Privacy policy
Last updated 19 October 2026
BasketBook keeps your grocery receipts and the prices you paid. That's personal information, and this page explains plainly what we collect, why, who helps us run the service, how long we keep it, and what you can ask us to do with it. It is written to meet the Nigeria Data Protection Act 2023.
Who we are
BasketBook is run by Afefe Creative, Lagos, Nigeria. We are the data controller for the information you put into BasketBook. For anything about your data, email hello@basketbook.app.
What we collect
- Your account: your name, email address and password. The password is stored scrambled (hashed), so nobody, including us, can read it.
- Your receipts: the photos you take, and what is read from them: store, date, items, quantities, prices and totals, plus any changes you make.
- What you build in the app: product names, shopping lists and your settings (such as your currency and price alert level).
- Questions you ask: when you use Ask, your question is used to write the answer. We don't keep a history of your questions.
- Sign-in and security details: when you log in we record your IP address and browser type with your session, and we count login attempts per IP address to block password guessing.
We don't use advertising or analytics trackers, we don't show ads, and we never sell your data.
Why we use it
- To run BasketBook for you (performing our agreement with you): reading receipts, saving them, working out prices and spending, suggestions and answers.
- To keep accounts safe and the service working (our legitimate interests): stopping password guessing, fixing problems, and keeping backups so your history isn't lost.
- To email you about your account: confirming your email address and resetting your password. We don't send marketing emails.
- To meet legal obligations where the law requires it.
Who helps us run it
These companies process data for us, only to provide BasketBook:
- Cloudflare runs the app, stores your account, receipts and photos (in Western Europe), and sends our emails.
- OpenRouter and the AI model provider it routes to (currently Google's Gemini) read your receipt photos and write answers to your questions. Each photo is shared through a private link that expires within minutes.
- Backblaze stores our encrypted off-site backups (in the European Union).
- GitHub runs our automated backup jobs.
These providers work under their own data protection terms. If we change providers, we'll update this list.
Where your data is stored
Your data is stored outside Nigeria, mainly in Western Europe, and some providers above are based in the United States. We transfer it on the basis of your agreement to use BasketBook and the protections these providers offer, as the Nigeria Data Protection Act allows.
How long we keep it
- While you have an account, we keep your receipts and everything you've saved, so your history is there when you need it.
- When you delete a receipt or your account, it is removed from BasketBook straight away.
- Backups are kept indefinitely, including copies made before an account was deleted. Recent backups let us undo mistakes from the last 30 days, weekly copies are kept for 90 days, and monthly and off-site copies are kept with no end date so a serious failure can never wipe out everyone's history. Backups are encrypted, kept apart from the app and only opened to recover from a failure or when the law requires it.
- Login sessions, reset codes and login-attempt counters are short-lived and are never included in backups.
How we protect it
- Everything travels over encrypted connections (HTTPS).
- Passwords are hashed; receipt photos are private and never on a public link.
- Each account can only ever see its own data, and we test for this automatically.
- Off-site backups are encrypted before they leave our servers.
Your rights
Under the Nigeria Data Protection Act you can:
- see the data we hold about you, and get a copy (Settings has a full export any time);
- correct it (you can edit receipts and your details in the app);
- delete it (Settings, then Delete account);
- object to or ask us to limit how we use it;
- withdraw any consent you've given;
- complain to the Nigeria Data Protection Commission if you think we've handled your data wrongly.
Email hello@basketbook.app with “Privacy request” in the subject. We'll reply within 30 days, usually much sooner.
Cookies
We only use the cookies needed to keep you logged in. No advertising or tracking cookies, so there's no cookie banner.
Children
BasketBook is for adults. Please don't create an account if you are under 18.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect. See also our terms.