Privacy

Who is responsible

The controller is Roberto Esposito EI, trading as Apeirion Labs, 17 rue Ferrandière, 69002 Lyon, France. Email: hello@tarino.app.

What personal data we process

You can use the site without an account. We set no tracking or advertising cookies. If you sign in, we set two strictly necessary cookies: one protects the sign-in form for 15 minutes, and one keeps you signed in until you sign out, for at most 180 days. The city you choose and the ticks you make in your basket while shopping are kept only in your browser on your device; they are not sent to us or anyone else. We process technical data about your visit (time, requested page, referring page, browser type) in server logs, and the content of your message if you write to us. The logs record your IP address only when a request is redirected to https://tarino.app (for example from an address starting with http:// or www.) or when the server records an error or a warning about the request, such as when it refuses the request because too many requests came from the same IP address. When a sign-in code is requested, we also keep a fingerprint of the network the request comes from: a keyed hash (HMAC, made with a secret key of our server) of the IPv4 address, or of the /64 block of an IPv6 address. We use it only to limit how many sign-in codes one network can request, so that one client cannot block sign-in mail for everyone. It counts for one hour and is deleted at the first sign-in code request after that hour; our nightly database backups may keep it until they are deleted. It is never used for analytics and never shown to anyone. The legal basis is our legitimate interest in the security of the service (Article 6(1)(f) GDPR).

If you report a price, we process what you send us: the shop name, the price, the item, and your email address if you give one.

Legal basis

We process technical data on the basis of our legitimate interest in the security and operation of the service (Article 6(1)(f) GDPR). We process messages and price reports on the basis of your consent and to take steps at your request (Article 6(1)(a) and (b)).

Processors and recipients

Host: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

Backup storage: Hetzner Online GmbH.

Email: the emails we send you, for example those with a sign-in code, go out through Scaleway SAS (Paris, France). Email you send to our address is received by OVH SAS, which also provides the DNS service for the tarino.app domain, and forwarded to our mailbox at Google (Gmail).

Payments for Plus: Paddle, our reseller and merchant of record; the details are in the payments section below. We do not sell your data and we do not use it for advertising.

Account and sign-in

An account stores your email address and the sign-in codes and sessions we issue to you. We use them only to sign you in and to keep you signed in. When you delete your account we erase the account data, and any copy still held in backups is deleted after 30 days. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).

Payments (Plus)

Paddle.com Market Limited is the seller of record for Plus and acts as an independent controller for payment data. Your card details are entered with the payment provider and never reach our servers. Apple Distribution International Ltd. and Google Ireland Limited process in-app purchases as independent controllers. RevenueCat, Inc. reconciles these three sources into the single Plus flag on your account. From these providers we receive and keep only what sets the Plus flag: the subscription or transaction identifier, its status, whether it is a trial and when it ends, on the basis of the performance of our contract with you (Article 6(1)(b) GDPR).

Push notifications and crash reports

Push notifications are sent directly to the Apple and Google push gateways; no third-party push processor. Crash reports are self-hosted on our own server; no third-party crash processor; a crash report never contains your email address or your IP address. The legal basis is our legitimate interest in the security and operation of the app (Article 6(1)(f) GDPR).

AI helper (Plus)

When you use the AI helper, your question is sent to Scaleway SAS (Paris, France) so that an answer can be produced. The provider never trains a model on your question and we never share it with another provider. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).

Launch list

If you join the launch list we keep your email address for at most 30 days after we send the one notice, and then we delete it. The legal basis is your consent (Article 6(1)(a) GDPR).

Retention

We keep server logs for 14 days and backups for at most 30 days. We keep messages and price reports until we reply and for at most 12 months from the last message.

Your rights

You have the right to access, rectify, erase, restrict processing, object, and to data portability. Write to hello@tarino.app and we will reply within one month.

Supervisory authorities

In France: CNIL, www.cnil.fr. In Croatia: AZOP, azop.hr. You may also complain to your local supervisory authority.

Last updated

Last updated: 2026-10-03