Privacy

This describes what Cartunda holds about you, why, and what you can do about it. It describes the software as it actually behaves — every item below corresponds to something the site really stores.

The short version

• An account is an email address, a name you choose, and a password.
• Joining a purchase shows the organiser and the other members what you ordered and what you owe — unless you hide your items, which you can.
• There is no advertising, no analytics, no tracking, and one cookie, which keeps you signed in.
• The browser extension is optional. It reads a page only when you press its button, and it keeps its access token on your own machine.
• You can download everything held about you, and you can have it erased.

What is collected, and why

Your account

Your email address, the name you chose to display, and a hashed password — hashed, so it cannot be read back, here or by anyone who steals the database. Also when you verified your address and when you last signed in. The email address is how you sign in and how the site writes to you; without it there is no account.

If you sign in with Google

Google tells the site your address and basic profile — name, and a picture link if your Google account has one — and that is stored so the accounts stay connected. Google is told that you signed in here. If you would rather they were not, use a password instead.

What you order

The items you add to a purchase: title, link, variant, quantity, price, any note you write, and the totals worked out from them. The organiser of that purchase can see all of it — they have to place the order. Other members see it too, unless you switch your items to private on that purchase, and you can set that as your default for every purchase you join.

You can also use a made-up name within a purchase. That hides your real name from the other members; the organiser still sees both, because they are the person collecting money from you.

Joining without an account

If somebody invited you as a guest, the name and address you gave are stored against that purchase so the organiser knows who ordered what. Registering later with the same address, once it is verified, joins those orders to your new account.

How you get paid, if you organise

The bank account, handle or instructions you save are stored so they can be shown to the people who owe you. They are shown to those people — that is their purpose. Cartunda never moves money, never touches a payment, and has no card details of yours because it never asks for any.

People you collect from

If you tag part of your order for a friend and enter their email so the site can send them their share, that address is stored against your tag. It is yours to remove, and it goes when you delete your account.

Subscriptions

If you subscribe to an organiser's updates, your address is stored against their list, along with when you confirmed it. Nothing is sent to an address until it confirms. The organiser sees a count and never the addresses. Every message has a one-click unsubscribe link that needs no account and does not expire.

Security and diagnostics

Actions that change something — signing in, joining, editing an order, confirming a payment — are written to an audit log with the time and the IP address the request came from. This is what makes it possible to answer "who changed this?" and to stop somebody guessing access codes. It is administrative, not analytical: nothing profiles you and nothing is sold.

Email

Every message sent is queued in full — subject and body, which means your name and any amounts in it — so delivery can be retried and so an administrator can see what actually went out. Delivered messages are deleted after 90 days.

The browser extension

The extension is optional and separate — the site works without it. It exists to put an item you are looking at into a purchase, and, if you are the one placing the order, to fill the shop's basket with what everybody asked for.

What it keeps, and where

On your own machine, in the browser's extension storage: the address of this site, an access token, the last purchase you added to, and how many items are in it. Nothing else. None of it is synced to your other browsers — a credential does not belong in something that copies itself between machines. Signing out in the extension erases the token from your machine.

What it reads

The page you are on, and only when you ask it to: the title, the price, the currency, and whatever identifier the shop uses for the product. It reads that when you press its button, not as you browse. It has no standing permission to read any website until you grant one, shop by shop, and you can withdraw those at any time in your browser's extension settings.

It does not read your browsing history, your bookmarks, your saved passwords or your other tabs. It collects nothing for analytics, because there are none.

What it sends here

The item you chose to add — the same information described under What you order above — and nothing beside it. Requests carry the access token, which identifies your account and can do only the things you ticked when you created it.

What it sends to shops

When you fill a basket, the extension acts as you, in your own browser, using the session you are already signed in with. The shop sees the same requests your own clicking would have made, and nothing it would not otherwise see. To read a basket back it may open the shop's own basket page in a background tab.

It never learns your password for a shop, never enters payment details, and never completes a purchase: it fills the basket and stops. Nothing about the shops you visit reaches Cartunda except the items you deliberately add.

Cookies

One: a session cookie that keeps you signed in. It is essential to the site working and carries nothing but a signed session identifier. There are no analytics, no advertising and no third-party scripts, which is why you have not been asked to agree to any.

Who else sees it

• Other people in a purchase you join — as described above. This is the point of the site rather than an incidental disclosure.
• The email provider that delivers the site's mail. It handles the address and content of messages sent to you.
• Google, only if you choose to sign in with Google.
• Shops you order from, if you use the browser extension. It acts as you, in your browser, with the session you already have — so they see what they would have seen had you clicked yourself.

Nothing is sold, rented, or handed to advertisers. Data is disclosed to authorities only where the law actually requires it.

How long it is kept

• Your account and orders — until you delete the account.
• Sent email — 90 days.
• Sign-in and confirmation links — they expire on their own, within days.
• An extension access token — until you revoke it from your account page, or sign out in the extension, which erases the copy on your machine. A revoked token is marked revoked rather than deleted, so the audit log can still say what was done with it.
• The audit log — kept, because its purpose is to answer questions about the past. Your entries are stripped of anything identifying when you delete your account.

What you can do

From your account page, without asking anyone:

• Download everything. One file with all of it, including the parts the interface does not show you.
• Correct it. Your name and preferences are editable there.
• Delete your account. What that does exactly is below, because it is not quite what the word suggests.

You may also object to how data is used here, ask for it in a portable form — the download is that — and complain to your national data protection authority if you think this is being handled badly.

What deleting your account really does

Everything that is only about you is destroyed: your password, your saved payment details, your connected Google account, your subscriptions, and the copies of emails sent to you.

What cannot be destroyed is the part of the record that belongs to somebody else. If you joined a purchase, your order is also a line in the organiser's order, and what you owed is half of a settlement they keep. Deleting those would rewrite their records of what they bought and who paid them. So instead your name and address are overwritten, and those entries survive attributed to a deleted account that cannot be traced back to you or signed into.

Deletion is refused while you owe money on an unsettled purchase, or while you are still organising one — other people are relying on you for those. Settle or finish them and it will go through.

Who is responsible

Cartunda is run by Dovydas Rimeisis, who decides what is collected here and why — in data protection language, the controller.

Statybininku g. 1A-63

Write to [email protected] about anything on this page, including your own data. A person reads that address; nothing on this site does.