Stocked

Privacy Policy

Last updated September 24, 2026

Stocked is a shared grocery list, pantry and recipe app. It is made by one independent developer, Easton Lindsay (“I”, “me”). This policy explains what the app collects, why, who can see it, and how to delete it.

What the app collects

Your account

Your name, your email address and a user ID, from whichever sign-in you choose: email and password, Google or Apple. If you use Sign in with Apple and choose to hide your email, I only receive Apple’s private relay address. Passwords are handled by Google Firebase Authentication and never seen by me. The app does not ask for your date of birth or collect age eligibility. Older age-confirmation timestamps from an earlier version are removed when that account’s profile next loads.

Your household

The household’s name, its members’ names and user IDs, and its invite code.

What you add to the app

• Grocery lists: their names, the store you usually shop them at, and, for a list you hide, which member it belongs to.
• Items: names and anything you add to them, such as quantity, category, store, price, notes, purchase and best before dates, which list they are on, and which member last changed them.
• Recipes: names, ingredients, amounts, notes, links, and a photo if you add one. A recipe photo is stored with the recipe, so everyone in your household can see it.
• Shopping trips: the date, store, items bought, prices, item subtotal, optional printed receipt total and the name of the member who shopped. When you save a scanned receipt, its reviewed structured lines and totals are stored here; the original receipt photo is not.
• Notifications: push notifications are disabled in this release. If enabled in a future release, an opted-in device would store a push token and household and per-list choices.

What the app doesn’t collect

No location, contacts, advertising identifiers, advertising analytics or tracking. Photos you scan, of a receipt or of your groceries, are temporarily cached on your phone while preparing the scan; they are not saved to the household database. A photo you add to a recipe is the one kind of photo that is saved; it is stored with that recipe and is deleted when you remove the photo or delete the recipe.

How it’s used

Only to run the app: to sign you in, keep your household’s lists in sync, show spending totals and provide the AI features you choose to use. Your data is not used for advertising, not sold and not shared with anyone other than the services listed below.

Push notifications are disabled in this release. If enabled in a future release, nearby list edits would be grouped into one update instead of sending one notification per edit, with household and per-list controls in Settings.

AI features

Receipt scanning, adding items from a photo, meal ideas and saving a recipe from a link are optional. The first time you use one of them, the app explains what will be sent and asks for permission. Nothing is sent unless you choose Allow. You can turn them off at any time in Settings → AI Features.

• Receipt scanning sends the receipt photo and your household’s item names (so receipt lines can be matched to existing items).
• Adding items from a photo sends the photo you take or choose, along with your household’s item names and category names, so what it finds can be matched to items you already have and filed the way you file things. Everything else in the frame is sent with it, so keep people, documents and anything private out of the shot.
• Meal ideas sends the items in your Inventory (names, how many are left and days until their best before date), your saved recipe names, and anything you type into the request box.
• Saving a recipe from a link sends the web address you give it, and nothing about your household. The app’s server opens that page itself — not your phone, so the site never sees your device or address — and sends the recipe it finds there to OpenAI to be written out as a recipe. The link is saved with the recipe in your household so you can open the original later.

This data goes through the app’s own server on Cloudflare to the OpenAI API, which reads it and sends back the result. The app’s server does not store the photo, the lists or the pages it fetches. It only keeps a count of how many AI requests each user ID makes per day, to enforce daily limits. Current usage records expire within 48 hours of their UTC usage day. Account deletion removes the counts and retains only an abuse-prevention marker for up to 48 hours so deletion cannot be used to reset the daily allowance.

When enabled, Stocked uses the paid OpenAI API through a billing-enabled account. Stocked sets store: false, so responses are not kept as OpenAI application state. OpenAI does not use these requests to train its models by default, but may retain prompts and responses in abuse-monitoring logs for up to 30 days, or longer when legally required or reasonably necessary to prevent harm. Receipts may contain card fragments or loyalty numbers, and a photo of a shelf may show more than the groceries; cover or crop out details you do not want processed. AI remains unavailable until the paid service is configured. Your lists, inventory and saved recipes do not depend on AI being available. OpenAI’s services agreement requires parent or guardian permission for a minor to use its services, so anyone under 18 should only enable Stocked’s optional AI features with that permission.

