Privacy policy.
The short version first: we don't want your data. Most of what would need protecting, we never collect in the first place. Below you'll find the full details required by the General Data Protection Regulation (GDPR).
This is an English translation of our German privacy policy. If the two ever differ, the German version applies.
1. Who is responsible
The controller under the GDPR is:
Daniel Kimmich
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach, Germany
Email: info@nimmit.app
We are not legally required to appoint a data protection officer. For any privacy question, please write to the address above.
2. The principle: collect as little as possible
Nimmit is built local-first and with privacy by design. You don't create an account. There's no sign-up, no profile and no newsletter. We use no cookies, no tracking, no analytics tools and no ads. What the app sends to our server is described in section 4.2.
3. This website
3.1 Hosting and server log files
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located in Germany (EU). We have a data processing agreement with Hetzner under Art. 28 GDPR.
When you open a page, the server automatically processes connection data that your browser sends and that is technically necessary. It is kept in server log files:
- IP address (shortened or in full),
- date and time of the request,
- requested file or URL and HTTP status code,
- amount of data transferred,
- referrer URL and browser and operating system identifier (user agent).
Purpose: delivering the website, keeping it stable and fending off attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running the site securely and without disruption). Retention: log files are kept only briefly and are deleted regularly once they are no longer needed for these purposes.
3.2 Fonts (hosted by us)
The font “Nunito” is served from our own server. There is no connection to Google Fonts or any other third party, so your IP address is not sent to anyone else for this.
3.3 No cookies, no tracking, no third-party services
The website is static. We use no cookies, no analytics, no advertising IDs and no social media plugins, and we don't embed any external content. There is no newsletter and no mailing list. We never ask for your email address.
3.4 Encrypted connection
The website is only ever delivered over an encrypted connection (TLS/HTTPS).
3.5 Shared lists via a link
When you open an invite or snapshot link (for example nimmit.app/j#…), the secret
key sits in the part after the # (the URL fragment). Browsers
never send this fragment to a server. Decryption happens only on your own
device. How secure sharing works →
4. The Nimmit app
4.1 Local-first
By default, your shopping lists live only on your device. No list content leaves your phone unless you decide to share it, and you never have to use a cloud.
4.2 No account, no personal data
Nimmit works without signing up. You don't create an account: no profile, no name, no email address, no password to remember. We don't know who you are.
There is still a technical identifier. On first launch, the app creates a random string of characters on your device, and it stays there. It is only sent to our server in Germany when you do something that needs a server: share a list, join a shared list, restore your identity or send us feedback. If you only use the app for yourself, you never sign in anywhere, and nothing about you is stored on our side.
Once that happens, the server stores only this string and the time, plus your IP address while the connection is set up, for operations and to fend off attacks. Legal basis: our legitimate interest in running the sharing feature (Art. 6(1)(f) GDPR).
4.3 Optional sharing and sync (end-to-end encrypted)
A list is only synced through a server if you deliberately make it shareable. Before anything leaves your device, the data is end-to-end encrypted on your device (XChaCha20-Poly1305). The server only stores ciphertext, random identifiers and timestamps, never readable content. We can't decrypt it either.
Sync runs on a server we operate ourselves in Germany. No external sync service receives your data. The server infrastructure is provided by Hetzner Online GmbH (Germany), with a data processing agreement under Art. 28 GDPR in place. Legal basis: your consent, given by actively turning on sharing (Art. 6(1)(a) GDPR), and providing the sync feature you asked for (Art. 6(1)(b) GDPR).
One honest caveat: syncing creates a small amount of metadata (which random identifier synced with which list, and when). The server can see who is a member of a shared list and when they sync. It can never see what is on the list.
4.4 Voice input
Voice input runs directly on your device wherever possible. Where the operating system needs a network connection for it (on some Android devices), speech recognition is handled by the operating system provider (Apple or Google). The app tells you when this is the case. The provider's own privacy policy then applies as well.
