1. Who We Are
GrubShelf (“we”, “us”, “our”) is a household pantry management, shopping list, and spending tracker application. For the purposes of data protection law, GrubShelf is the data controller responsible for your personal data.
Contact: hello@grubshelf.app
2. Data We Collect
2.1 Information You Provide
- Account information — name and email address, for account creation and authentication.
- Pantry data — item names, quantities, expiry dates, storage locations, and categories.
- Shopping lists — list names, items, quantities, and completion status.
- Financial data — transaction amounts, store names, budget settings, and currency preferences.
- Photos — product images taken with the camera or selected from your photo library, for item identification.
- Household data — household name and member invitations.
2.2 Information Collected Automatically
- Device information — device model, OS version, and app version, for crash reporting and compatibility.
- Crash data — crash logs and error reports, for improving app stability.
- Usage data — feature usage counts and engagement milestones, for improving the Service.
- Subscription data — subscription status, plan type, and billing period, for managing your subscription.
2.3 Information from Third Parties
- Apple Sign-In — name and email (as you choose to share), for authentication.
- Google Sign-In — name, email, and profile identifier, for authentication.
- Open Food Facts — product names and details from barcode scans, for item identification.
2.4 Information Collected on This Website
- Email address when you join the waiting list or newsletter.
- Basic usage data through analytics tools to understand how visitors use our site and measure advertising.
- Campaign attribution (e.g. UTM parameters from ad links) stored with your signup so we know which campaigns work.
3. How We Use Your Data
- Providing the Service — storing your pantry items, shopping lists, and transactions; sharing data within your household; processing barcode scans.
- Authentication — verifying your identity and maintaining your session.
- Subscription management — processing and managing your Premium subscription through Apple.
- Notifications — sending push notifications for expiry reminders, low stock alerts, approval requests, and shopping list updates.
- Improving the Service — analysing crash reports and usage patterns to fix bugs and improve features.
- Communication — sending household invite emails, daily digest notifications, and service-related communications.
- Feature management — using feature flags to enable or disable features.
We do not sell your data to third parties.
4. Legal Basis for Processing (UK GDPR / EU GDPR)
We process your personal data under the following legal bases:
- Contract — account data, pantry/shopping/financial data — necessary to provide the Service you signed up for.
- Legitimate interest — crash data, usage analytics — improving app stability and features without compromising your privacy.
- Consent — push notifications, marketing emails, optional photo uploads — you can withdraw consent at any time.
- Legal obligation — retaining transaction records where required by law.
6. International Data Transfers
Your data may be transferred to and processed in countries outside the United Kingdom and the European Economic Area (EEA), including the United States, where our service providers operate.
When we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- The UK International Data Transfer Agreement or Addendum
- Adequacy decisions where applicable
7. Data Retention
- Account data — retained while your account is active; deleted within 30 days of account deletion.
- Pantry, shopping, and financial data — retained while your account is active; deleted with your account.
- Photos — retained while your account is active; deleted with your account.
- Crash data — retained by Firebase for up to 90 days.
- Usage analytics — retained in aggregated, anonymised form.
- Subscription records — retained as required for financial record-keeping.
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (HTTPS/TLS for all connections)
- Row-Level Security (RLS) on all database tables, ensuring users can only access their own household’s data
- Server-side subscription validation with Apple’s App Store Server API
- Certificate pinning for external API connections
- Secure token storage
No system is completely secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security.
9. Your Rights
9.1 UK GDPR / EU GDPR Rights
If you are in the United Kingdom or European Economic Area, you have the following rights:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate data.
- Right to erasure — request deletion of your data (you can do this directly via Profile > Delete Account).
- Right to restrict processing — request that we limit how we use your data.
- Right to data portability — request your data in a machine-readable format (available via the App’s export feature in JSON or CSV).
- Right to object — object to processing based on legitimate interest.
- Right to withdraw consent — withdraw consent at any time for processing based on consent.
To exercise these rights, contact us at hello@grubshelf.app. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO).
9.2 California Consumer Privacy Act (CCPA) Rights
If you are a California resident, you have the following rights:
- Right to know — request what personal information we collect, use, and disclose about you.
- Right to delete — request deletion of your personal information.
- Right to opt-out of sale — we do not sell personal information, so this right does not apply.
- Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights.
To exercise these rights, contact us at hello@grubshelf.app.
Categories of personal information we collect: identifiers (name, email), internet activity (usage data), commercial information (purchase/transaction records), and sensory data (photos).
We do not sell personal information. We do not share personal information for cross-context behavioural advertising.
10. Subscriptions
If you subscribe to GrubShelf Premium, payment is processed by Apple. We do not collect or store payment card details. Apple provides us with a transaction receipt to verify your subscription status.
11. Children’s Privacy
GrubShelf is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at hello@grubshelf.app and we will delete it promptly.
All household members must be at least 13 years of age. If a parent or guardian adds a household member who is between 13 and 18, the parent or guardian assumes responsibility for that minor’s use of the Service.
13. Push Notifications
We send push notifications for expiry date reminders, low stock alerts, household approval requests, and shopping list updates. You can disable push notifications at any time in your device’s Settings > Notifications > GrubShelf.
14. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority (ICO in the UK) within 72 hours of becoming aware of the breach.
- Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
- Document all breaches, including their effects and remedial actions taken.
15. Account Deletion
You can delete your account and all associated data at any time from Profile > Delete Account in the app. This permanently removes your pantry items, shopping lists, household data, and personal information. You can also request deletion by contacting us at hello@grubshelf.app.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email. Your continued use of the App after changes take effect constitutes acceptance of the updated Privacy Policy.
17. Contact Us
If you have questions about this Privacy Policy, your data, or wish to exercise your rights, contact us at:
Email: hello@grubshelf.app
For UK GDPR enquiries, you may also contact the Information Commissioner’s Office:
Website: ico.org.uk
Phone: 0303 123 1113