Privacy Policy
This policy explains what Grocery Boffin collects, why, and how you can ask us to change or delete it. We follow South Africa’s Protection of Personal Information Act (POPIA).
What we collect
- Account. Email (or an identifier from Google or X if you sign in that way), display name, country, optional cuisine preferences, optional currency override.
- Shopping data. Lists, trips, shops, items, quantities, and prices you record or confirm. If you share a list, the chosen buddy can see that list and the shops you run from it. A product you add to the catalogue is visible to other shoppers in your country.
- Photos you choose to upload. Till-slip and handwritten-list pictures are sent to our API so we can read them. We use them for that request. We do not run a long-term photo library of your slips.
- Feedback you choose to send. If you use Send feedback, we keep the message (up to 4,000 characters), an optional title, the kind of note you picked (a bug, a complaint, a request, a compliment, or other), how serious you marked it, your country, the app version, the build number, and your platform (for example Android). It is linked to your account so we can follow up. We read it in our admin tool.
- A note from the crash screen. You can type a note of up to 1,000 characters. The screen asks you to leave out your name, email and receipt details. It goes to Sentry without your name, email or account id.
- Device and diagnostics. Crash and error reports (Sentry) so we can fix bugs. We also send a small sample (about 10–20%) of performance traces from the app, our server and our prediction service, with device type and app version. Before they are sent we remove request bodies, query strings, cookies, sign-in headers, and email addresses. Reports from our server may include your account id.
- Suggestions (only if you opt in). If you accept the in-app ML terms, we use your finalised trips to predict items you may need and to compute anonymised group statistics. That consent is separate from creating an account. Trained model files made from those trips are not removed when the account is deleted. A trained model file holds a word list built from item names and brands across many shoppers, plus tables of numbers. It holds no account id, name or email. The files are stored on our Fly.io servers in Paris and in a private storage bucket.
- Advertising. The free app shows ads served by Google AdMob. To show and measure ads, and to limit fraud, AdMob may collect your device’s advertising ID, approximate location from your IP address, and how you interact with ads. Where the law requires it (for example in Europe and the UK), we ask your consent before ads are personalised. You can reset or delete your advertising ID, or opt out of personalised ads, in your Android settings under Google › Ads.
Who processes data for us
- Supabase — sign-in and the application database. EU (Paris, France).
- Fly.io — runs the API, the prediction service and its training job, and this website. Paris, France (cdg).
- xAI — reading till slips and handwritten lists you upload.
- Resend — sends the sign-in emails from
no-reply@mail.buddysoftware.org(confirming a new account, and resetting a password). It receives your email address and the email it sends. Region eu-west-1 (Ireland). - Sentry — crash and error reports, performance traces, and notes sent from the crash screen. EU, Germany.
- Google AdMob — serves and measures ads in the app. Google handles this data under its own Privacy Policy.
- Google or X — only if you tap those sign-in buttons; they then share an identifier (and email if they provide one) with us via Supabase.
- RevenueCat — purchase and subscription status (your account id and store purchase tokens). Not till-slip or list photos.
- Google Play or the App Store — if you subscribe to Premium; they process the payment.
We do not sell your personal information.
How long we keep it
We keep account and shopping data while your account exists. You can delete the account in Grocery Boffin (Profile, then Delete account) or from our delete-account page, including by email if you no longer have the app.
The text a till-slip read returns is kept for 30 days so we can fix a bad read, or until you delete the account, and the photo is not stored.
When the account is deleted:
- Lists only you can see, and their items, are deleted. A list you shared is handed to that buddy, who keeps the items. A list someone shared with you stays with them.
- Shops you already ran with someone else stay in their history. Your other shops are deleted. Your name is removed from the shared history.
- Your buddy connection and invite code are removed.
- Your name, email, and machine-learning choice are removed, and prediction data tied to you is erased.
- Feedback you sent from the app is deleted.
- Catalogue products stay. Your name is removed from any product you added. A product report you filed stays, with the comment cleared and no longer tied to your name.
- We keep the account id and the date it was deleted, without your name or email, so the account cannot be opened again. Store billing notices stay without your account id, so a repeated notice from the store is not treated as a new purchase.
- Where a record has to name who did something, we store the word “deleted” instead of your account.
Deleting the account does not remove:
- The RevenueCat customer record (your account id and the store purchase tokens).
- Sentry: crash and error reports, performance traces and crash-screen notes already sent. Sentry deletes them when its retention period ends (up to 90 days).
- Fly.io logs, for about 7 days. They may include your account id.
- Trained model files already made. Deletion erases your prediction data but does not edit those files. Words from your items may stay in them until the models are retrained and the older files are removed.
An in-app deletion finishes when the app confirms it. An email request is completed within 30 days. We do not restore a deleted account from a backup. A copy still inside a routine backup is discarded when that backup expires. Where the law requires a short extra record that the request was handled, we keep only that record.
Deleting the account does not cancel a Google Play or App Store subscription. Cancel that in the store. Details are on the delete-account page.
Your rights
You may ask to access, correct, or delete your personal information, or object to how we use it. To delete the account, use Grocery Boffin or the delete-account page. For access, correction, or an email deletion, write to support@buddysoftware.org from the address on the account. We complete an email request within 30 days.
Children
Grocery Boffin is not directed at children under 13. Do not create an account for a child under 13.
Changes
If we change this policy in a material way we will update the date at the top. Continued use after that date means you accept the updated policy. The version date is the source of truth.