GDPR & Your Data Rights

Last updated: June 15, 2026

If you're located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR give you specific rights over your personal data. This page explains those rights and how Debara supports them, alongside our Privacy Policy.

1. What data we process

As described in our Privacy Policy, we only process data you provide directly: account identifiers from Apple/Google sign-in, the pantry and shopping list content you create, household/space membership and aliases, subscription status (via RevenueCat), and basic product analytics (via Mixpanel). We do not sell or share your personal data with third parties for their marketing purposes.

2. Legal basis for processing

• Contract: processing your account and content data is necessary to provide the Service you've signed up for.
• Legitimate interests: product analytics (Mixpanel) help us understand and improve the Service, in a way that doesn't override your privacy rights.
• Consent: where required (for example, certain optional analytics or marketing communications), we rely on your consent, which you can withdraw at any time.

3. Your rights

Under GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten"), for example by deleting your account.
• Portability — request your data in a structured, commonly used format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests, such as analytics.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

Many of these — exporting or deleting your pantry data, leaving a shared household, or deleting your account entirely — can be done directly from the app's settings. For anything else, contact us at support@debara.app and we'll respond within one month, as required by GDPR.

4. International data transfers

Our service providers (including Supabase, Mixpanel, and RevenueCat) may process data on servers located outside the EEA/UK. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms required by GDPR/UK GDPR.

5. Data retention

We keep your personal data only for as long as your account is active or as needed to provide the Service. When you delete your account, your personal data and household content are deleted or anonymized within a reasonable period, except where retention is required for legal, tax, or security reasons.

6. Complaints

If you believe we haven't handled your personal data properly, you can contact us first at support@debara.app so we can try to resolve it. You also have the right to lodge a complaint with your local data protection supervisory authority.

7. Contact us

For any data protection request or question, email support@debara.app.