Privacy policy

Grocely is operated by Axiom Studios of 2 Park Avenue, NW11 7SJ, London ("Grocely", "we", "us" or "our"). We are the controller of the personal data described in this policy.

Contact: support@axiomstudios.org

This policy explains how we collect, use, disclose and retain personal data when you use the Grocely iOS app and related services.

Data we collect

Account data

If you use Sign in with Apple, we receive an Apple account identifier and, if you choose to share them, your name and email address. Apple may provide a private relay email address instead of your personal email address. We exchange Apple's authorization code for tokens stored on our server so we can revoke the authorization when you delete your account.

If you register with email and password, we collect your name and email address, store a hash of your password, and send an email verification code through Resend. We do not send your password to Resend.

For both methods, we store a Grocely account identifier, account creation and update dates, and whether your email has been verified.

Subscription data

Apple processes App Store subscription payments. We use RevenueCat to manage subscription access, purchases and restores. RevenueCat receives your Grocely account identifier, purchase and transaction information, subscription status and expiry dates, and technical information about the app and device. This links your subscription to your Grocely account. Grocely does not receive your full payment-card details from Apple.

Meal-planning data

We collect the information you provide to create and save meal plans, including:

• your chosen supermarket, weekly budget, household size and planning days;
• dietary preferences and goals;
• foods and food groups you ask Grocely to exclude;
• kitchen equipment and pantry items;
• generated meal plans, recipes, meal-swap options and priced shopping lists; and
• shopping-list items you add, remove or mark as complete, including manual items.

Onboarding answers

The app stores your onboarding progress and answers on your device. When onboarding is saved to your account, we also store your name, age, how you heard about Grocely, whether you find cooking or planning difficult, and your meal-planning answers on our server. These include your supermarket, budget, household size, planning days, dietary preferences, food exclusions, kitchen equipment and pantry items.

We use these answers to personalise your experience and save your profile. Food exclusions are also processed as described under When we disclose data. Deleting the app normally removes the local onboarding file; it does not delete your server-stored account or profile.

Some answers, including allergies, dietary preferences, dietary goals and foods to exclude, may reveal information about your health, religion or lifestyle. We use them to filter recipes and products and to personalise meal plans.

Technical and usage data

If you allow Help improve Grocely, PostHog collects a randomly generated app identifier and information about app installs, updates, opens, background activity, screens visited, onboarding progress, and purchase or restore attempts and outcomes. Events can include the app version and build, device type and model, operating system and version, screen dimensions, language, time zone, and IP address. When you are signed in, we send PostHog your Grocely account identifier to associate this activity with your account. This data is not anonymous.

The same optional choice enables session replays and diagnostic reports. Session replays record your interactions with the app and reconstruct the screens you see, helping us understand problems. We configure replay recording to mask text input fields and images and disable console-log and network-telemetry capture. Other text displayed on a screen may appear in a replay, including information shown from your profile. Diagnostic reports can include error messages, stack traces, recent app activity, and technical information about the affected app version and device.

We do not start these optional PostHog analytics, recordings or crash reports unless you allow them. We store your choice, the date of your choice and the notice version on your device.

Our authentication system also records session tokens, session expiry, IP address and user-agent information. The app stores authentication data in iOS secure storage.

Separately, our server records when a signed-in account last opened the app to support meal-plan scheduling. Authentication, subscription checks, meal planning and this account activity record operate independently of your optional analytics choice.

If you allow notifications, we store a push token linked to your account so we can tell your device when a meal plan is ready. You can turn notifications off in iOS Settings.

If you set a cooking timer, Grocely schedules a local notification on your device. Its title or body may include the recipe title. We do not send cooking-timer data to our server.

We do not use this data to track you across apps or websites owned by other companies, and we do not use it for advertising.

How we use data

We use personal data to:

• create and secure your account;
• verify your email address;
• process subscription access, validate purchases and restore subscriptions;
• personalise the app using your profile and onboarding answers;
• generate, price, save and sync meal plans and shopping lists;
• offer meal swaps and save changes to your plan and shopping list;
• notify you when a meal plan is ready;
• filter recipes using your dietary preferences and food exclusions;
• retrieve current product information from your chosen supermarket;
• maintain, troubleshoot and protect Grocely; and
• understand app adoption, onboarding and purchase flows, and technical performance when you allow optional analytics.

Grocely uses automated systems to choose recipes and supermarket products based on the preferences you provide. These recommendations do not produce legal or similarly significant effects. Prices are estimates based on available supermarket information and may differ at checkout.

