Privacy policy

This policy explains what CartCraft collects, why, who else sees it, and what you can make us do about it. It covers the CartCraft iPhone app, the CartCraft Android app, the web app at web.cartcraft.app, and this website. The Android app is the web app inside an Android shell, so everything said here about the web app is true of it too, and the few places it differs are named.

The company responsible for your information — the “data controller”, if you are somewhere that uses the term — is Waypoint Digital LLC. CartCraft is a product of Waypoint Digital LLC, not a separate company. You can reach us at privacy@cartcraft.app.

What we collect

Your account

If you create an account we hold your email address and a user id. If you sign in with Apple or Google we receive whatever that service passes us, which is normally an email address and an identifier — with Sign in with Apple you may choose to hide your address, in which case we only ever see Apple’s relay address and that is fine. If you sign in with a password, the password is handled by Google Firebase Authentication and we never see or store it.

You can use the web app without an account. Do that and nothing about your plan leaves your browser, because there is nowhere for it to go.

Your household plan

This is the substance of the service, and it is stored in one document under your account. It contains:

• How many people you are cooking for, your weekly budget, and how many breakfasts, lunches and dinners you want.
• Dietary preferences, for the household and for each person you add — vegetarian, gluten free, dairy free, low carb, high protein.
• Food allergies, for the household and for each person you add, chosen from the nine the United States calls major allergens: peanuts, tree nuts, milk, eggs, fish, shellfish, soy, wheat and sesame. This is health information, and the note further down says what that means.
• Names of people in your household, if you add them individually. These are whatever you type. They do not have to be real names, and nothing in the app checks or cares.
• The shops you are willing to visit, which one you prefer, and which day you shop.
• Where you shop: the town or postal code you typed, and a latitude and longitude for it. If instead you ask the app to use your location, your device is asked for its position once, with your permission, and that position is what gets searched around and stored. It is never read again unless you ask again, and never in the background. The coordinate is what lets the app price your week against your area rather than a national average, and it is the reason your phone and your browser show the same total.
• What is in your pantry, the meals you have saved or ruled out, and the weeks you have planned.
• What your kitchen can cook with, if you have been asked: a stovetop, an oven, a microwave, an air fryer, a slow cooker, a blender, a grill. Leaving the question unanswered is not the same as answering “none”, and an unanswered kitchen rules nothing out of your week.
• Daily nutrition targets, if you set them: calories, protein, carbohydrate and fat. And any cuisines you have ruled out.
• Recipes you write yourself. They stay private to your household unless you publish them, which is covered below.
• A number used to shuffle your meal choices, so the same week does not regenerate identically.

Your community profile, if you make one

The community is optional. Nothing in this section exists until you choose a handle, and if you never do, other users cannot see you at all.

• A public profile: your handle, a display name, an avatar (picked from a fixed set of symbols and colours, or a picture you upload, described under Photos you add below), the dates you created the profile and last renamed it, and any social links you choose to add. Any signed-in CartCraft user can view the profile and can find it by searching for the handle; nothing about it is visible to the open internet.
• Links to your accounts elsewhere, if you add them: Instagram, X, Facebook, TikTok and Pinterest. We store the username you type, never a link you supply, and build the address ourselves, so the icon can only ever go to the site it names. Anyone who can see your profile can see these and follow them, and following one leaves CartCraft for a site with its own terms and its own privacy policy. Clear the field to remove one.
• You can change your handle once every 30 days, and a handle you give up becomes available for someone else to take.
• If you subscribe, the profile carries an approximate end date for the subscription, and whether the seat is a lifetime one; that is what draws the Plus badge, and like the rest of the profile it is readable by any signed-in user. A verified badge exists too, with a short note from us; only we can grant or remove it.

Recipes you publish, and likes

When you publish a recipe you choose its audience: everyone, your friends, or people you pick. It is shown to that audience and nobody wider, under your handle, with your display name, avatar and badges beside it.

