Legal

Privacy Policy

This Privacy Policy explains how Startups Engineering (“we,” “us,” or “our”) collects, uses, discloses, and protects your information when you use the Grocery mobile application and associated web services (collectively, the “Service”).

1. Who We Are and How to Contact Us

Grocery is provided by Startups Engineering ("we", "us", or "our"). For privacy requests, contact us via contact form.

2. Information we collect

Account data: Name, email address, password hash, and account verification status.
App Content & Usage Data: Grocery lists, item entries, purchase history, calendar integrations, and metadata associated with optional attachments.
Device & Technical Data: Push notification tokens, device model, operating system version, app version, IP address, and system language settings.
Support data: Details provided when contacting customer support (name, email, subject line, message text).
Security and operational data: authentication artifacts (for example password reset and email verification codes in hashed form), logs, and request metadata needed to secure and operate the service.

3. How we use information

Core Functionality: To provide, sync, and maintain your grocery lists across multiple devices.
Account Management: To register users, verify accounts, process password resets, and enforce security.
Service Communications: To deliver transactional emails and real-time push notifications related to your active lists.
Customer Support: To investigate and respond to inquiries or technical support tickets.
Security & Operations: To monitor system performance, fix bugs, defend against unauthorized activity, and optimize server reliability.

4. Legal Bases for Processing (GDPR / Applicable Privacy Laws)

If you reside in the European Economic Area (EEA), UK, or similar jurisdictions, we process your personal data under the following legal bases:

Contractual Necessity: Processing required to fulfill our obligation to provide the Service to you.

Legitimate Interests: Processing necessary for account security, fraud prevention, service improvements, and server maintenance.

Legal Compliance: Processing required to comply with applicable statutory or legal obligations.

Consent: Where required by law (e.g., marketing communications or optional device permissions), which you may withdraw at any time.

5. Third-party services

We do not sell, rent, or trade your personal information to third parties. We share limited data with trusted infrastructure and service providers bound by strict data protection agreements:

Cloud Infrastructure: We use Microsoft Azure to host our backend servers and database. Your data is stored securely in their data centers. (Azure Legal)
Communications: We use SMTP services for transactional email delivery and Firebase Cloud Messaging (Google) to deliver push notifications. These services process your device tokens or email addresses only to facilitate communication. (Firebase Privacy)

These providers are authorized to use your information only as necessary to provide these services to us and are contractually obligated to keep your information confidential.

6. Data Storage & Local Device Storage

Server Storage: Data sent to our backend is encrypted in transit using TLS/SSL protocols and encrypted at rest in our secure database environments.

On-Device Storage: The Grocery app stores essential session tokens and local offline list cache directly on your device storage.

7. Account and data deletion

You can request account deletion from within the app or from our public web form at https://grocery.startups-engineering.pro/account-deletion. Deletion removes the account and related application data under our normal deletion flows. Some limited records may be retained where required for security, legal, or dispute-resolution purposes.

Upon deletion, your personal account details, saved lists, and device tokens will be permanently purged from our active databases. Limited log records may be retained temporarily in backup archives or as required by law for audit and security purposes.

8. Data Retention

We retain personal data only as long as your account remains active or as needed to provide you with the Service. Backup archives containing application data are rotated out and permanently deleted on a standard automated cycle.

9. Security

We implement industry-standard administrative, physical, and technical safeguards—including salted password hashing, access control policies, and encrypted transport layers—to protect your data. However, no internet transmission or electronic storage system can be guaranteed to be 100% secure.

10. Children's privacy

The Service is not intended for or directed to children under the age of 13 (or 16 in certain legal jurisdictions). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please notify us immediately so we can remove it.

11. Your Rights and Choices

Depending on your geographic location, you may hold specific privacy rights, including:

Access & Portability: Request a copy of the personal data we hold about you.

Correction: Request corrections to incomplete or inaccurate account data.

Deletion: Request erasure of your personal data.

Restriction & Objection: Object to or restrict certain processing activities.

12. Updates to This Policy

We may revise this Privacy Policy periodically to reflect changes in our Service, legal obligations, or technical infrastructure. The latest version will always be posted on our website with an updated Last Updated date. Effective date: May 19, 2026. Last Updated: July 24, 2026.