Grocita — Privacy Policy

Effective date: June 14, 2026 · Published by OceanStateDigital · Contact: zaidshahzadbusiness@gmail.com

Summary

Grocita is a grocery-list and calorie-tracking app. We collect the minimum needed to run your account, sync your lists, power the calorie tracker, and understand product usage. We do not sell your personal data, we do not use it for advertising, and we use your health and nutrition data only to provide the calorie features.

What we collect and why

Data	Source	Purpose	Processed by
Email address, name, account identifier	Clerk (sign-in)	Create and secure your account, sign-in	Clerk
Your grocery lists, items, notes, onboarding answers	You	Provide the core app features and sync across sessions	Convex
Share links you create	You	Let people you choose view a read-only copy of a list	Convex
Calorie-tracking data: your calorie profile (age, sex, height, weight, activity level), daily calorie target, and logged meals (calories and protein/carbs/fat)	You	Estimate your maintenance calories and track what you eat	Convex
Meal photos you scan	You (camera or photo library)	Identify the food in a photo and estimate its calories and nutrition	Convex (stored with the meal entry), OpenRouter (AI analysis)
Product analytics: app events (counts/flags/screens), device & usage data, approximate location derived from IP, an opaque user identifier	App usage	Understand feature usage and improve the app	PostHog
Crash & error diagnostics: exception type, message, stack trace, app version, device info	App (automatic)	Diagnose and fix crashes and errors	PostHog

We do not send your email, the free-text contents of your lists/items, your calorie profile, your meal photos, or any health/nutrition figures to our analytics provider — analytics records counts, flags, and screen names only.

Third parties (sub-processors)

Clerk — authentication. clerk.com/legal/privacy
Convex — backend database storing your lists, account record, calorie data, and meal photos. convex.dev/legal/privacy
PostHog — product analytics. posthog.com/privacy
OpenRouter — AI analysis of the meal photos you scan, to estimate calories and nutrition. openrouter.ai/privacy
USDA FoodData Central — public U.S. government nutrition database queried to look up foods identified in your photo (we send food names, not your personal information). fdc.nal.usda.gov
Open Food Facts — public product database used for barcode lookups. world.openfoodfacts.org

We share data with these providers only to operate the app. Grocery price estimates come from public U.S. Bureau of Labor Statistics average-price data fetched on our servers; no personal data is sent to obtain them.

Data retention and deletion

Your data is retained while your account exists.
You can delete your account at any time in the app: Settings → Delete account. This permanently deletes your account and all your data — your lists, your logged meals, and any meal photos — and cannot be undone.
To request deletion another way, email zaidshahzadbusiness@gmail.com. We will delete your account and all associated data.
Analytics events tied to your opaque identifier are retained per PostHog's retention settings.

Security

Authentication tokens are stored in the device's encrypted secure storage (Android Keystore / iOS Keychain via Expo SecureStore).
All network traffic uses HTTPS/TLS.
Automatic device backup of app data is disabled on Android.

Children

The app is not directed to children under 13 (and not under the applicable age in your region). We do not knowingly collect data from children.

Your rights

Depending on your region (e.g. GDPR/UK GDPR, CCPA/CPRA) you may have rights to access, correct, delete, or port your data, and to object to certain processing. Contact zaidshahzadbusiness@gmail.com to exercise these rights.

Changes

We may update this policy; material changes will be reflected by the effective date above and, where appropriate, in-app notice.