• A published recipe is a frozen copy of the recipe plus your handle at the moment you published. You can change its audience or take it down at any time: access ends immediately, though the community feed can show the old entry for a few minutes more while its cache turns over. A copy somebody already saved into their own household stays theirs, because by then it is part of their plan.
• Liking a public recipe adds to its like count. Your recent likes of public recipes are also kept in a list that any signed-in user can read, which is what powers the friends boards: it holds the recipe and the date, never more than 500 entries, and entries older than 40 days are dropped as new likes come in. A like on a recipe that was shared privately is never written into it.
• If you report a recipe or a profile, we record that your account reported it and email ourselves the details so a person can review it. Who reported is visible to nobody, including the person reported, though the count of reports sits on the recipe or profile itself. Reports from enough different accounts hide a recipe, or take down a profile picture, automatically.
• Display names, handles and the title, description and steps of a recipe you publish are checked by the same automated moderation service as photos before anyone else sees them.

Photos you add

You can upload a profile picture, and with CartCraft Plus a photo for a recipe you wrote. Both are optional, and nothing is uploaded unless you choose a photo, or take one with the camera, and save it. You crop every photo to a square before it is saved.

• Before a photo is stored it is resized and re-encoded, which strips the location and other EXIF data a camera writes into the file. It is then checked by an automated moderation service, OpenAI’s moderation API, which receives the image and nothing about who sent it; a photo it flags is refused and not kept.
• For a profile picture we also keep the whole photo you chose, re-encoded the same way, so you can change its crop later without choosing it again. It is the whole photo that the moderation service checks. It is shown to no one: its address is never given to any app, ours included, and only you can load it, through your own signed-in account.
• Photos are stored on Cloudflare R2. A profile picture is visible to anyone who can see your profile, unless you set it to friends only: then CartCraft shows it only to you and the people on your friends list, and everyone else sees your icon. A recipe photo is visible to the people in your household, and, if you publish the recipe, to the audience you publish it to. Each photo lives at a web address that is hard to guess but not secret, so anyone who is given that address can open it.
• Removing a photo, or deleting the recipe it belongs to, deletes it from storage (for a profile picture, the whole photo kept for its crop as well), which also takes it off a recipe you published with it. Deleting your account deletes your profile picture and the photos on your own household's recipes. A photo you added to a household someone else shares with you belongs to that household's recipe, and stays until it or the recipe is removed. Copies can linger for a short while in caches along the way.

Friends

A friend request is visible to the two accounts it involves and to nobody else. Your friends list is readable only by you: there are no public friend lists, and declining a request is never announced to the person who sent it.

Sharing your household

You can invite a friend’s account into your household, and everyone in it then plans from the same document. Joining a household is a real decision, so here is exactly what it means:

• Everyone in the household can see and change everything in the plan: the people and the names you gave them, every dietary preference and allergy, the budget, the stores, the town you shop in and its coordinate, the pantry, the weeks planned and past, the household’s recipes, and the shopping list check-offs.
• Members see each other’s display name or handle, never an email address.
• Invites only work between friends. Either side can end it at any time: the owner can remove a member, and a member can leave. The household data you had before you joined is kept untouched and comes back when you leave.
• A subscription is never shared through a household. CartCraft Plus belongs to the account that bought it.

Notifications

CartCraft can tell you when something needs you: a friend request, a household invite, a like on your recipe, a new recipe from someone you follow, and a reminder to plan next week before your shopping day. For that we keep, under your account:

• A device token, if you allow notifications on your phone. It is the address Apple (on iPhone) or Google (on Android) needs to deliver a notification to that phone, and it identifies the app on that device, not you. Signing out on that phone removes it, and so, on iPhone, does turning push off in CartCraft’s own settings.
• Which of those notifications you want, and whether each one comes as a push, an email, or both. Email is off until you turn it on.
• A list of the notifications themselves, which you see under the bell. Each one is kept for 30 days, and you can swipe any of them away sooner.

Emails go to the address on your account and are sent through Resend, our email provider. The same route carries the code we send to confirm your address when you sign up with an email and password. The weekly reminder on iPhone is scheduled by the phone itself and involves no server at all.

