Privacy Policy

Some apps would love to know that you buy oat milk every Tuesday. We genuinely do not care. Grocer stores your lists, items, item photos, trip history, and household details on our own secure sync backend, tied to your account so your family’s devices stay in sync. We do not sell or mine your groceries, and we do not build a profile of your habits.

Shared lists are visible only to the people you invite. Your account is anchored to Sign in with Apple or to your phone number — there is no separate password to manage, no shadow profile to enrich, and no dossier on your snack habits.

Signing in with your phone number is optional — Sign in with Apple does the same job. If you choose it, tapping Continue with iMessage opens your own Messages app with a one-time code already written out and addressed to Grocer. You send it. We never send the first message, and the app cannot send it for you.

We reply once, confirming the sign-in worked. The first time you ever sign in, that reply also carries a contact card so you can save Grocer and recognize the number later. Then we stop. There are no recurring texts, no marketing texts, no promotions, and no follow-ups — if you sign in again next year, you text us again and get one more confirmation. Message and data rates may apply. Reply HELP for help or STOP to opt out at any time; opting out of texts does not delete your account, though it does mean phone sign-in stops working for you.

We keep your number as a one-way keyed fingerprint that lets us recognize you on your next sign-in, plus an encrypted copy and the last four digits so the app can show you which number is on the account. It is used for signing you in and for nothing else — not ads, not analytics, not lookups, and not enrichment.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messages are delivered through Twilio, which carries them for us and is not permitted to use your number for anything else. No one else receives it.

Contacts — Grocer shows the contact picker when you invite someone. The lookup happens on your device. We do not upload your address book or use it to map your social circle. That would be creepy and, more importantly, completely unnecessary.

Location — if you link a list to a store, an on-device geofence can remind you to start a trip when you arrive. Your location never leaves your device.

Camera & photos — photograph an item to identify it, and the photo is saved with that item so members of the shared list can see it. We do not sell or mine your photos.

We use PostHog for basic product analytics, such as whether a trip was started or the paywall was viewed. This helps us fix bugs and improve features. These events do not contain your list contents, contacts, photos, or location. We use this information to understand whether Grocer works as intended.

Here is the radical business model: if Grocer is useful, you can pay us for a Grocer Pro subscription. That is how we make money — not by selling access to you. Apple processes App Store purchases (with RevenueCat managing subscription status), and Stripe handles web checkout where offered. We never see your full card number. The app keeps only the purchase information needed to know whether your subscription is active.

A novel concept, apparently: our notifications are for the feature you asked for. Live Activities and trip updates use Apple’s push notification service, and each push carries only what is needed to update the trip on your Lock Screen.

We do not sell your data, show ads, build advertising profiles, or hand your information to data brokers. We have no incentive to turn your private life into inventory because subscriptions pay the bills. You are the customer, and the app is the product.

For a privacy question or request, email human@grocer.sh and a human will get back to you.