We built Grocer so that we couldn't read your grocery lists even if we wanted to.
Stays on your device / in your iCloud
- Your lists and trips — stored in your private iCloud database and shared only with people you invite.
- Your device's location — used on-device for store suggestions and arrival reminders. Never sent to Grocer's servers.
- Your contacts — used on-device to show names when inviting. Never uploaded.
What reaches Grocer's servers
- Item names you add (e.g. "whole milk") together with the store you've chosen, so we can look up the aisle and price.
- Photos you scan are processed to extract item names and are not stored.
- Live trip updates — progress counts, the shopper's display name, the store, and the item most recently checked off — pass through our push service briefly to power Live Activities on your family's devices.
- Feedback you send from Settings → Send Feedback, including your email only if you type it. Kept until you ask us to delete it.
- Usage analytics and crash reports, tied to a device identifier, that help us find bugs and see which features matter.
What we never have
Your password (there are no accounts), your contact list, your device's location, or your lists at rest — list data lives in your iCloud, not on our servers. There's no ad SDK, no ad tracking, and nothing is sold to anyone.
The full policy is at grocer.sh/privacy.