Privacy policy

Who we are

The Service is operated by Hamzah Qureshi (“we”, “us” or “our”), who is responsible for the personal information described in this policy. You can contact us at [email protected].

Information we collect

• Account information: your name and email address. If you set a password, we store only a one-way cryptographic hash of it, never the password itself. One-time sign-in codes sent to you by email are stored only as a keyed hash and expire within one day. If you sign in with Google, we also store the identifier Google assigns to your account, so that we can recognise you on later sign-ins.
• Content you provide: your lists and their items (names, quantities, units, notes, estimated and paid prices, and categories), the store you associate with a list, reminders you set, your households, and the membership of each list and household.
• Invitations: when you invite someone by email, their email address, the type of invitation and its status.
• Email suppression records: if an email to an address is permanently undeliverable, or the recipient reports it as spam, we keep that address and the reason for up to one year so that we do not email it again. The record is deleted if the account holding that address is deleted.
• Receipts: photos of receipts that you take or select, the information read from them (store, date, items and prices) and any corrections you make. Receipt photos are stored privately and are accessible only to you.
• Purchase history: the prices you enter when you mark items as bought, and the lines of receipts you save. We use this to show your spending, price changes and suggestions, including a “you may be running low” card and an optional daily notification about items you buy regularly.
• Product names and preferences: the names you give items, so that the app can recognise them. When you correct a name on a receipt or mark two names as the same item, we store that correction (the printed text, the store it came from and the name you chose), together with any category you assign to an item.
• App settings: which notifications you have turned on or off, and which “you may be running low” suggestions you have dismissed or been notified about.
• Device information: if you allow notifications, a push notification token for your device and whether it runs Android or iOS.
• Information stored on your device: a sign-in token, kept in the operating system’s secure storage; a copy of your lists and receipts, so that they are available offline; changes made while offline that have not yet been sent (for example an item you added, ticked or edited, with its name, quantity and price, or the new name of a list you renamed), which are kept until the app can send them to us as they were made, and are then deleted; and the name and email address of the last person to sign in on that device, so that the app can open offline. The app may also keep a temporary copy of a receipt photo in its cache. On Android, the home screen widgets store a snapshot of one list (its name and up to 16 open items) in order to display it; anyone who can see your home screen can read it. Signing out, or deleting your account in the app, removes the stored copy, pending changes, remembered sign-in and widget snapshot. Uninstalling the app removes all data it stored on the device.
• Launch notification list: if you asked on our website to be told when Zocery becomes available on Google Play, your email address and the date of your request (see “Launch notifications”).
• Technical information: your device’s IP address is processed briefly, in memory, to limit repeated sign-in attempts, and is recorded in our servers’ request logs (see “Diagnostics and logs” under Service providers). When an error occurs, we record a request number, the internal identifier of the account concerned and a description of the error, with email addresses and tokens removed, in order to diagnose it. Our logs are configured not to record passwords, sign-in codes or tokens, and we do not log the contents of your lists or receipts.

Information we do not collect

Zocery does not collect your location, contacts, microphone input or advertising identifier. The Service contains no advertising and no analytics or tracking tools. We do not sell your personal information.

Device permissions (Android)

• Internet access, to communicate with our servers. Without it, the app shows your stored copy and keeps your changes until a connection is available.
• Camera, used only when you choose to photograph a receipt, and never in the background. You may instead select an existing photo.
• Photos, limited to those you select. The app uses the system photo picker and cannot access the rest of your photo library.
• Notifications (on Android 13 and later, the system asks for your permission the first time). You may decline and continue to use the app, and you can turn off each type of notification in Settings.

The app requests no other permissions, including location, contacts, microphone, calendar, phone or file access.

How we use your information

• To provide the Service: to sign you in, store your lists and share them with the people you invite.
• To send communications you request: sign-in codes, invitations, the notifications and reminders you have enabled and, if you requested it on our website, a single launch email.
• To read the receipts you scan, and to calculate your spending, price trends and suggested lists.
• To keep the Service secure and reliable: limiting repeated attempts, preventing abuse and fixing errors.

Information visible to other users

Members of a list or household you share can see its items, who added and ticked them, and your name. People you invite see your name in the invitation. We do not show your full email address to other users; people you are connected with see only a shortened form, such as a***@example.com. No information is made public.

