Version 2026-11-07. This page is the permanent record of this version and never changes. The current version is at /privacy/.
Português ·
Every version
Privacy policy
In force since 7 Nov 2026.
This is an English translation. The Portuguese version of this policy is the one that governs, and it prevails if the two ever differ: Política de privacidade.
1. Who looks after your data
Freedom Hub Brazil LTDA, CNPJ 55.802.734/0001-86, Avenida Paulista, 1471, Conj. 1110, Sala 01, São Paulo, SP, CEP 01311-927, Brazil ("Estoki", "we"), is the controller of the personal data processed in the Estoki apps, the Estoki kiosk and on estokiapp.com.
This policy explains what personal data we process, why, who else handles it, how long we keep it and what your rights are. It is written under Brazil's data protection law, the LGPD (Lei 13.709/2018).
2. Who Estoki is for
Estoki is for adults running a household, to keep track of what it has in stock. You must be 18 or over to have an account. Estoki isn't directed at children.
3. What we process, and why
3.1 Your account
| Data | Where it comes from | What it is for |
|---|---|---|
| Your name and email address | Google or Apple, when you sign in with them | to identify your account, and to show your name to your household |
| A sign-in identifier from Google or Apple | Google or Apple | to sign you in |
| Your language, when you created your account and when you last signed in | the app | to show Estoki in your language, and to run your account |
| The legal texts you accepted, and when | the app, when you sign in or accept a new version | to record what you agreed to |
With Sign in with Apple you may hide your email address. We then receive an address Apple relays to you, and never your own.
Legal basis: performing the contract you enter into with us by accepting the Terms of use (LGPD Art. 7, V).
3.2 Your household
Your household's name, country and time zone; the names of the people in it; and everything you record: rooms, units and spots, products and their photos, stock, dates, grab bags, and a list of each change with who made it and when. Invite codes are kept too, and stop working after 7 days.
Everyone in your household sees all of it, including your name beside the changes you made. Nobody outside your household does.
Legal basis: performing the contract (Art. 7, V).
3.3 Kiosks
A storage-room kiosk, if your household has one, has its own account that can only see and change your household's stock. It isn't tied to any person, and records its changes as the kiosk.
3.4 Barcodes and shared product names
When you scan a barcode we don't know, our server asks Open Food Facts (openfoodfacts.org) for the product's name and photo. Only the barcode is sent, never anything about you, and your phone never contacts Open Food Facts itself.
When your household names a product, its name, brand and size, never your stock or your photos, may be suggested to other households that scan the same barcode. What is shared carries nothing that points back to your household. You can turn this off in your household's settings.
If you report a suggested name as wrong or offensive, we stop suggesting it straight away and keep your report: the barcode, the name as it was shown, your account identifier and your household's identifier, so we can look into it.
Legal basis: legitimate interest (Art. 7, IX), in suggesting names that save every household typing, and in keeping those names fit to show.
3.5 Usage statistics and crash reports
Both are off until you turn them on, with Share usage and crash reports in Settings. You can turn them off there at any time: the app then stops sending both at once.
The apps use Google Analytics for Firebase to count how Estoki is used: which screens are opened, the device's model and system version, the app's version, a random identifier for the app on your phone, and the country you're in. On Android it also sends the advertising ID.
The apps use Firebase Crashlytics to send us a report when they crash: what went wrong, the device, the system and the app's version. A crash report may carry your Estoki account identifier, so we can find what went wrong for you.
Neither ever receives your name, your email address or what your household keeps.
Legal basis: your consent (Art. 7, I), given when you turn the switch on and withdrawn when you turn it off. The app works the same either way.
3.6 Notifications
Only if you allow them on your phone. Estoki can send you a weekly summary (what is past its date, what is due within a month, and how much is on the shopping list) and a short message the morning after something in your household passes its date. Each is on until you turn it off in Settings, then Notifications; turning notifications off for Estoki in your phone's settings stops both on that phone.
To send them, we keep:
| What | Why |
|---|---|
| A notification token for each phone where you allow them, which system the phone runs (Android or iOS), and when the token was last updated | to address the notifications to your phone |
| Your choices: which notifications you want, and the summary's day and time | to send what you chose, when you chose |
A notification carries the names of products your household keeps and how many are due. It reaches your phone through Google's Firebase Cloud Messaging and, on an iPhone, Apple's push notification service.