Importing a recipe

If you import a recipe from a link, some pasted text or a screenshot, what you give us is sent to our server so it can be turned into a recipe you can edit. For a link, our server fetches the page, and for a video it fetches the audio so what is said can be written down. The text or the screenshot is then read by Anthropic’s Claude model, and the audio is transcribed by Groq. Neither receives your name, email address or account. Nothing is kept on our side once the draft is back with you; the recipe only exists if you save it.

If the recipe calls for a food CartCraft has never priced, the import can add it to the shared list of foods every household plans from. That entry is a food, not a note about you, but it records which account added it, and that record is removed if you delete your account.

Apple Health, on iPhone

If you choose to log a meal to Apple Health, CartCraft writes that meal’s calories, protein, carbohydrate and fat to Health on your iPhone. It asks for permission to write those four things and nothing else, and it never reads anything from Health. None of it passes through our servers.

Connecting Discord

You can connect a Discord account from Settings or from your public profile. Discord’s own sign-in page asks you to let CartCraft see your Discord username, and nothing else. We keep your Discord user ID and username with your account, and whether you are in the CartCraft Discord server. The access Discord grants us is revoked as soon as we have read your ID, and it is never stored.

Our bot then does two things in the CartCraft server, and keeps them current as your subscription changes: it gives your Discord account a Plus or Founder role to match your subscription, which everyone in the server can see, and it sets your nickname there to your CartCraft handle. Disconnecting takes the role off, clears the nickname we set (one you changed yourself is left alone), and deletes the link. What you post in the server is between you and Discord, under Discord’s own privacy policy.

On your device

Your appearance setting, a count of how many swaps and recrafts you have used this week, and a few markers of where you got to (whether you have seen the tour, which step of setup you stopped on) stay in your browser’s local storage, or the phone’s. Your signed-in session is kept in the same storage, by Firebase. We set no cookies, and there is nothing to consent to.

Payment

If you subscribe on the web, Stripe takes the payment. Stripe receives your account identifier, which plan you chose, and your email address. Your card details go straight to Stripe and never touch our servers — we cannot see them, and we do not store them. If you subscribe on iPhone, Apple takes the payment under its own terms and we are told only that a subscription exists and when it expires. If you subscribe in the Android app, Google Play takes the payment; we receive a purchase token tied to your account, which we check with Google to confirm the subscription and learn when it renews, lapses or is refunded. Your payment details stay with Google.

Asking to be a beta tester

If you ask for a TestFlight invite from our website, we hold what that form collects: your first and last name, the email address your Apple Account uses, your phone number, and the fact that you checked the acknowledgement. We use them to send you an invite and to reach you about the test, and nothing else. The Apple ID goes to Apple, because that is how a TestFlight invite is addressed; the phone number does not. The note that tells us a request arrived is an email delivered through Resend, our email provider, and it carries the details you typed. You can ask us to delete the request at any time, and we delete it ourselves once the beta ends.

Writing to us

If you use the contact form on this website, we keep what you send, your name, email address, the topic and your message, so we can answer it, and it reaches us as an email through Resend. It is stored as well as emailed so that a message is not lost if the email fails. Ask and we will delete it once you have your answer.

Server logs

Our host, Vercel, keeps ordinary request logs, which include IP addresses and browser user agent strings. These exist to keep the service running and to investigate abuse. Our own rate limiting keeps counters too: for signed-in requests they are keyed by your account, and for the beta form by a one-way hash of the IP address, never the address itself.

What we do not collect

Stated plainly, because most policies bury this and most apps cannot say it:

• No analytics or product telemetry. There is no analytics SDK in any of our apps.
• No advertising, no ad identifiers, no advertising partners, no retargeting pixels.
• No cookies, and therefore no cookie banner.
• No location tracking. We hold the place you searched from and its coordinate. Your device’s location is read once, when you ask, and never in the background.
• No contacts or microphone, and no access to your photo library. The camera opens only when you tap Take Photo. A photo you choose or take for your profile or a recipe, and save, is the only one we receive, and a screenshot you choose to import is read and then discarded.
• Nothing read from Apple Health. The only health information we hold is what you type: allergies and nutrition targets.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We never have.

