Privacy policy

Who is responsible

The controller for the GroceryLens app and the website grocerylens.app is:

[CONTROLLER_NAME]
[CONTROLLER_ADDRESS]

Email: support@grocerylens.app

Write to this address with any question or request about your data.

In short

• We process your data to run GroceryLens: your account, your receipts and your spending overview.
• An AI model from Google, Gemini, reads your receipts through our own server. Google does not use your receipts to improve its products.
• The app shows no ads, and we do not track you across apps or websites. We do not sell your data.
• The app sends crash reports only if you turn them on.
• You can delete single receipts or your whole account in the app at any time.

The app

Your account

You need an account to use GroceryLens. You sign in with your email address, using a code or link that we send to it, or with Sign in with Apple.

• We process your email address and a random account ID that links your data to your account.
• If you use Sign in with Apple, Apple confirms who you are and sends us an Apple user ID and the email address you chose to share. With Hide My Email, this is a relay address from Apple. Your name is not sent to our servers.
• When you sign in, Supabase records technical data such as your IP address, the time and the user agent of your device, to secure your account.
• Legal basis: Art. 6(1)(b) GDPR, because we need the account to provide the app to you.

Receipts and spending data

Your account holds:

• your profile: monthly budget, currency and country
• each receipt: the store’s name, the country of the receipt, date and time, totals, taxes, discounts and refunds
• each line item: name, brand, category, quantity, unit and prices
• the image or PDF of each receipt. The app reduces images in size on your device before it uploads them.
• your usage: for each scan and each Grocery AI answer, the type of request, the number of AI tokens and the time
• your subscription status, see “Subscription” below

Supabase stores this data in Frankfurt, Germany. PowerSync keeps the copy on your device up to date with your account.

• Legal basis: Art. 6(1)(b) GDPR.

Reading receipts with AI

When you scan or import a receipt, the app sends the image or PDF to our server. It also sends the time zone set on your device, so that the purchase time is stored correctly. Our server passes the receipt to Google’s Gemini model, which returns the store, the line items and the amounts. Our server keeps no copy of the receipt. The app saves the result in your account and uploads the image there.

• We use the paid Gemini service. Google does not use your receipts or the results to improve its products.
• Google keeps the requests and responses for 55 days, only to detect and prevent abuse of its service.
• Legal basis: Art. 6(1)(b) GDPR.

Grocery AI

When you ask Grocery AI a question, the app sends your question and the earlier messages of the conversation to our server, which passes them to Gemini. To answer, Gemini can ask our server for summaries of your own receipts: your spending per category, the stores where a product was cheapest for you, the price trend of a product, and your savings from offers. Our server computes these summaries from your data and sends Gemini only the result.

The app keeps the conversation in memory only and does not save it. Our server does not store it either.

• The same Google terms apply as for reading receipts.
• Legal basis: Art. 6(1)(b) GDPR.

Subscription

You buy GroceryLens Plus in Apple’s App Store. Apple handles the purchase, the free trial and the payment as a controller in its own right, under Apple’s privacy policy. For customers in the EU, this is Apple Distribution International Ltd., Ireland. We receive no payment data.

• Our server creates a random token for your account, which the app passes to Apple with the purchase.
• Apple, and the app after a purchase, send our server signed purchase information. We store your plan, the start and end of the current period, and the token, so that the app can unlock GroceryLens Plus for your account.
• Legal basis: Art. 6(1)(b) GDPR.

Protection against abuse

Each request from the app to our server carries a check from Firebase App Check. With Apple’s App Attest service, App Check confirms that the request comes from a genuine copy of GroceryLens on a real Apple device. The check uses a key for each app installation, which is not linked to your account. According to Google, App Check does not keep the attestation data.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to protect our server and the AI scans from abuse and automated misuse.

Crash reports, only with your consent

Crash reports are off until you turn on Send crash reports, during setup or later in the app’s settings under Privacy. From then on, Firebase Crashlytics receives a report when the app crashes or records an error. A report contains the course of the crash, your device model, iOS version and app version, short technical log messages from the app, and your account ID.

Crash reports are pseudonymous, linked to your account ID so we can help you when you contact support.

