The short version: Grocer makes money from subscriptions, not from data. We never sell what you buy, never use it for ads, and you can delete all of it from inside the app.
Never leaves your device
- Your device's location — used on-device for store suggestions and arrival reminders. Never sent to Grocer's servers.
- Your contacts — used on-device to show names when inviting. Never uploaded.
Stored on Grocer's backend, tied to your account
- Your lists, items, notes, quantities, and trip history — held on our own secure backend so they can sync between your devices and the people you invite. Shared lists are visible only to those people.
- Item photos you attach, and the store you've linked to a list.
- Your name and email as Apple provides them at sign-in (Apple may give us a private-relay address), or your phone number if you sign in that way.
What reaches Grocer's other services
- Item names you add (e.g. "whole milk") together with the store you've chosen, so we can look up the aisle and price.
- Photos you scan to add items are processed to extract item names and are not stored.
- Live trip updates — progress counts, the shopper's display name, the store, and the item most recently checked off — pass through our push service briefly to power Live Activities on your family's devices.
- Usage analytics and crash reports, tied to a device identifier, that help us find bugs and see which features matter.
What we never have
Your password (Sign in with Apple and phone sign-in mean you never make one), your contact list, and your device's location. There's no ad SDK, no ad tracking, and nothing is sold to anyone — ever.
The full policy is at grocer.sh/privacy.