A note on allergies, dietary information and names

A food allergy you record is health information outright, not something merely implied by what you eat, and we treat it as that. Dietary preferences imply rather than state: gluten free or dairy free may reflect a medical condition, vegetarian may reflect a belief. In some places both are a protected category of information. We ask for them only to plan meals that work for your table, we use them for nothing else, and you give them to us voluntarily by choosing them in the app.

If you would rather not attach that to a name, use a nickname or an initial. The app never verifies who anybody is, and the plan works exactly the same.

Why we are allowed to hold it

If you are in the UK, EU or somewhere with similar law, these are our legal bases:

• Performing our contract with you — your account and your household plan. Without them there is no service to provide.
• Our legitimate interests — keeping the service running, secure and free of abuse, and understanding faults when they are reported to us.
• Your consent — where you record a food allergy, or volunteer other dietary information that reveals health or belief. You can withdraw it by changing or removing it in the app.
• Legal obligation — records we are required to keep, such as tax records for a payment.
• Your consent — the details you give us to ask for a beta invite. You can withdraw it by asking us to delete the request.

Who else sees it

First, other CartCraft users, because that is the sharing that is actually about you: they can see your public profile, whatever you publish, your recent likes of public recipes, and, if you share a household with them, the household plan. All of it is described in the sections above, all of it happens only because you chose it, and all of it can be undone.

Beyond that, we use a small number of companies to run the service. They act on our instructions and may not use your information for their own purposes. This is the complete list of them, what each one does for us, and what it receives. All of them are US companies.

• Google (Firebase): authentication and the database your household plan is stored in, and Firebase Cloud Messaging, which delivers notifications to the Android app. Receives your sign-in credential, email address, everything in the household document, and the text of each notification with the device token it goes to.
• Apple: Sign in with Apple; App Store subscriptions if you subscribe on iPhone; the Apple Push Notification service, which delivers notifications to the iPhone app and receives the text of each one and the device token; and the Apple Maps Server API when you search for shops or a town. That search is made by our server, so Apple receives the words you typed and, if you asked for shops near a point, that point. Apple does not receive your IP address or your identity from us.
• Google: Sign in with Google, if you use it, which receives only the sign-in itself; and Google Play, which takes payment if you subscribe in the Android app.
• Stripe: payments on the web. Receives your account identifier, plan and email address, and takes your card details directly.
• Resend: delivers our email: the notifications you asked for by email, the code that confirms your address, and the messages that tell us a beta invite was requested or a contact form was sent. Receives your email address and the words of each email.
• Anthropic: reads a recipe you import, from its text or a screenshot. Receives that text or image and nothing about who sent it.
• OpenAI: checks a photo you upload for content that breaks our rules, before it is stored. Receives the image and nothing about who sent it.
• Cloudflare (R2): stores the photos you upload and serves them to the people who can see them. Receives the photos, and the IP address of whoever loads one.
• Groq: writes down what is said in a recipe video you import. Receives the audio and nothing about who sent it.
• Discord: only if you connect a Discord account. The sign-in happens on Discord. Our bot then tells Discord your CartCraft handle, as your server nickname, and whether you have Plus or Founder, as a role.
• Vercel: hosting, and the request logs described above. Receives your IP address and browser user agent on every request, as any host must.
• Cloudflare (Turnstile): the check on the beta and contact forms that tells scripts from people. Loaded only on pages with one of those forms. Receives your IP address and browser details, and sets no cookie that follows you elsewhere.

Nothing else is loaded from anyone else. The fonts on this website, the artwork on its pages and the screen recordings on its front page are served from our own host, so apart from Cloudflare on the two form pages, no third party learns that you visited.

We will also disclose information if the law genuinely requires it, and if CartCraft is ever sold or merged your information may transfer with it — in which case this policy continues to apply until you are told otherwise.

