Privacy Policy

ListAlert  ·  Effective date: June 1, 2026  ·  Last updated: August 30, 2026

This Privacy Policy describes how ListAlert ("we," "us," or "our") collects, uses, shares, and protects information when you use the ListAlert mobile application and associated services (the "Service"). We are committed to handling your information with transparency and minimal footprint.

1. Who We Are

ListAlert is an independent mobile application. For questions about this policy, contact us at info@listalert.app.

2. Information We Collect

2.1 Information you provide

• Grocery list items — item names, categories, store tags, and completion status you enter into My List.
• Recipes — recipes you save, including photos you upload, URLs you paste, or text you type. Extracted ingredients, cuisine type, cook time, and vibe tags.
• Household information — the display name you choose when creating or joining a household, and the display names of other household members you can see.
• Store preferences — the name, address, and GPS coordinates of stores you save and favorite.
• Email address (optional) — if you add a recovery email to protect your household access (so you can restore it after reinstalling or on a new device via a magic-link sign-in), or if you choose to sign up for product updates. Email is never required to use the app's core features.

2.2 Information collected automatically

• Anonymous session identifier — when you first launch the app, an anonymous Supabase user ID is generated for your device. This ID has no connection to your name, email, or any other personal identifier unless you later link an email.
• Device location — used in two distinct ways. (1) Background proximity alerts (opt-in): ListAlert requests background location permission only when you enable a GPS alert for a store. When enabled, geofencing runs on your device's operating system to detect when you are near a saved store and fire a local notification; these background coordinates are not transmitted to our servers or shared with third parties. (2) Store search: when you actively search for a nearby store, your current coordinates are sent through our Cloudflare Worker to the Google Places API to return nearby results (see Section 5.3). If you never enable GPS alerts and never search for a store, we do not collect location.
• Purchase and trip history — when you end a shopping trip, the app records the list of completed item names and the trip duration; this history is stored locally on your device. If you belong to a household, the items and checked-off state of your active shared shopping trip are also stored in our Supabase database so household members share one live trip (see Section 4.2).
• Crash and diagnostic data — the app uses Sentry (our crash- and performance-monitoring service). When the app crashes, a crash report is automatically transmitted, including device model, OS version, app version, a stack trace, and touch-event breadcrumbs (a record of which UI elements were tapped before the crash). Sentry also samples basic performance metrics (such as screen-load timing) to help us find slow or failing screens. This data does not include your list contents, location, or account information.

2.3 Information we do NOT collect

• Your real name
• Payment information of any kind
• Retailer (Kroger, Instacart, Walmart) account credentials, order history, or purchase data
• Continuous or persistent location tracking
• Browsing history, ad identifiers, or cross-app tracking signals
• Contacts or address book data

3. How We Use Your Information

4. Data Storage and Where It Lives

4.1 On your device

The following data is stored on your device in React Native AsyncStorage. Note that your grocery list and saved recipes (including photos) are also synced to our Supabase database when you belong to a household — see Section 4.2:

• Your full grocery list and all item details
• Your recipe catalog, including saved photos
• Trip history and purchase records
• Allergy and exclusion lists
• Store preferences and GPS alert settings
• Kroger OAuth tokens (stored in the device's encrypted secure storage)

Your Supabase session token (the JWT used to authenticate requests to our backend) is also stored on your device, in the operating system's encrypted secure storage (iOS Keychain / Android Keystore via expo-secure-store) — the same protection used for Kroger OAuth tokens.

On-device data that is not part of household sync (for example, trip history, allergy and exclusion lists, and store preferences) is not backed up to our servers; if you uninstall the app or clear app data, that local data is deleted. Data that was synced to your household (your list, recipes, and recipe photos) remains in Supabase until removed as described in Section 7.

4.2 In our cloud database (Supabase)

The following data is stored in our Supabase database to enable household sync. It is protected by Row Level Security (RLS), meaning each user can only access data belonging to their own household:

• Anonymous user IDs (Supabase Auth)
• Household records: name, invite code
• Household membership: user ID, display name, role (admin / shopper / contributor)
• Grocery list items: item name, category, store tag, and completion/recurring status (synced so your household shares one list)
• Saved recipes: name, ingredients, tags, source, cuisine, cook time, and vibe (synced for the shared household cookbook)
• Recipe photos: stored as files in a private Supabase Storage bucket (recipe-images)
• Active shared shopping trips: the trip's item list and checked-off state (synced for real-time household coordination)
• Household meal plans: selected recipe IDs and slot count (synced for household coordination)
• Email addresses, if you add a recovery email (to restore household access) or sign up for optional product updates. A recovery email is also linked to your Supabase Auth account to enable magic-link sign-in.

Supabase servers are hosted in the United States. See Supabase's Privacy Policy.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only as described below:

5.1 Retailer delivery providers — when you initiate a handoff

When you tap a delivery handoff button, only the ingredient names you selected for that specific action are transmitted. No account identity, location, email, or other personal data is included in these transmissions.

5.2 AI recipe extraction — Anthropic

When you extract a recipe, the photo or text you submit is sent through our Cloudflare Worker (which verifies your session token and holds our Anthropic API key server-side) to Anthropic's Claude API. Only the submitted content is transmitted — your name, email, user ID, location, and grocery list are not included. Anthropic's use of this data is governed by Anthropic's Privacy Policy. Per Anthropic's API terms, inputs submitted via the API are not used to train models. We do not independently process or use your submitted recipe content for any purpose other than returning the extracted ingredient list to you.