4.5 Barcode scanner
When you scan a barcode, the app looks it up in the free product database Open Food Facts to suggest a name and quantity. Only the number is sent, with no list content and no identifier. Open Food Facts is never contacted unless you scan something. Legal basis: providing the feature you asked for (Art. 6(1)(b) GDPR).
As with any visit to another website, Open Food Facts sees your IP address and, by its own account, keeps it for up to three years. It is run by Association Open Food Facts, 21 rue des Iles, 94100 Saint-Maur-des-Fossés, France. Its privacy policy applies.
4.6 In-app purchase “Nimmit Pro”
The app is free. You can unlock “Nimmit Pro” once inside the app. The purchase is handled entirely by the Apple App Store or Google Play. Apple or Google is the seller and processes the payment. We receive no payment data: no name, no address and no payment method.
The app only asks the store whether your store account has bought “Nimmit Pro” and saves the answer as a simple yes or no on your device. No profile is created, and this check never reaches any of our servers. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The store's own privacy policy applies to the purchase itself.
4.7 System backups
System backups (for example iCloud or Android backup) may include app data. You control this in your operating system's settings. It is outside our control.
4.8 Feedback form
In the app's settings you can report a bug or send us an idea. This is voluntary. When you send it, we transmit the type of message, your text, and the app version, platform and operating system version so we can reproduce the problem. The app shows you this information before you send it. The identifier from section 4.2 is not stored with your message, so a message is not linked to your lists.
If you'd like a reply, you can also add an email address. This is optional and only active if you turn on the switch for it. The legal basis is our legitimate interest in fixing bugs and improving the app (Art. 6(1)(f) GDPR), and for an email address you choose to give us, your consent (Art. 6(1)(a) GDPR).
The message is stored on our server in Germany and delivered by email to info@nimmit.app. We keep it for as long as we're working on it and delete it on request to info@nimmit.app. The rights in section 7 apply accordingly.
5. Recipients and processors
- Hetzner Online GmbH (website hosting and the infrastructure for our self-operated sync server, Germany/EU). The sync server stores only ciphertext and is only used when sharing is turned on.
- Apple Inc. / Google LLC: only insofar as the operating system processes voice input, you got the app from their store, or the “Nimmit Pro” in-app purchase is handled there.
- Association Open Food Facts (France): receives the scanned barcode number and your IP address, only when you scan. See section 4.5.
- IONOS SE (Germany): runs the info@nimmit.app mailbox, where feedback messages from the app and your emails arrive. See section 4.8.
We never pass on or sell your data for advertising or any other purpose.
6. Transfers to third countries
Running this website involves no transfers to third countries (hosting and fonts are in the EU). Where voice input, downloading the app or the in-app purchase goes through Apple or Google, processing may take place in the USA. These providers rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses (Art. 46 GDPR).
A barcode scan sends the request to Open Food Facts in France (EU). Open Food Facts does not say where its servers are, so processing outside the EU cannot be ruled out.
7. Your rights
Under the GDPR, you have the right to:
- access (Art. 15), rectification (Art. 16) and erasure (Art. 17),
- restriction of processing (Art. 18) and data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw any consent you have given, with effect for the future (Art. 7(3)).
Important: because we deliberately collect no identifying data and shared content is end-to-end encrypted, we usually can't link anything to a specific person (Art. 11 GDPR). Some of these rights may therefore have no practical effect. That's deliberate: if you collect almost no data, there's almost nothing to link to anyone.
8. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority
(Art. 77 GDPR). You can contact the authority in the country where you live. The authority
responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
(State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg),
Lautenschlagerstraße 20, 70173 Stuttgart, Germany,
baden-wuerttemberg.datenschutz.de
9. No automated decision-making
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
10. Changes to this policy
We update this privacy policy when Nimmit's features or the law change. Last updated: 21 August 2026.