Where it is held, and for how long

Our providers are US companies and your information is processed in the United States. If you are in the UK or EU, that is a transfer outside your region; it is covered by the standard contractual clauses our providers offer, or by the EU–US Data Privacy Framework where they participate in it.

We keep your household plan for as long as your account exists. Delete your account and it goes with it. A recipe you published stays published until you take it down or ask us to, and the record that an account reported a recipe is kept even after the recipe comes down, because it is the evidence for the takedown. Records tied to a payment are kept as long as tax and accounting rules require, which is typically seven years. A request for a beta invite is kept until the beta ends, or until you ask us to delete it. A notification is kept for 30 days. A Discord link is kept until you disconnect it or delete your account. Server logs are kept on our host’s ordinary schedule, a matter of weeks.

Your rights

Wherever you are, you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to privacy@cartcraft.app and we will answer within 30 days.

If you are in the UK or EU you also have the right to restrict or object to processing, the right to receive your information in a portable form, the right to withdraw consent, and the right to complain to your data protection authority — in the UK, the Information Commissioner’s Office.

A copy of your information, or a portable one, is the same thing from us: a JSON file containing your household document, your community profile and the recipes you published, sent to the email address on your account. Ask at privacy@cartcraft.app from that address and it arrives within 30 days, usually much sooner.

If you are in California you have the right to know what we collect and why, the right to delete it, the right to correct it, and the right to opt out of sale or sharing. There is nothing to opt out of: we do not sell or share personal information. We will not treat you differently for exercising any of these rights.

Deleting your account

You can do this yourself, in any of the apps, and it takes effect immediately.

• On the web and on Android — open Settings and choose Delete account and cloud data at the bottom of the screen.
• On iPhone — open Settings, then Account, and choose Delete account and cloud data.

It removes everything that belongs to your account, and then the account itself: the household and everything in it (the people, stores, pantry, recipes and every week you have planned), your community profile and handle, the recipes you published and the likes on them, the likes you gave, any photos you uploaded, your friendships on both sides, any request or invite still waiting, your notifications and your notification settings with any device token, your Discord link (we ask Discord to take its role and nickname off first), and our records linking you to a subscription. It cannot be undone. Two things can stand in its way: if other accounts are still linked to your household you will be asked to remove them first, so a shared plan is never pulled out from under the people using it, and if you signed in a long time ago you may be asked to sign in again before the deletion is accepted.

A few things outlive it, and we would rather say so. A report you made against someone else’s recipe no longer names you, but the count it added stays on that recipe, because hiding it was a moderation decision. A food your recipe import added to the shared list stays, without your account on it. Payment records are kept for tax, as described above. And a timestamp that stops friend requests being sent twice to the same person is left behind, holding nothing but two account identifiers that can never be reused. If you would rather we did the deletion for you, write to privacy@cartcraft.app from the address on your account.

Deleting your account cancels a subscription bought on the web or in the Android app first, and if that cannot be done at that moment, the deletion is refused rather than leaving you paying for an account that no longer exists. A subscription bought on iPhone cannot be cancelled by us, because Apple does not allow it: cancel it in your App Store settings before you delete.

Security

Your household document is readable only by your own account and by the household members you have invited, enforced by database rules rather than by our good intentions. What you publish is readable by the audience you chose, and nothing in the community is visible without a signed-in account. Connections are encrypted in transit. Passwords are handled by Firebase Authentication and never reach us. No system is perfectly secure, and we do not claim otherwise. If a breach ever puts your information at risk we will tell you by email without undue delay, and notify the relevant authority within 72 hours of learning of it where the law requires that.

Children

CartCraft is not intended for children under 13, and we do not knowingly collect their information. If you add a child to your household as a person to cook for, please use a first name or a nickname — nothing more is needed. If you believe a child has created an account, write to privacy@cartcraft.app and we will remove it.

Changes

If this policy changes we will update the date at the top, and for anything significant we will tell you in the app or by email before it takes effect.

Contact

Waypoint Digital LLC, the company behind CartCraft — privacy@cartcraft.app.