• When you turn crash reports off, the app removes your account ID from Crashlytics and deletes the reports it has not sent yet.
• Google keeps crash reports for 90 days.
• Legal basis: Art. 6(1)(a) GDPR, your consent. You can withdraw it at any time by turning the switch off. The withdrawal does not affect the lawfulness of the processing before it.

Data that stays on your device

• The camera, the photo picker and the file import give the app only the receipts you choose.
• The app keeps your data and receipt files in a local database, your settings such as your crash report choice in its local settings, and your sign-in session in the iOS keychain.
• Signing out clears the local database and ends the session.
• The app contains no advertising and no analytics, uses no advertising identifier, and does not track you.

Server logs

Our server runs on Google Cloud Run in Frankfurt, Germany, and writes logs to Google Cloud Logging. For each request, Google Cloud records technical data such as your IP address, the time, the requested address and the user agent of the app. Our server adds entries with your account ID and details such as the country of a receipt, your plan and, in some cases, the time zone of your device or the name of a store. We use these logs to run the service and to find and fix errors.

• We delete the logs after 30 days.
• Supabase also keeps technical logs of requests, such as IP address and time, for 7 days.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to run the service reliably and securely.

The website

Delivering the website

Cloudflare delivers grocerylens.app. When you open a page, your browser sends Cloudflare your IP address and technical data such as the requested page, the time and the user agent of your browser. Cloudflare needs this data to deliver the page and to protect it from attacks. The website sets no cookies and stores nothing in your browser.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website securely.

Web Analytics

We count page views with Cloudflare Web Analytics. A small script measures how fast the page loads and records the page you came from. According to Cloudflare, the script stores nothing in your browser and reads no cookies, and Cloudflare discards your IP address at the nearest data center. We only see totals, such as the number of views per page.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to learn which pages people read and how fast they load.

Waitlist

If you sign up for the waitlist, the form sends your data directly to our email provider Brevo:

• your email address
• the language of the form, the version of the consent text, and the place on the page where you signed up
• the time you signed up and the time you confirmed

When you submit the form, Brevo also receives your IP address and the user agent of your browser, even if you never confirm.

Brevo then sends you an email with a confirmation link, which is valid for 72 hours. Until you click it, we send you nothing else. If you do not confirm, we delete the entry after 14 days.

Once you have confirmed, we email you when GroceryLens launches and, after that, news about the app now and then, at most once a month. Our emails do not record whether you open them or click a link.

You can withdraw your consent at any time, with the unsubscribe link in every email or by writing to support@grocerylens.app. Brevo then keeps your address on a block list, so that you get no more emails. We keep the details of your consent for three years after the withdrawal, so that we can prove it. For the same purpose, we keep a monthly export of the list with these details.

• Legal basis for the emails: Art. 6(1)(a) GDPR, your consent.
• Legal basis for keeping the proof: Art. 6(1)(c) GDPR together with Art. 7(1) GDPR, and Art. 6(1)(f) GDPR. Our legitimate interest is to be able to prove your consent.

Support emails

When you email support@grocerylens.app, we process your email address, your message and any attachments. In the app, Send feedback opens your mail app with a prepared email. It ends with your app version, build, iOS version and device model. You see these lines and can change or delete them before you send the email. The app itself sends nothing.

• The mailbox runs on iCloud Mail from Apple, see “Service providers” below.
• We delete support emails 12 months after your case is closed.
• Legal basis: Art. 6(1)(b) GDPR.

Service providers

These companies process data for us. Where a provider processes data outside the EU or can access it from there, the safeguard named for it protects the transfer.

Supabase

• Company: Supabase Pte. Ltd., Singapore
• Purpose: account, sign-in emails, database and file storage
• Location: data center in Frankfurt, Germany
• Legal basis: Art. 6(1)(b) GDPR, for its logs Art. 6(1)(f) GDPR
• Safeguard: Supabase can access the data from outside the EU. Its data processing agreement includes the EU standard contractual clauses.

