AI app and data privacy: the 10 questions to ask before you install it
Ask ten questions before you give an AI app your data: what data it collects, whether it trains a model on it, who processes it and where, how long it keeps it, how you delete it, who else receives it, which permissions it asks for, whether it acts on your behalf, who the controller is and how it announces changes. The answers are in the privacy policy, in the settings and in the app stores’ privacy sections. According to the Federal Data Protection and Information Commissioner (FDPIC, page of 24 September 2025), the data protection act applies directly to AI-supported data processing.
Rappn compares the current promotions of 7 Swiss retailers, updated daily: free, no subscription.
Get Rappn, freeBefore you install an app that applies AI to your grocery or budget data, check ten points: data collected, training, provider and country, retention, deletion, recipients, permissions, acting on your behalf, controller and changes. If the privacy policy is silent, you can ask the controller which data it processes and why (art. 25 FADP).
Updated October 2026. Sources: FDPIC, “AI and data protection” (24 September 2025), “Real examples of artificial intelligence (AI) in everyday life”, “Duty to provide information” and “Privacy statements on the internet”; FADP, SR 235.1, consolidated text of 7 July 2025; Apple, privacy information on the App Store; Google, Data safety section on Google Play; NCSC, Device security (viewed on 20 October 2026).
What should you ask before giving an AI app your data?
An AI app usually sends what you enter (lists, receipts, photos, questions) to an artificial intelligence model, run by the app itself or by an outside provider. According to the FDPIC, the data protection act applies directly to this kind of processing. Before you enter personal data, it advises finding out about the manufacturer, the purpose and the risks, about access, third parties and data security and, for training, which data are used, whether they are anonymised and whether you can object. If you do not accept the conditions, it advises giving up the service or, where possible, removing the personal data first.
This is the Rappn home screen, a preview of the features before you install: you can apply the ten questions to what you see. Tap the tabs to explore.
Get Rappn, freeFree, no subscription · iOS & Android
Welcome
The 10 questions to ask the app
- What data does it collect? Including photos of receipts, loyalty card data, location.
- Does it train a model on it, and how do you object? For general AI assistants see what happens to what you type and how connectors and permissions work.
- Which AI provider processes it, in which country?
- How long does it keep it?
- How do you delete the account and the data?
- Who else receives it? Advertising, partners, other providers.
- Which phone permissions does it ask for, and why?
- Does it act on your behalf (payments, orders) and ask first? What an AI agent is.
- Who is the controller and how do you reach them?
- How does it announce changes?
Where do you find the answers?
| Question | Where to look | Warning sign |
|---|---|---|
| 1 Data collected | Privacy policy; store listing | Generic list (“necessary data”), or listing and policy that do not match |
| 2 Training | Privacy policy; app or account settings | No answer, or only “anonymised data”: with AI, even such data can be traced back to a person (FDPIC) |
| 3 Provider and country | Privacy policy: recipients and disclosure abroad | Only “third parties” or “partners”, with no categories and no State |
| 4 Retention | Privacy policy; otherwise the access request (art. 25 para. 2 lit. d FADP) | Neither a period nor criteria |
| 5 Deletion | Account settings; privacy policy; on Google Play “Data safety” | No way to delete, or only an address that does not answer |
| 6 Recipients | Privacy policy; App Store “Data Used to Track You”; Google Play “Data sharing” | Advertising or “partners” with no name or category |
| 7 Permissions | Phone prompt; phone settings | Permissions that are not explained or that the feature does not need |
| 8 Acting on your behalf | Terms of use; confirmation screens | Orders or pays without asking |
| 9 Controller and contact | Privacy policy; legal notice | No company, address or contact |
| 10 Changes | Date and version at the end of the policy | No date, or changes “at any time” without notice |
Store listings show what the developers declare: at Google, the independent security review, where there is one, does not verify whether the Data safety section is accurate and complete, and a service provider that processes data on the developer’s behalf need not appear under “Data sharing”. Start from the listing, but read the policy.
Which phone permissions should you grant?
Grant only the permissions the feature you are using needs, and review them in the phone’s settings, app by app. For an AI app, look closely at the camera and gallery (receipts, photos), the microphone, location, contacts and notifications. The NCSC advises downloading apps only from reputable stores and carefully reviewing ratings and access permissions.
If an answer is missing, what are your rights?
Write to the controller: anyone can ask whether it processes data about them, and the answer includes, among other things, the data processed, the purpose, the retention period or the criteria for it, and the recipients or their categories; it is free of charge in principle and, as a rule, arrives within 30 days (art. 25 FADP). In general you can also ask for correction and deletion (FDPIC, Knowing and asserting my rights). Request and next steps: guide to your rights when an AI processes your data. This is general information, not legal advice.
How can you use the 10 questions today?
First step: open the privacy policy of an app you already use and look for the answers to the ten questions. For Rappn, a free Swiss app (iOS and Android) that compares the current promotions of seven Swiss retailers and turns receipts into a spending overview, the privacy policy (version 2.0 of 17 April 2026, viewed on 20 October 2026) names Rappn GmbH, Zug, as controller, with the contact info@rappn.ch, and states: “We do not sell your personal data”. Rappn covers groceries, not rent, insurance or taxes. Rappn is building an AI assistant for groceries: you can join the waitlist.
Updated: .
Why Rappn?
Rappn is an independent grocery price comparison app in Switzerland, with no commercial agreements with any retailer. Our comparisons are truly independent.
- 100% free: no subscription, no hidden costs
- Neutral: no commercial agreements with Migros, Coop, Aldi, Lidl, Denner, Aligro, or Otto’s
- Updated daily, as soon as the chains publish their deals
- The chains’ deals in one place: search, filter, compare, no subscription
- Meal planner in the Kitchen tab: plan the week, send the ingredients to your list
Ready to save on groceries?
Install Rappn and compare for yourself this week. No account required.Scan the code, install Rappn and compare current offers. No account needed.
Frequently Asked Questions
Do AI apps use my data to train the model?
It depends on the app and the plan. According to the FDPIC (24 September 2025), people who talk to a language model directly have the right to know whether the data they enter is used to improve self-learning programs or for other purposes. Look for the answer in the privacy policy and the settings; for general AI assistants, the settings as the vendors describe them are in the guides to what you type into an assistant and to connectors.
How do I see what data an app collects?
Before installing, check the app’s store listing: on the App Store the privacy section shows some of the data types the app may collect and whether they are linked to you or used to track you; on Google Play the Data safety section covers data collected and shared, security practices and deletion. These are the developers’ own declarations (Apple and Google, viewed on 20 October 2026): compare them with the privacy policy.
Can I have my data deleted?
In general you can ask the controller to delete it: the FDPIC lists deletion among the rights you can assert, within the limits set by law. You can also ask it in writing which data it processes (art. 25 FADP). The steps and a sample request are in the guide to your rights when an AI processes your data.
Can an app buy for me?
Only if you have linked a payment method or a shop account to it and allow it. Before linking them, check whether the app asks for confirmation at every purchase and how you withdraw access; the difference between an assistant and an agent is explained in the guide to AI agents.
How does Rappn handle data?
According to Rappn’s privacy policy (version 2.0 of 17 April 2026), the controller is Rappn GmbH in Zug (info@rappn.ch; it says it aims to reply within 30 days), and data is processed primarily in Switzerland and the European Economic Area, with some processing possible elsewhere, including in the United States. Account data is kept for the duration of the account plus up to 12 months after closure, and material changes are announced in advance, for example in the app or by email. Rappn is building an AI assistant for groceries: the waitlist is on the site.