Legal basis: performing the contract (Art. 7, V): the notifications are part of the service you asked for, and you choose whether to receive them.
3.7 Product photos
A product can have a photo, shown when you open the product and in Edit product. It comes from one of two places:
- Open Food Facts, when the product's barcode has a photo there. Our server keeps a copy, which every household with that barcode sees. It is a picture of the product, and says nothing about you.
- Your phone, when someone in your household takes a photo or chooses one in Edit product. Only that one picture is sent: Estoki never looks through your photo library. Our server shrinks it and saves it again without its metadata, so it no longer carries where or when it was taken, or on which phone.
Everyone in your household sees your household's photos. Nobody outside it does, and they are never suggested to other households. A photo is meant to show the product: take it so that nobody is in the picture.
Legal basis: performing the contract (Art. 7, V): the photo is part of the service you asked for, and only you choose to add one.
3.8 Meal ideas
Only when someone in your household asks for them, with Suggest on the Meal ideas screen. To make 2 or 3 ideas, our server sends Google, whose Vertex AI service runs Claude, an AI made by Anthropic, in the European Union:
- the products your household has in stock and in date: each one's name, brand, size, category, how many there are and its earliest date;
- how many adults, children and babies live in your household, and today's date;
- what the ideas are for (a snack, dinner or the baby) and the language to answer in.
Never your name, your email address, your household's name, its spots or its photos. Product names are what your household typed, so don't put anything about a person in them.
The ideas come back to our server, which keeps the last ones of each kind for your household, and counts how many your household has used this month.
Google processes what we send on our behalf, under Google Cloud's terms, only to make the ideas; it does not use it to train any model, and Anthropic does not receive it.
Legal basis: performing the contract (Art. 7, V): the ideas are part of the service your household asked for, and nothing is sent until someone asks.
3.9 Estoki Plus
Estoki Plus is sold by Google Play and the App Store, not by us. You pay them, under their own terms and privacy policies, and we never see your card, your billing address or your store account.
For your household, our server keeps:
- whether it has Estoki Plus, on a free trial or a subscription, until when, and whether its free trial has been used;
- for each subscription: the store, the plan, the store's purchase token or transaction number, its state and dates, whether it renews, and who in the household bought it;
- a random code for your household, which the app gives the store when you buy, so the store's record of the purchase says which household it is for.
Our server asks the store about a purchase when it is made or restored, and again before it renews, to know whether it is paid. Everyone in your household sees that it has Estoki Plus, until when, and who bought it.
Legal basis: performing the contract (Art. 7, V): Estoki Plus is a service your household chose, and it can't be given without knowing it was paid for.
3.10 Our servers' logs
Our servers keep technical logs of requests: when, from which account, and what failed.
Legal basis: legitimate interest (Art. 7, IX), in finding and fixing faults and keeping the service secure.
3.11 What we do not do
- We do not collect your location or contacts, and we never look through your photo library: the only photos we receive are the ones you take or choose for a product (section 3.7).
- A barcode scanned with the camera is read on your phone, and no picture of it is sent to us.
- We do not sell your data, or share it for advertising, and we do not show ads.
- We do not make automated decisions about you.
4. Who else handles your data
We use these companies to run Estoki. Each processes your data on our behalf and only as we instruct (operators, LGPD Art. 5, VII):
| Company | What it does for us | What it receives |
|---|---|---|
| Google (Firebase and Google Cloud) | sign-in, our database, our servers, storing product photos, notifications, usage statistics and crash reports, and meal ideas, with Claude on its Vertex AI service | everything in section 3 |
| Apple | Sign in with Apple, if you use it; delivering notifications to an iPhone | what Apple needs to sign you in; a notification's text and your iPhone's notification token |
| Open Food Facts | the name and photo of a product we don't know | the barcode, and nothing about you |
Google Play and the App Store sell Estoki Plus themselves (section 3.9): what you give them to pay is theirs, under their own privacy policies, and they tell us only what section 3.9 lists.
The people in your household see your name and what you record in it (section 3.2).
We share data with authorities only when the law or a court requires it.