AI recipe images. If you choose to generate an illustrative image for a recipe, the recipe name and prompt are sent through our Cloudflare Worker to Cloudflare's Workers AI image model. The generated image is saved with your recipe (in Supabase Storage and/or on your device). No account identity, email, or location is included in this request.

5.3 Store search — Google Places (via our Worker)

When you search for a grocery store, your search query and your current device coordinates (latitude and longitude) are sent to our Cloudflare Worker, which forwards them to the Google Places API to bias results toward stores near you. Because the request is proxied server-side, Google receives our Worker's IP address rather than your device's IP. See Google's Privacy Policy.

5.4 Infrastructure providers

• Supabase — authentication, household data storage, and file storage for recipe images. Privacy Policy
• Cloudflare — secure server-side proxy for AI recipe extraction (Anthropic), AI image generation (Workers AI), Google Places store search, and Kroger OAuth token exchange. Privacy Policy
• Sentry — crash monitoring (crash reports only, no list or location data). Privacy Policy
• Expo / EAS — over-the-air app updates. On each app launch, the app checks Expo's update servers (u.expo.dev) for available updates; your app version, platform, and update channel are transmitted. Privacy Policy

5.5 Legal requirements

We may disclose your information if required to do so by law or in response to a valid legal process (e.g., a court order or subpoena), or if we believe disclosure is necessary to protect the rights, property, or safety of ListAlert, our users, or the public.

6. Location Data

Location is the most sensitive data type ListAlert touches. Here is exactly how it works:

• Background location is opt-in at the store level. When you save a store and tap "Set GPS alert," the app requests the "always on" location permission so it can detect when you are nearby — even when the app is in the background. If you do not tap that toggle, ListAlert never requests background location permission.
• Background alert location is processed on-device. The geofencing logic for proximity alerts runs on your device's operating system, and those background GPS coordinates are not transmitted to ListAlert's servers, to any retailer, or to any third party. Store search is separate: when you look up a nearby store, your coordinates are sent through our Worker to Google Places (see Section 5.3).
• Alerts are local notifications. When the system detects you are within the configured radius of a saved store, your device fires a local notification. This requires no round-trip to a server.
• You can revoke at any time. Disable location permission for ListAlert in your device's Settings → ListAlert → Location. All GPS alerts will stop immediately.

Apple App Store privacy nutrition label declarations:

• Contact Info — Email Address (only if you provide one for household recovery or product updates) — App Functionality & Account Management — Linked to Identity
• Location — Precise Location (sent only when you search for a nearby store; background proximity alerts are processed on-device and not collected) — App Functionality — Linked to Identity
• User Content — Photos (recipe photos you upload) and Other User Content (grocery list items and recipe text you save), stored for household sync — App Functionality — Linked to Identity
• Identifiers — User ID (anonymous session identifier your list, recipes, and household are stored under) — App Functionality — Linked to Identity
• Diagnostics — Crash Data, Performance Data, and Other Diagnostic Data (crash reports, basic performance metrics, and touch breadcrumbs) — App Functionality — Not Linked to Identity

7. Data Retention and Deletion

• On-device data — retained until you uninstall the app or clear app data.
• Household data in Supabase — retained as long as your household exists. If you leave your household and it has no remaining members, household data is deleted.
• Anonymous session data — your Supabase anonymous user record is retained until you request deletion.
• Email signups — retained until you request removal.
• Kroger OAuth tokens — retained in your device's encrypted storage until you disconnect Kroger from within the app, or until the token expires (per Kroger's token lifetime policy).

How to delete your data

The fastest way to delete everything is directly inside the app — no request or waiting period required:

1. Open Stores & Household → Household and tap "Delete my account and data." This immediately and permanently deletes your account and all associated Supabase records — your list, recipes, recipe photos, and household membership. This cannot be undone.
2. Uninstall the app to remove any remaining on-device data.

If you cannot use the in-app option — for example, you have already uninstalled the app — you can request deletion by email instead:

• Email info@listalert.app with subject line "Delete my ListAlert data". Include either (a) the email address associated with your account, or (b) a description of your household name and display name so we can locate your records. We will delete your Supabase records within 30 days.

8. Security

We take reasonable technical and organizational measures to protect your information:

• All communication between the app and our servers uses HTTPS/TLS.
• API keys (Anthropic, Kroger client secret) are stored server-side only in Cloudflare's environment — never in the app bundle.
• Kroger OAuth tokens are stored in your device's hardware-backed encrypted storage (iOS Keychain / Android Keystore via expo-secure-store).
• Supabase Row Level Security (RLS) ensures each user can only read and write their own household's data — this is enforced at the database level, not just in app code.
• Our Cloudflare Worker verifies your Supabase JWT on every AI and Kroger token exchange request using Supabase's public JWKS endpoint (ES256 asymmetric signatures).

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.

9. Children's Privacy

ListAlert is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children under these ages. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data. These include:

• Access — the right to know what personal data we hold about you.
• Correction — the right to correct inaccurate data.
• Deletion — the right to request deletion (see Section 7).
• Portability — the right to receive your data in a structured, machine-readable format.
• Objection / restriction — the right to object to or restrict certain processing.
• Withdraw consent — where processing is based on consent (location, email), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at info@listalert.app. We will respond within 30 days.

California residents (CCPA / CPRA)

California residents have the right to know what personal information is collected, to delete personal information, to opt out of the sale of personal information (we do not sell personal information), and to non-discrimination for exercising these rights. To submit a CCPA request, use the contact information in Section 12.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, seek your consent. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

12. Contact

For questions, requests, or complaints about this Privacy Policy or our data practices:

ListAlert
Email: info@listalert.app

We aim to respond to all privacy inquiries within 30 days.