Privacy
Grocr compares grocery prices in Bermuda. This page says exactly what we collect, why, how long we keep it, and who else sees it. Where something might surprise you, it is called out rather than buried.
Who is responsible for your data
To complete before launch: the legal entity operating Grocr, its registered address, and a named contact for data protection. This is a required disclosure and cannot be filled in from the code.
In the meantime you can reach us at hello@grocr.fyi.
What we collect
- Your email address. If you create an account, we use it to send your one-tap sign-in link and any price alerts you ask for. We also collect it if you join the waitlist, send us feedback, submit a receipt and give us an address, or request a Grocr Intelligence demo. Those are separate from having an account, but deleting an account removes your address from all of them too.
- Your lists, saved baskets, alerts and preferences. So they sync across your devices when you are signed in. Signed out, these stay only in your browser.
- Receipt photographs, if you send one. See the section below, because this is the most sensitive thing we handle and it deserves its own explanation.
- Your IP address and browser when you submit a receipt, join the waitlist or request a demo. We keep these for 30 days to stop abuse of those forms, then delete them.
- Anonymous usage stats. Which pages and searches are popular, so we
know what to improve and which products to add. Collected by Umami, cookieless, at
stats.dot.bm, a server run by dot.bm, which builds Grocr. Requests to it pass through Cloudflare. No advertising cookies, no tracking across other sites, not shared with anyone.
To confirm before launch: how long Umami at stats.dot.bm keeps
raw events. Grocr's own analytics table is cleared after 90 days (below); Umami's is set in
its own admin and has not yet been checked.
Receipts
You can send us a photograph of a till receipt to help us check prices. This is optional and you never have to do it.
- What happens to the photograph. It is sent to OpenAI, whose AI service reads it in the United States and sends back the store, date, prices and items. So the image leaves Bermuda, and OpenAI sees it while reading it. It is stored on our own server in Helsinki, Finland.
- What we keep. The prices and product names read from the receipt, so we can check them against what the shops publish. The photograph itself is deleted after 180 days, automatically, by a job that runs daily. The prices read from it stay, because they are the reason for collecting it.
- The whole submission is deleted after 24 months.
- Who can see it. Grocr operators whose job includes reviewing receipts, and every time one opens a photograph it is recorded. OpenAI also sees it, while reading it. Not other shoppers and not advertisers.
- Your IP address and browser are kept with the submission for 30 days to stop abuse, then deleted. Your email address only if you give it.
- Removing one. Email hello@grocr.fyi with the reference shown after you upload, eight letters and numbers like
3F9A2C1B, and we will delete the photograph and everything read from it.
Please avoid photographing anything you would not want read: receipts sometimes show the last digits of a card, or a loyalty number. We do not want those and do not use them.
How long we keep things
These are enforced by a job that runs every day, not by intention. It records what it deleted so we can tell it is still working.
| What | Kept for |
|---|---|
| Receipt photographs | 180 days |
| Receipt submissions, including the prices read from them | 24 months |
| IP address and browser from a receipt, waitlist or demo form | 30 days |
| Sign-in links | Deleted once used, or 24 hours after they expire |
| Sessions | Deleted when they expire |
| In-app notifications | 12 months |
| Raw analytics events | 90 days. Totals are kept. |
| Records of the emails we sent you and whether they arrived | 90 days |
| Your email address or IP address in our rate limits | 1 day |
| The email address on a feedback message | 12 months after we deal with it. The message itself, 24 months. |
| Unsubscribe links in emails we sent | 24 months |
| Invitations to a Grocr Intelligence account | 30 days |
| Your account, lists, baskets, alerts and preferences | Until you delete your account |
| Database backups | Copies may persist until backups rotate out |
Who else sees your data
Only these, and only for the jobs listed. The typefaces on this site are served from our own servers, so loading a page tells nobody but us.
- Resend sends our email. They see your address and the message, and tell us whether it was delivered.
- OpenAI reads receipt photographs, in the United States. They see the photograph you send.
- Cloudflare carries requests to our analytics server. It sees your IP address and the page, as any network in the path does.