5. Where your data is
| What | Where |
|---|---|
| Our database, our servers and product photos | Belgium (Google Cloud, europe-west1) |
| Sign-in | Google's global infrastructure, with no fixed region |
| Notifications | Google's and Apple's global infrastructure, with no fixed region |
| Usage statistics and crash reports | United States (Google) |
| Meal ideas, while they are made | European Union (Google Cloud, Vertex AI) |
| Our server's questions to Google Play and the App Store about a purchase | Google's and Apple's global infrastructure, with no fixed region |
The legal basis for each transfer abroad (LGPD Art. 33):
- our database, our servers, product photos and meal ideas: the standard contractual clauses approved by the ANPD, which Google Cloud's terms include (Art. 33, II, b);
- sign-in: performing the contract (Art. 33, IX with Art. 7, V), since you cannot have an account without it;
- notifications: performing the contract (Art. 33, IX with Art. 7, V), since a notification can't reach your phone without passing through them;
- usage statistics and crash reports: your specific consent (Art. 33, VIII), given with the switch in section 3.5;
- Estoki Plus: performing the contract (Art. 33, IX with Art. 7, V), since a purchase can't be checked without asking the store that took it.
6. How long we keep it
| What | How long |
|---|---|
| Your account, and your household's data | until you delete your account, or delete the item yourself. When the last person leaves a household, the household and everything in it are deleted, kiosk accounts included |
| Invite codes | 7 days |
| A photo taken or chosen on a phone | until someone replaces or removes it, or the product's household is deleted |
| A phone's notification token | until you sign out on that phone, turn notifications off for Estoki on it, or delete your account; a token not updated for 60 days is deleted |
| Reports of a product name | until we've reviewed them, or you delete your account |
| Your household's Estoki Plus records | until the household is deleted; if the person who bought it deletes their account, the records stay with the household, without their name, while the subscription runs |
| Your household's last meal ideas | until someone asks for new ones of the same kind, or the household is deleted |
| Server logs | 30 days, as Google Cloud keeps them |
| Usage statistics | 14 months at most |
| Crash reports | 90 days, as Crashlytics keeps them |
7. Deleting your account
You can delete your account in the app: Settings, then Delete account. It deletes, at once and for good:
- your account, your name and email address, and your acceptances;
- your notification tokens and choices;
- your place in your household;
- any report you made of a product name;
- if you're the last person in your household, the household too, with all its spots, products and their photos, stock, history, grab bags, kiosk accounts and Estoki Plus records.
Deleting your account doesn't cancel an Estoki Plus subscription you bought. Cancel it first in Google Play or the App Store, wherever you bought it, or it goes on renewing.
If others remain in your household, the stock you recorded and the photos you added stay theirs, and the history keeps the changes you made without your name. Product names your household shared stay, since they say nothing about you.
If you can no longer open the app, write to contact@4freedomhub.com from the email address of your account, and we delete it in the same way. How to delete your account.
8. Security
- Who can read and write what is enforced by rules on our servers, not by the app. A modified app can't reach another household's data.
- Your data is encrypted in transit and at rest by Google's infrastructure.
No measure removes every risk. If a security incident puts your data at relevant risk, we tell the ANPD and you within 3 business days of learning that it reached personal data, as Art. 48 of the LGPD and ANPD Resolution 15/2024 require.
9. Your rights
The LGPD (Art. 18) gives you the right to:
- confirm that we process your data, and get a copy of it;
- correct data that is incomplete, wrong or out of date;
- have unnecessary or excessive data anonymised, blocked or deleted;
- receive your data in a format you can use, or have it sent to another provider;
- delete data processed with your consent, and withdraw that consent at any time;
- know who we share your data with;
- know what happens if you don't consent;
- object to processing based on legitimate interest;
- complain to the ANPD, Brazil's data protection authority.
Much of it you can do yourself in the app: change what your household records, turn shared product names and usage reports off, leave your household, and delete your account.
For anything else, write to contact@4freedomhub.com. We answer requests to confirm or access your data within 15 days (LGPD Art. 19, II), and every other request within 30 days. We may ask you to show it's you, since giving your data to someone else would be a leak in itself.
10. Data protection officer
Encarregado: Jonathan Silva dos Santos. Contact: contact@4freedomhub.com.
You can write to the data protection officer about anything to do with your personal data, including to use the rights in section 9.
11. Changes to this policy
When this policy changes in a way that matters, we publish a new version with a new date and ask you to accept it in the app.
Earlier versions stay published, unchanged. The record of your acceptance names the version you accepted, and that version can still be read. A correction never rewrites a published version: it becomes a new one. Every version.
12. Contact
Privacy, your rights and anything else: contact@4freedomhub.com.
You can also complain directly to the ANPD, at gov.br/anpd.