PowerSync

• Company: Journey Mobile, Inc., USA
• Purpose: keeps the data in the app up to date with your account
• Location: data center in Ireland
• Legal basis: Art. 6(1)(b) GDPR
• Safeguard: EU standard contractual clauses

Google Cloud

• Company: Google Cloud EMEA Limited, Ireland
• Purpose: runs our server (Cloud Run), stores its logs (Cloud Logging), provides Gemini and Firebase App Check
• Location: our server runs in Frankfurt, Germany. Google stores the logs in its global location, which can be outside the EU. Gemini and App Check can process data in any country where Google has facilities, including the USA.
• Legal basis: Art. 6(1)(b) GDPR for the server and Gemini, Art. 6(1)(f) GDPR for the logs and App Check
• Safeguard: EU-US Data Privacy Framework for transfers to Google LLC in the USA, EU standard contractual clauses for other countries

Firebase Crashlytics

• Company: Google Ireland Limited, Ireland
• Purpose: crash reports, only with your consent
• Location: Google’s data centers worldwide, including the USA
• Legal basis: Art. 6(1)(a) GDPR
• Safeguard: EU-US Data Privacy Framework for transfers to Google LLC in the USA, EU standard contractual clauses for other countries

Cloudflare

• Company: Cloudflare, Inc., USA
• Purpose: delivers the website and provides Web Analytics
• Location: Cloudflare’s worldwide network, including the USA
• Legal basis: Art. 6(1)(f) GDPR
• Safeguard: EU-US Data Privacy Framework for transfers to Cloudflare, Inc. in the USA, EU standard contractual clauses for other countries and for the USA if the framework no longer applies

Brevo

• Company: Brevo GmbH, Berlin, Germany
• Purpose: the waitlist and its emails
• Location: servers in the EU. Brevo’s form service runs behind Cloudflare, and Brevo uses further providers outside the EU, among them Brevo Inc. in the USA and Brevo CRM Solutions in India.
• Legal basis: Art. 6(1)(a) GDPR, for the proof of consent Art. 6(1)(c) and (f) GDPR
• Safeguard: EU-US Data Privacy Framework and EU standard contractual clauses for the USA, EU standard contractual clauses for India

Apple iCloud Mail

• Company: Apple Distribution International Ltd., Ireland
• Purpose: our support mailbox support@grocerylens.app
• Location: Apple’s servers, which can be in the USA
• Legal basis: Art. 6(1)(b) GDPR
• Safeguard: according to Apple’s privacy policy, EU standard contractual clauses

How long we keep your data

• Your account, receipts and usage: until you delete them or your account. After deletion, they remain in the daily database backups for up to 7 more days. Receipt images and PDFs are not part of these backups.
• Receipt files that no longer belong to any receipt: deleted automatically after 7 days.
• Server logs: 30 days. Supabase logs: 7 days.
• Gemini requests and responses at Google: 55 days.
• Crash reports at Google: 90 days.
• Support emails: 12 months after your case is closed.
• Waitlist: the confirmation link is valid for 72 hours, and an unconfirmed entry is deleted after 14 days. A confirmed entry stays until you unsubscribe, and the proof of your consent stays for three years after that.

Delete your data

• To delete a single receipt, swipe left on it in the receipt list and tap Delete. This deletes the receipt, its line items and its image, with or without a subscription.
• To delete your account, open the app’s settings and tap Delete Account under Account Deletion. This deletes your receipt files, your account and all data linked to it.
• You can also ask us to delete your data by writing to support@grocerylens.app.

Deleting your account does not end your subscription. Cancel it in your Apple Account, as the support page describes.

Your rights

You have the right to:

• get access to your data (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• have the processing of your data restricted (Art. 18 GDPR)
• receive your data in a machine-readable format (Art. 20 GDPR)
• object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR)
• withdraw a consent at any time, with effect for the future (Art. 7(3) GDPR)

To use these rights, write to support@grocerylens.app.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, where you work or where the alleged infringement took place (Art. 77 GDPR).

No automated decisions

We make no decisions about you based solely on automated processing that have legal effects for you or affect you in a similarly significant way (Art. 22 GDPR). Reading receipts with AI is not such a decision.

Do you have to provide data?

To create an account, you need an email address or an Apple Account. Without an account, you cannot use the app. Crash reports and the waitlist are voluntary.

Changes to this policy

We update this policy when the app, the website or our providers change.