Privacy policy

Who we are

Zocery is run by Hamzah Qureshi. You can reach us at [email protected].

What we keep

• Your account: your name and email address. If you choose a password, we keep only a scrambled (hashed) version of it, never the password. Sign-in codes we email you are kept only as a keyed hash, for at most a day.
• What you put in the app: your lists and the items on them (names, quantities, units, notes, estimated and paid prices, categories), the store you name for a list, reminders you set, your households, and who belongs to each list or household.
• Invitations: when you invite someone by email, we keep their email address, the kind of invitation, and what happened to it.
• A do-not-email note: if an email to an address bounces for good, or the person marks it as spam, we keep that address and the reason for up to a year so we do not send to it again. It is deleted with the account of the person it belongs to.
• Receipts: the photo you take or choose, the text we read from it (store, date, items, prices), and any corrections you make. The photo is stored privately and only you can open it.
• Your purchase history: prices you enter when you tick items off, and the lines of receipts you save. We use it to show spending, price changes and suggestions, including a “you may be running low” card and an optional daily notification about things you buy at a regular rhythm.
• Your dictionary: the names you give things, so the app can match them. When you correct a name on a receipt or say two names are the same item, we remember it for you (the printed text, the shop it came from, and the name you chose), and any category you choose for an item.
• Your choices in the app: which notifications you switched on or off, and which “you may be running low” suggestions you dismissed or were told about.
• Your phone, sent to us: if you allow notifications, a notification token for your device and whether it is Android or iOS.
• Your phone, kept on the phone: a sign-in token in the system’s secure storage; a saved copy of your lists and receipts so they open without a signal; changes you made without a signal that have not been sent yet (for example an item you added, ticked or edited, with its name, quantity and price, and the name of a list you renamed), which stay until the app can send them to us exactly as it would have when you made them, and are then deleted; and who last signed in on that phone (their name and email address), so the app can open without a signal. The app may also keep a temporary copy of a receipt photo in its cache on your phone. On Android, the home screen widgets keep a small snapshot of one list (its name and up to 16 open items) so they can draw it; anyone who can see your home screen can read it. Signing out or deleting your account in the app clears the saved copy, the waiting changes, the remembered sign-in and the widget snapshot. Removing the app removes everything it stored.
• The launch list: if you asked on our website to hear when Zocery is on Google Play, your email address and the date you asked (see “If you asked us to tell you when Zocery launches”).
• Technical information: your device’s network address is used briefly, in memory, to limit repeated sign-in attempts, and our hosting provider’s logs may include it. When something breaks we log a request number, the account’s internal id and a description of the error with email addresses and tokens removed, to find the cause. Our logs are set up so that passwords, sign-in codes and tokens are not written to them, and we do not log the contents of your lists and receipts.

What we do not collect

Zocery does not use your location, contacts, microphone or advertising identifier. It has no advertising and no analytics or tracking tools. We do not sell your data.

What the Android app asks your phone for

• Internet access, to talk to our server. Without it the app shows your saved copy and keeps your changes until you are back online.
• The camera, only when you choose to take a photo of a receipt. The app never uses it in the background. You can instead choose a photo you already have.
• Your photos, only the ones you pick. The app uses the system photo picker, so it cannot see the rest of your photo library.
• Notifications (on Android 13 and newer the phone asks you the first time). You can say no and still use the app, and switch each kind off in Settings.

Nothing else is requested: no location, contacts, microphone, calendar, phone number or files.

How we use it

• To run the app: sign you in, keep your lists, and share them with the people you invite.
• To send what you ask for: sign-in codes, invitations, the notifications and reminders you leave switched on, and the one launch email if you asked for it on our website.
• To read receipts you scan, and to work out your spending, price trends and suggested lists.
• To keep the service safe and working: limiting repeated attempts, preventing abuse, and fixing errors.

What other people can see

People on a list or household you share can see its items, who added and ticked them, and your name. When you invite someone, they see your name in the invitation. We never show your full email address to other people; people you are connected with see only a shortened form, such as a***@example.com. Nothing is public.

Who handles your data for us

• Expo’s push notification service, and Apple and Google, deliver notifications to your phone. When you allow notifications, the app registers your phone with Expo directly, which receives your phone’s push registration token and an installation id, and they then receive your device’s notification token and the notification text, which can include a list name, item names and the name of the person who changed the list.
• Anthropic’s API reads the receipt photos you scan. It receives the photo, an instruction to read it, and up to 50 of the names you use most for products, taken from items you added and things you bought (so it can use the same names); it does not receive your name, email address or any other account details. Anything printed on the receipt is in the photo, so avoid photographing a receipt that shows something you would not want read.
• Our diagnostics service (Axiom) receives technical measurements of how the service is running: which part of the app was called (for example “GET /lists/:id”, never the full web address with your list’s id in it), whether it worked, how long it took, counts (emails sent, receipt scans that failed, sign-in attempts), and our technical log lines with email addresses, tokens and ids removed. It is set up to receive no personal data: not your name, email address, account id, network address, lists, items, receipts or sign-in details, and not what a request contains. It keeps this for up to 30 days.
• Our hosting and database providers store and process your data for us, under our instructions. Cloudflare hosts our website (zocery.com) and, like any web host, sees the requests visitors make to it, including their network addresses.

These providers may process data in other countries. We do not share your data with anyone for advertising.

If you asked us to tell you when Zocery launches

The Zocery website has a form where you can leave your email address to be told when the app is on Google Play. It is separate from the app: you do not need an account. If you use it, we keep your email address and the date you gave it, and nothing else.

We use that address once: to send you one email on the day Zocery is on Google Play, saying so. We send nothing else to it, we use it for nothing else, and we do not share the list with anyone for advertising. We do not send a message when you sign up, so we cannot check that the address is yours; if someone gave yours by mistake, the launch email is the only message you will get.

The list is deleted once the launch email has been sent. To be taken off it sooner, write to [email protected] from that address and we will remove it. If you also have a Zocery account with the same address, deleting your account removes it from the list too.

How long we keep it

• Your account and everything in it: until you delete your account.
• A receipt and its photo: until you delete that receipt or your account.
• Invitations: 30 days after they expire. Sign-in tokens: 30 days after they expire or are signed out. Sign-in codes: a day at most.
• The launch list: until the launch email has been sent, then the whole list is deleted.
• Backups: database backups are kept for up to 35 days, so deleted data can remain in a backup until it is replaced. We do not restore deleted accounts.

Your choices

• Delete your account in the app: Settings, then Delete account. This removes your data as described on the account deletion page.
• Delete a receipt, an item, or a list you own at any time.
• Switch off any kind of notification in Settings, or turn them off for your phone.
• Download a copy of your data in the app: Settings, then Download a copy of your data. We email a link to your account’s address (it must be a verified address). The link works for an hour, and changing your password cancels any link already sent. It gives you a zip file with your lists, receipts and receipt photos, your spending history, your dictionary and your notification choices, with files you can open in a spreadsheet. Other people’s email addresses are not in it.
• To correct something, change it in the app. If you cannot use the app, write to [email protected] from the address on your account and we will help within 30 days.

Children

Zocery is not meant for children under 13, and we do not knowingly keep their data. If you think a child has made an account, write to [email protected] and we will delete it.

Security

Data travels over encrypted connections. Passwords and codes are stored hashed. We limit repeated sign-in attempts. No service can promise perfect security, so please use a password or email account only you can open.

Changes to this policy

We will update this page when something changes, and tell you in the app or by email if the change matters to you. The date at the top shows when it last changed.

Contact

Hamzah Qureshi, [email protected].