Service providers

• Email delivery (Resend): delivers the emails we send, namely sign-in codes, invitations, security notices (such as confirmation that your password was changed), links to download your data and, once, the launch email to people who requested it on our website. Resend receives the recipient’s email address and the content of the message, which in the case of an invitation may include a name and a list name. The launch email contains only a link to Google Play. Resend informs us when an email is permanently undeliverable or reported as spam, and we then stop emailing that address (see “Information we collect”).
• Google sign-in: if you choose “Continue with Google”, Google provides us with your name, your email address (verified by Google) and an identifier for your Google account, which we use only to sign you in. We receive nothing else from your Google account, such as your contacts or files, and we share no information about you with Google. Google’s own processing is governed by Google’s privacy policy.
• Bot protection (Cloudflare Turnstile): when activity appears unusual (for example, many sign-in attempts or launch-list sign-ups from one connection), we may ask you to confirm that you are a person before we send a code, sign you in or add an address to the launch list. The check runs in a page within the app or in a frame on our website. Cloudflare receives technical information about your device, browser and connection, including your IP address, in order to distinguish people from automated programs. We receive only the result of the check. Cloudflare’s processing is governed by Cloudflare’s privacy policy.
• Push notifications (Expo, Apple and Google): these services deliver notifications to your device. When you allow notifications, the app registers your device directly with Expo, which receives your device’s push registration token and an installation identifier. Notifications are then delivered using your device’s notification token, and their content may include a list name, item names and the name of the person who changed the list.
• App updates (Expo): each time the app starts, it asks Expo whether a newer version of its own code is available and, if so, downloads it. Expo receives the app’s version, the device platform and a random identifier for this installation of the app, and nothing about you, your account, your lists or your receipts.
• Receipt reading (Anthropic): Anthropic’s API reads the receipt photos you scan. It receives the photo, instructions for reading it and up to 50 of the product names you use most often (taken from items you have added and purchases you have recorded), so that the results use your own names. It does not receive your name, email address or any other account details. A receipt photo includes everything printed on the receipt, so please avoid scanning receipts that show information you would not want processed.
• Diagnostics and logs (Axiom): receives technical measurements of how the Service is performing (which part of the Service was called, whether the request succeeded, how long it took, and counts such as emails sent, failed receipt scans and sign-in attempts), our server’s technical log entries with email addresses and tokens removed, and the request logs of our servers. A request log entry records your device’s IP address, the type of device or app making the request, the address requested (which can include the internal identifier of a list, item or receipt, but never your sign-in codes, passwords or tokens), the result and the time taken. When an unexpected error occurs, its log entry may include the internal identifier of the account concerned (a random code, not your name or email address). We use this information only to keep the Service running, secure it and investigate errors. Axiom does not receive your name, email address, lists, items, receipts or sign-in details, or the content of any request. This data is retained for up to 30 days.
• Hosting and infrastructure: our hosting and database providers store and process your information on our behalf and under our instructions. Cloudflare hosts our website (zocery.com) and, like any web host, processes the requests visitors make to it, including their IP addresses.

International processing

Our service providers may process information in countries other than your own. We do not share your information with anyone for advertising purposes.

Launch notifications

Our website offers a form where you can leave your email address to be notified when Zocery becomes available on Google Play. It is independent of the app and does not require an account. If you use it, we keep only your email address and the date you submitted it.

We use that address for a single purpose: to send one email when Zocery becomes available on Google Play. We send nothing else to it, use it for nothing else, and do not share the list with anyone for advertising. Because we send no confirmation message at sign-up, we cannot verify that an address belongs to the person who submitted it; if your address was submitted by someone else, the launch email is the only message you will receive.

The list is deleted once the launch email has been sent. To be removed sooner, write to [email protected] from the address concerned. If you also have a Zocery account with that address, deleting your account also removes the address from the list.

Data retention

• Your account and its contents: until you delete your account.
• Receipts and receipt photos: until you delete the receipt or your account.
• Invitations: 30 days after they expire. Sign-in sessions: 30 days after they expire or you sign out. One-time sign-in codes: no more than one day.
• Launch notification list: until the launch email has been sent, after which the entire list is deleted.
• Backups: database backups are retained for up to 35 days, so deleted information may remain in a backup until it is overwritten. We do not restore deleted accounts from backups.

Your rights and choices

• Deleting your account: in the app, go to Settings, then Delete account. Your information is removed as described on our account deletion page.
• Deleting specific data: you can delete a receipt, an item or a list you own at any time.
• Notifications: you can turn off any type of notification in Settings, or turn off notifications for the app in your device settings.
• Obtaining a copy of your data: in the app, go to Settings, then Download a copy of your data. We email a download link to your account’s verified email address. The link is valid for one hour, and changing your password invalidates any link already sent. The download is a zip file containing your lists, receipts and receipt photos, spending history, product names and notification settings, in formats that can be opened in a spreadsheet. It does not include other people’s email addresses.
• Correcting your data: you can correct your information in the app. If you are unable to use the app, write to [email protected] from the email address on your account and we will respond within 30 days.

Children

Zocery is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe that a child under 13 has created an account, please contact [email protected] and we will delete it.

Security

Information is transmitted over encrypted connections. Passwords and sign-in codes are stored as hashes, and repeated sign-in attempts are limited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please protect your password and the email account you use to sign in.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page shows when it was last revised. If we make a material change, we will notify you in the app or by email.

Contact us

If you have any questions about this policy or your personal information, please contact Hamzah Qureshi at [email protected].