Privacy policy

Last updated: 22 October 2026. This policy applies to the website shopkobel.com and to the Shopkobel app (Android).

1. Controller

Marco Desiderio (BEng.), Cookobel · Dienstleistungen rund um das Internet und Werbung, Niethammerstr. 13, 74189 Weinsberg, Germany · Email: madex@madex.biz

2. In short

3. This website

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, which acts as our processor. When you visit, the server processes technically necessary information (IP address, time, page requested, browser) so that the page can be delivered and to keep the service secure (legitimate interests, Art. 6(1)(f) GDPR). The IP address is only stored in shortened form in the log files. Fonts and images are on the same server; no third-party content is embedded.

4. Contact

If you write to us by email or through the contact form, we process your email address, your name if you give it and your message in order to reply (Art. 6(1)(b) or (f) GDPR). The form sends the details to us by email and stores nothing on the website. We delete messages once the matter is settled, unless a statutory retention obligation applies.

5. The Shopkobel app

5.1 What stays on your devices

The app stores your lists and items, what you buy often, the learned order of your shop and your settings only on your devices. When it first starts, it creates a random device ID; it reveals nothing about you.

Backup. Once a day Shopkobel saves a backup file to the “Download/Shopkobel” folder on your device; where you send it is up to you. Android's automatic backup to your Google account is switched off for Shopkobel; Android does not copy the app's data when you move to a new device either.

5.2 Shared lists over Wi-Fi

To share lists with other devices, you pair them with a QR code. After that the devices sync their lists directly with each other, on the same Wi-Fi and encrypted with a key that only your devices know. So that your devices can find each other, the app announces itself on the local network with a short form of your shared lists' ID, the device ID and the device name; other devices on the same Wi-Fi can see this. Your other devices show the device name (from Android) in their device list. None of this reaches us.

Edit on your PC. On the same Wi-Fi, your device serves Shopkobel to the browser on your PC; you connect with a QR code containing a one-time key. The lists only travel between your device and the PC, encrypted. Nothing stays in the browser after you disconnect.

5.3 Real-time sync on the go (mailbox)

If you switch on “Real-time sync on the go” on a device, the app sends changed lists as encrypted packets to our mailbox kasten.madex.biz (server at ALL-INKL.COM in Germany), and your other devices collect them there. The packets are end-to-end encrypted; only your devices have the key, and we cannot read the content. The mailbox only sees random IDs (your shared lists and your devices), a checksum of the access key, the size and time of packets and when a device last collected. It deletes a packet as soon as all devices have collected it, after 7 days at the latest. The legal basis is the contract of use (Art. 6(1)(b) GDPR).

When shared lists register with the mailbox for the first time, it processes a checksum of the IP address so that nobody can create any number of them from one connection, and deletes it after 2 days (legitimate interests, Art. 6(1)(f) GDPR). If you switch real-time sync off or remove a device, the app signs it off at the mailbox; a device that has collected nothing for half a year is deleted automatically.

So that only the genuine Shopkobel app from Google Play uses the mailbox, each device obtains a confirmation through Google's Play Integrity service on first contact and roughly every 30 days after that: Google confirms that the app comes unmodified from Google Play and runs on an unmodified device. For this the app creates a key whose secret part never leaves the device. The mailbox has Google decrypt the confirmation, checks it and does not store it; it only stores the public part of the key with an expiry date under the device's ID. The device signs every further request with this key. The legal basis is our legitimate interest in protecting the service against misuse by modified apps (Art. 6(1)(f) GDPR). What Google checks on the device for this is governed by Google's terms.

5.4 Speaking and text from pictures

Speaking. For dictation, Shopkobel opens your Android device's voice input (usually the Google app). That app does the recording, under its provider's terms – depending on the device, also on the provider's servers. Shopkobel only receives the recognised text.

Screenshots. The text recognition of Google Play services (ML Kit) reads the text in a screenshot or shared picture on the device. The picture does not leave the device for this, and Shopkobel does not keep it – only the text.

5.5 Working with Cookobel and Todokobel

Shopping from Cookobel, reports back to it and tasks in Todokobel go through Android directly from app to app on your device. None of this reaches us.

5.6 Full version through Google Play

You buy the full version through Google Play; Google handles payment, invoicing and refunds under its own privacy policy. We receive no payment data. The app keeps the purchase data signed by Google (product, order number, purchase token, time and a checksum of your shared lists' ID) on the device and passes it on to your other devices when syncing – encrypted, see 5.2 and 5.3 – so that the full version applies there too.

So that a refunded purchase ends, our service ki.madex.biz (server at ALL-INKL.COM in Germany) asks Google once a day for refunded purchases and keeps only a list of checksums of their purchase tokens. Devices with the full version download this list at most every 12 hours without sending any ID; the server logs the request as it does for the website (see 3.). During the first 21 days the app also asks the same service for the time, at most every 6 hours and again without any ID, so that a changed clock cannot extend the free trial. The legal basis is the contract (Art. 6(1)(b) GDPR).

5.7 Google Play services

For scanning QR codes, text recognition and purchases, the app uses components of Google Play services (code scanner, ML Kit, Play Billing). QR codes and text are read on the device. Google's privacy policy applies to these components. The app contains no advertising or analytics services.

6. Recipients

7. How long we keep data

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time with effect for the future. Just send us an email. As we store no names or email addresses, we can only match data to you if you tell us something that identifies it – for example the order number of a purchase from your Google Play confirmation (Art. 11 GDPR). We do not store your lists; they are on your devices, where you delete them yourself, as you do the whole app.

You can also complain to a data protection supervisory authority; the one responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Children

Shopkobel is intended for adults. Purchases through Google Play require a Google account, for which Google has its own age rules.

10. Changes

If the way Shopkobel handles data changes, we will update this policy. The version with the latest date at the top of this page applies.