Our legal bases

If UK or European data-protection law applies, we rely on:

• Contract to create and verify your account, manage your subscription, and provide meal plans, shopping lists and account syncing that you request.
• Consent for optional analytics, session replays and crash reports. You may withdraw consent at any time without affecting processing that already took place.
• Legitimate interests to secure the service, prevent abuse, diagnose faults and improve core reliability. Our interest is operating a safe and reliable service, and we limit this processing to what is necessary.
• Legal obligation when we must keep or disclose information to comply with law.

An account requires either Sign in with Apple or an email address and password. Onboarding requires some profile and planning answers before you can continue. You can skip food exclusions and notifications, and reject optional analytics, session replays and crash reports.

When we disclose data

We disclose data only as described below. We do not sell your personal data.

• Apple provides account authentication when you choose Sign in with Apple and processes App Store subscription payments.
• RevenueCat receives your Grocely account identifier, purchase and transaction information, subscription status and app/device information to validate purchases, manage access and restore subscriptions. This processing is separate from optional PostHog analytics.
• Resend receives your email address and verification email content, including the verification code, to send account verification emails. It also processes email delivery information.
• Apple and Expo deliver notifications when you allow them.
• PostHog processes the optional analytics, session replays and diagnostic reports described above, linked to your Grocely account identifier when you are signed in. Grocely sends this data to PostHog's European service endpoint after you allow collection.
• OpenRouter and the language-model providers it uses receive supermarket product details, recipe ingredient requirements, relevant dietary preferences and the food terms you ask Grocely to exclude. OpenRouter routes these inputs to a language-model provider so Grocely can classify foods and assess product suitability. We do not send your name, email address or Grocely account identifier with these requests.
• Hosting, database and network providers process data to run Grocely's servers, database and network connections.
• Supermarkets and retail-data sources receive product search requests needed to retrieve current product information. These requests are made by Grocely's server and do not include your name, email address or Grocely account identifier.
• Professional advisers, authorities or a buyer of our business may receive data when reasonably necessary to obtain advice, comply with law, establish or defend legal claims, protect users, or complete a corporate transaction.

We require service providers that process personal data for us to protect it and use it only under our instructions. Third parties that act as independent controllers process data under their own privacy policies.

How long we keep data

• We keep account data, saved preferences, meal plans, meal-swap proposals and shopping lists while your account is open. We delete or anonymise this data after account deletion unless the law requires us to keep specific records.
• The local onboarding file remains until the app's data is reset or the app is deleted, including after account deletion. Onboarding answers saved to your account follow the account-data retention described above.
• Account deletion removes your RevenueCat customer record. It does not cancel your Apple subscription or remove transaction records Apple retains under its own policies. Cancel subscriptions in iOS Settings to stop future billing.
• Account deletion does not automatically remove analytics events, session replays or diagnostic reports already sent to PostHog. Contact us if you want us to request deletion of that data.
• Authentication sessions remain until they expire, you sign out, or you delete your account.
• Push tokens remain until Apple reports that they are invalid or you delete your account.
• We retain analytics events, session replays, and diagnostic reports for 1 year.

We may keep anonymised information that can no longer identify you.

Your choices and rights

You can change meal-planning preferences and shopping-list entries in the app. You can stop analytics, session replay, and diagnostic collection through Settings > Privacy > Help improve Grocely. You can also contact us to withdraw consent.

Withdrawing this permission stops future optional collection; it does not automatically erase data already sent to PostHog. Contact us to request deletion of that data.

Depending on where you live, you may have the right to:

• access and receive a copy of your personal data;
• correct inaccurate data;
• ask us to delete or restrict our use of your data;
• receive data you provided in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent at any time.

The right to object applies to processing based on our legitimate interests. Contact us at support@axiomstudios.org to exercise it. We may need to verify your identity before completing a request.

You can delete your Grocely account and its associated personal data through Settings > Danger zone > Delete account. Data that we must retain by law will be isolated and deleted when the required period ends. If you used Sign in with Apple, account deletion also revokes the associated Apple sign-in token.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. If you live elsewhere, you may also contact your local data-protection authority.

Security

We use administrative, technical and organisational measures designed to protect personal data. No storage or transmission method is completely secure.

Children

Grocely is not intended for children under 13, and they may not create an account. If you believe a child under 13 has provided personal data, contact us so we can delete it.

Changes to this policy

We may update this policy when Grocely or the law changes. We will post the revised policy with a new effective date. If a change materially affects how we use personal data, we will provide notice in the app or by another appropriate method before the change takes effect.

Contact us

Questions or requests about this policy can be sent to:

Axiom Studios
2 Park Avenue, NW11 7SJ, London
support@axiomstudios.org