Privacy policy

Grocery Notebook · Operator: Higashi Ryuya

Contact: main.higashi.pg@gmail.com

Information and purposes

We store your name, email address, password hash, user ID and session information for authentication and service operation. Personal shopping data stored on the server by older versions is used for a one-time import on a device signed in to the same account and remains on the server until account deletion. Authentication IP addresses and device/browser information support session management and abuse prevention. Family sharing stores family names, membership, hashed invitation codes, shared items, notes, purchase status, purchase event IDs and the users who performed actions. Names and shared items are visible within the family. For billing, we store Apple transaction IDs, opaque account identifiers, subscription status and expiration dates. We do not collect card numbers or store plaintext passwords. Sign in with Apple stores the identifier, name and email provided by Apple and encrypted authentication tokens. Hide My Email uses Apple’s relay address. We never collect your Apple Account password.

Storage and service providers

Server processing and storage use Cloudflare Workers and D1. Better Auth runs on our server for authentication. Cloudflare processes data needed to provide the service. Request information may appear in communication and operational logs. We do not serve advertising or track users for advertising.

Data on your device

Sign-in state uses protected OS storage on phones and cookies on the web. Personal shopping, food amounts, dates and storage locations, search drafts, manually saved links, recipe names, ingredients, amounts, notes, tags, ratings, favorites, and cooking and stock records are saved per account in SQLite on your device. Fridge data does not sync between family members. Signing in alone does not restore it on another device. Deleting the app may erase local data. Unit-price comparisons are held in app memory and are not saved to the server.

Invitation camera, sharing and reminders

The camera is used only to scan family invitation QR codes. Camera images are not saved or sent to a server, and the microphone is not used. Pending invitations are temporarily stored in protected device storage or browser session storage. Using LINE or the share sheet shares the family name and invitation link with recipients you choose. The invitation page reads the code from the URL fragment, so the code is not included in the page’s HTTP request. Optional shopping reminders are scheduled locally using your personal count and the last synced family count. We do not receive a push notification device token.

Search and saved links

Search the web sends your edited search terms to Google or Bing, as selected. Opening a link connects to that website. These services apply their own privacy policies. We do not automatically retrieve search results, recipe text, images or review counts, or use AI to process them. We write search terms to the clipboard only when you tap Copy.

Retention and deletion

Accounts and shopping lists are retained until account deletion. Deleting through Account settings removes the account, sessions and associated shopping lists from the active database, and personal data on the device used to delete. If interrupted, local deletion is retried on next launch. Personal data on other devices must be deleted on those devices. Deleting the organizer’s account also deletes shared family data. A former member’s name is anonymized on shared items. We retain transaction IDs, opaque purchase identifiers and subscription status after unlinking them from the app user to prevent duplicate purchase claims and allow restoration after re-registration. Cancel Apple billing separately in subscription management. Deleting an Apple sign-in account also revokes its Apple authentication tokens. Cloudflare backups and operational logs may remain until their configured retention periods expire.