- Open Food Facts supplies product information. We send them barcodes, never anything about you.
We do not sell or rent your data. Grocr Intelligence, our paid product for retailers and brands, sells price observations collected from shops' own published prices. It contains nothing about you, and no customer of it ever receives personal data.
What we don't do
- We don't sell or rent your data to anyone.
- We don't run advertising networks or cross-site tracking.
- We don't store passwords. Sign-in is by emailed link.
Cookies and what is stored in your browser
All of these are essential or functional. None is used for advertising.
| Name | What it does |
|---|---|
__Host-session | Keeps you signed in. Secure, HTTP-only, and only ever sent to this site. Renewed each day you use Grocr and ends after 30 days without a visit. Your account page lists every device signed in and lets you sign any of them out. |
grocr_next | Short-lived. Remembers the page you were heading to when you signed in. |
grocr_access | Only if you were sent an early-access invite: lets you into the app before it opens to everyone. Secure, HTTP-only, and ends when the invite does. |
grocr_branches | Which shop branches you picked, so prices match your area. |
These are kept in your browser's own storage, not sent to us. Clearing the site's data in your browser removes them.
| Name | What it holds |
|---|---|
grocr_basket_v1 | Your current list. |
grocr_saved_v1 | Lists you saved. |
grocr_alerts_v1 | Your price alerts. |
grocr_profile_v1 | Your stores and branches, your usual store, favourite brands and alert settings. |
grocr_recent_searches_v1 | Your last six searches, to offer them again. |
grocr_trip_v1 | The shopping trip you started, so it opens in store with no signal. |
grocr_trip_checks_… | What you have ticked off on that trip. One per trip. |
grocr_merged_v1 | That this browser's lists have already been added to your account. |
grocr_welcomed_v1 | That you have seen the welcome screen. |
grocr_hit_dismissed_v1 | Met targets you chose to keep watching, hidden until the price changes. |
grocr_install_dismissed_v1 | That you said no to installing the app, and when. |
grocr_offline_ready_v1 | That we have told you the app works offline. |
grocr_visits_v1 | How many times you have opened Grocr, so we ask about installing it only after a few. |
grocr_visit_counted | For this visit only, that it has been counted. |
The app also keeps a copy of itself and of your shopping trip page in your browser, so it opens offline. Signing out, or signing in as someone else, clears the trip page.
If you share a receipt photo into the installed app from another app, the photo is held in your browser only until the receipts page sends it to us, and is deleted from your browser straight after. It is then treated like any other receipt you add.
When you sign in, the list, saved lists and alerts in this browser are added to your account, and we tell you what was added. Where both had the same item or the same alert, your account's version is kept. Saved lists from both are kept.
Our analytics does not use cookies.
Sign-in links and account notices are how the service works. They are not marketing and cannot be turned off while you have an account.
Price alerts and digests are optional. You can turn them off in your account settings, and every one of them carries an unsubscribe link and a one-click unsubscribe control in your mail app. Turning email off does not stop the alert: you will still see it in the app when you sign in.
Your rights
- See what we hold. Signed in, download it yourself from the You page. Or ask, and we will send it to you.
- Correct it. Most of it you can edit yourself; ask us for the rest.
- Delete it. Delete your account from the Account page. That permanently removes your profile and sign-in details, your lists, baskets and favourites, your price and basket alerts, your notifications, your receipts and the photographs you sent us, and your trips and preferences. It also removes your email address from everywhere else we hold it: the waitlist, a demo request, an invitation to a Grocr Intelligence account, any unsubscribe link we had issued you, and the feedback you sent us.
- Object or complain. Email us first. You can also complain to Bermuda's Privacy Commissioner.
Two things stay when you delete your account. Price corrections and feedback you sent us stay, with your name and your address taken off them, because other shoppers rely on them. And if you had unsubscribed from an email, we keep that address on a do-not-email list, because deleting that record is how a service ends up emailing you again the next time your address reaches it from somewhere else. Ask us and we will remove that too. Copies of anything may remain in our database backups until those rotate out.
Contact
Questions about your data? Email hello@grocr.fyi or use the contact form.