Apple account; the developer technically cannot view it.

3. What data is processed — purposes and legal bases

3.1 Content data (shopping lists, ingredients, dishes, meal plans)

The content you create in the app (list entries, ingredients, recipes, meal plans, settings such as the chosen store layout) is stored locally on your device. If you are signed in to iCloud, the app syncs this content through Apple's CloudKit service into the private iCloud database of your Apple account so that it is available on your devices.

  • Purpose: providing the core functions of the app and syncing between your devices.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the usage relationship via the app).
  • Recipients: Apple as the operator of iCloud/CloudKit (see section 4). The developer receives no access to the content.

3.2 Shared lists (iCloud sharing / CKShare)

When you share your shopping list with other people, the app uses Apple's iCloud sharing function (CKShare). The shared list content then becomes visible and editable for the people you invited, through their own iCloud access. Depending on the iCloud settings, participants may see each other's name or Apple account identifier; that display is managed by Apple.

  • Purpose: using one shopping list together within a household.
  • Legal basis: Art. 6(1)(b) GDPR. Sharing only happens when you actively start it; you can end the share at any time in the app.

3.3 Calendar (EventKit)

If you choose, the app mirrors your meal plan into your device calendar. iOS asks you once for calendar permission. The calendar entries are created and updated purely locally through the iOS calendar function (EventKit); nothing is transmitted to the developer.

  • Purpose: showing the meal plan in your calendar.
  • Legal basis: your consent, Art. 6(1)(a) GDPR, given through the iOS permission dialog. You can withdraw it at any time in the iOS settings (Privacy & Security → Calendars); the app remains fully usable without the calendar mirror.

3.4 Location (store detection)

Optionally the app can use your approximate location to recognise the supermarket near you and sort the shopping list by that store's walking route. The feature is opt-in in the list settings and only asks for the iOS location permission when you use it. As long as store detection is switched on, the position is determined once each time you open the app.

The position is passed to Apple's mapping service (Apple Maps) for a search of nearby stores; matching the results against the built-in store layouts then happens on your device. No location is transmitted to the developer or any other third party, no movement profile is created, and there is no background location tracking. Only your store selection is stored (as a setting, see 3.1).

  • Purpose: suggesting the matching store layout for sorting the shopping list.
  • Recipient: Apple as the operator of the mapping service that handles the nearby search (see section 4).
  • Legal basis: your consent, Art. 6(1)(a) GDPR, given through the iOS permission dialog; withdrawable at any time in the iOS settings. Without location access you can pick the store manually.

3.5 Notifications

The app only asks for notification permission once you share a list. Notifications summarise activity in the shared list (for example “Shopping list updated — 3 changes to your list”). Sync signals are delivered through Apple's push infrastructure (CloudKit push); the developer runs no push server of their own and receives no content in the process.

  • Purpose: informing you about changes to shared lists.
  • Legal basis: your consent, Art. 6(1)(a) GDPR (iOS permission dialog); withdrawable at any time in the iOS settings.

3.6 Live Activity “shopping mode”

In shopping mode the app can show a Live Activity on the lock screen or in the Dynamic Island (open items, ticking-off progress). That display is generated and updated purely locally on your device; no data is transmitted to the developer or third parties for it.

4. Apple as infrastructure provider (iCloud/CloudKit)

For syncing and sharing the app uses Apple's iCloud/CloudKit services. Your content data is stored on Apple servers — but within the storage area of your own Apple account (private or shared CloudKit database), to which the developer has no access. Apple acts here as a technical infrastructure provider under your own iCloud agreement with Apple; there is no processor-like arrangement giving the developer access.

Apple's processing is governed by the iCloud terms and Apple's privacy policy:

Whether and how your iCloud data is end-to-end encrypted or encrypted by default (for example with Advanced Data Protection) depends on your iCloud settings with Apple.

5. This website

When you open this site, server log data is processed. In addition, a self-hosted, cookie-free counter records page views in aggregated form; no profiles are built and no data is passed on to third parties.

  • Server log data: for every page request the web server processes the IP address, date and time, the requested address, the HTTP status code, the amount of data transferred and the browser and operating system identifier. This data is required to keep the site secure and working; the legal basis is Art. 6(1)(f) GDPR (interest in a secure, working web presence). It is not merged with other sources and is deleted after seven days at the latest.
  • Visitor counter: a counter running on the same server records only which page was viewed how often. It sets no cookies, stores no IP addresses in plain text, uses no cross-device identifiers and builds no usage profiles. The legal basis is Art. 6(1)(f) GDPR (interest in a rough measure of reach). Since no information is stored on or read from your device, no consent under section 25 TDDDG is required.
  • No third parties: no advertising, analytics or social media services are embedded. No content is loaded from external servers; the typefaces, too, are served by this server itself. No data is passed on to third parties.
  • Getting in touch: if you write to the email address given above, the controller processes your message solely in order to deal with your request (Art. 6(1)(b) or (f) GDPR) and deletes it once it is no longer needed.

6. No analytics, no tracking, no advertising

The app contains no advertising, tracking or analytics services and no third-party SDKs that collect data. No usage statistics are transmitted to the developer and no data is processed or passed on for advertising purposes. Voluntary crash and diagnostic reports to Apple are controlled by you in your iOS settings (“Analytics & Improvements”); they are not part of the app.

7. Storage period and deletion

Your data stays stored until you delete it:

  • Individual content (items, dishes, plans) can be deleted at any time directly in the app; the deletion is carried over to your devices and shared lists through iCloud.
  • Shared lists: if you end a share, the invited people lose access. As the owner of the list, it stays in your iCloud storage.
  • All app data: delete the app from your device and additionally remove the app's iCloud data (iOS settings → [your name] → iCloud → Manage Storage, or “Delete from all devices”). After that the content is removed from your iCloud storage; for any backups, the Apple mechanisms of your account apply.
  • The developer stores no user data at all and therefore keeps no deletion periods of their own.

8. Your rights

You have the rights set out in Art. 15–21 GDPR against the controller: access, rectification, erasure, restriction of processing, data portability and objection to processing based on Art. 6(1)(f) GDPR. Any consent you have given (calendar, location, notifications) can be withdrawn at any time with effect for the future — most easily in the iOS settings.

A practical note: since the developer has no access to your content, you can exercise access, rectification and erasure of your content data directly yourself, in the app or through your iCloud settings. For questions and requests you can reach the controller at the email address given above.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the authority where you habitually reside or with the authority responsible for the controller in [PLATZHALTER: federal state].

10. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The dish suggestions in the app are simple, rule-based calculations on your device.

11. Changes to this policy

If the scope of the app changes (for example new features that involve data), this privacy policy will be updated. You will always find the current version at this address and in the app.