Who can see your data

• Your household: everyone in your household can see and edit its items, recipes and shopping trips, and sees members’ names. Joining requires a current invitation. Codes expire after seven days, can be replaced, and are revoked when a member leaves. Share invitations only with people you trust.
• Lists you hide: hiding a list stops the app showing it, and anything on it, to the rest of your household. It is stored with your household’s other data, so it is not sealed off from them — please don’t treat a hidden list as a secure place for sensitive information.
• Service providers that run the app on my behalf:
  • Google Firebase (Authentication and Cloud Firestore) stores your account and lists.
  • Expo would route push notifications to Apple or Google for delivery if notifications are enabled in a future release.
  • Cloudflare runs the server that passes AI requests to OpenAI.
  • OpenAI processes AI requests, as described above.
  • Google or Apple, if you sign in with them.
• Me, only when needed to keep the app working, fix a problem you report, or where the law requires it.

Where it’s stored and how it’s protected

Data is stored by Google Firebase and may be processed in the United States and other countries where these providers operate. It is encrypted in transit, and database security rules only let signed-in members of a household read or change that household’s data. The app also keeps a copy on your phone so it works offline. No system is perfectly secure, but I take reasonable steps to protect your data.

Unfinished receipt reviews are saved on your phone. Editable reviews expire after seven days; a submitted receipt stays until its save is confirmed or you explicitly discard it. A small receipt-operation marker is kept with the household to prevent a retry from recording the same purchase twice. It contains an operation ID, trip ID, save mode, completion time and a hash of the reviewed data, not names, email addresses, receipt text or photos. The marker stays until the household is deleted, even if a trip is later removed.

On iPhone, the app also saves a small summary of the list you have open — its name, how many items are left and the first few item names and quantities — in storage on your phone that only Stocked and its widget can read, so the Home Screen and Lock Screen widget can show it. It stays on your phone, is replaced whenever the list changes, and is replaced with a sign-in prompt when you sign out or delete your account. Anyone who can see your Home Screen or Lock Screen can see what the widget shows.

Keeping and deleting your data

Your data is kept while you have an account. To delete it, open the app and go to Settings → Delete Account. The same option is available before household setup. After you confirm your identity, the app removes your membership and account records. If your connection fails, deletion may be partial: reopen the app and continue deletion to finish. Removed data cannot be restored. Apple authorization must be revoked before Apple-account deletion can proceed.

• If you are the last member of your household, the household and all of its items, recipes and shopping trips are deleted too.
• If other people are still in the household, its lists stay for them. Your membership is removed and the app replaces your author, updater and shopper attribution with “Former member”. Free-text content written by household members may still mention you; contact me for help with personal information in retained content.

Leaving a household keeps your account. If you are its last member, leaving asks for confirmation and deletes that household and its content. App-owned list caches, receipt drafts, saved AI consent and list selections, receipt drafts, pending submissions and the widget’s list summary on the deleting device are cleared during account deletion. Firestore’s separate offline cache is cleared at the next full app launch, before household data is loaded. This is logical deletion, not a guarantee of forensic erasure from device storage or backups. Other devices may retain offline copies until they reconnect or their app data is removed.

Temporary photo files are removed after image preparation; cleanup is retried at a later launch if a file is locked or preparation was interrupted. Original images in your photo library are not deleted. If you can’t use the app, email me for help deleting your data, including records from older app versions.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how it’s used. You can see and edit almost everything directly in the app. For anything else, email me and I’ll respond within 30 days.

Changes to this policy

If this policy changes, the new version will be posted here with a new date. For significant changes, such as sending data to a new service, the app will tell you before they take effect.

Contact

Questions or requests: eastonlindsay.projects@gmail.com