Privacy Policy

1. Who we are

My Grocery List is operated by Jordan Taylor Reynolds, an individual. The operator can be contacted at contact@mygrocerylist.net. References to “we”, “us”, and “our” mean the individual operator.

Read the Terms of Service.

2. What personal information we handle

Depending on how you use the Service, we may handle:

• account information: email address, username, and a password hash (we do not store your password in readable form);
• grocery-list content: item names, categories, ordering, and whether an item is pinned;
• Home information: Home name, member accounts, usernames, membership, invitations, and scheduled delivery day;
• profile information: a profile image, if you choose to upload one;
• notification settings: the delivery email address and day you select;
• account and session information needed to authenticate you and keep you signed in;
• the date/time and version of the Terms of Service and Privacy Policy you accepted when creating an account; and
• technical information handled by our hosting and service providers, which may include IP address, browser/device details, request and diagnostic information, and timestamps.

Please avoid adding sensitive information. Grocery-list entries are stored so the Service can display and email your lists; they are not end-to-end encrypted.

3. How we collect and use information

We collect information directly from you when you register, verify your email, sign in, manage your account, upload a profile image, create or change lists, or use Home features.

We use information to:

• create and secure accounts, verify email addresses, authenticate sessions, record account-registration consent, and respond to support requests;
• store and display personal and shared grocery lists and account settings;
• operate Home membership and invitations;
• send account-verification emails and scheduled grocery-list emails to the addresses configured for those purposes;
• clear unpinned grocery items after the relevant scheduled list email has been successfully sent, as described in the Terms of Service;
• maintain, troubleshoot, protect, and improve the Service; and
• meet legal obligations and respond to lawful requests.

We do not use grocery-list content to create advertising profiles.

4. Sharing and disclosure

We may disclose information:

• to people in your Home: Home members can access shared Home information and the shared grocery list; scheduled Home-list emails are sent to all current Home members;
• to providers that help operate the Service: Render provides application hosting, Neon provides PostgreSQL database services, and Resend provides email delivery. These providers process information as needed to provide their services, subject to their terms and privacy practices;
• to website asset providers: the site currently loads fonts from Google Fonts, icons from cdnjs, and a stock image from Unsplash. A visitor's browser may connect to those services and disclose technical information such as an IP address to them;
• where required or authorised by law, or where reasonably necessary to protect users, the Service, or our legal rights; or
• as part of a business transfer, subject to applicable privacy law.

We do not sell your personal information.

5. Overseas handling

Our application is hosted by Render in Oregon, United States. Information processed by the application may therefore be handled in the United States.

Account and grocery-list data is stored in Neon in AWS US East 2 (Ohio), United States. We use Resend to send verification and scheduled grocery-list emails, which include the relevant email address and grocery-list contents. Resend states that its account data, including email metadata, logs, and API records, is stored in the United States regardless of the sending region selected. Email dispatch may use the region configured for our sending domain; check the domain's region in the Resend dashboard for the current sending location.

Squarespace provides domain and DNS services; it does not host our grocery-list database. The site also loads fonts, icons, and an image from Google Fonts, cdnjs, and Unsplash. Those services may receive technical information such as your IP address when your browser requests their assets.

The providers named above may use subprocessors or allow support access from other countries. Their locations and terms can change. We will review this section when our providers or configurations change.

6. Cookies and sessions

The Service uses a session cookie named “grocery.sid” to keep you signed in. It is configured as HttpOnly and SameSite=Lax, and is marked Secure in the production configuration. The session is configured to expire after seven days. Your browser must accept this cookie for authenticated features to work.

Our current application code does not include an analytics tracker. Hosting, security, or third-party asset providers may process technical data under their own services and policies. Update this statement if analytics or additional cookies are introduced.

7. Storage and security

Account and Service data is stored in a PostgreSQL database and session store. Passwords are hashed using Argon2id rather than stored as readable passwords. Profile images are stored with account data. The production application is configured to use secure session cookies and should only be made available over HTTPS.

We take reasonable steps appropriate to the information we handle to protect it from misuse, interference, loss, and unauthorised access, modification, or disclosure. No internet service or storage system can be guaranteed completely secure. If a data breach occurs, we will assess and respond to it, including making notifications where required by law.

8. Retention and deletion

We keep account and related information while the account is active and for as long as reasonably needed to operate the Service, resolve issues, maintain security, comply with legal obligations, and deal with claims.

Non-pinned grocery items are normally removed after a successful scheduled email. Pinned items and other account information remain until changed, deleted, or the account is closed, subject to the retention qualifications above.

To request access to, correction of, or deletion of your information, contact contact@mygrocerylist.net. We will verify your identity and respond within a reasonable period. Deletion from active systems may not immediately remove information from recovery data. Neon retains database change history for six hours for this project, which supports point-in-time recovery. Information deleted from the active database may remain in this recovery history until that six-hour window expires. Other providers may retain backups, logs, or delivery records under their own retention terms; those periods may differ from the Neon history window.

The current Service does not provide a self-service account deletion control. To request account closure or deletion, contact us using the contact details above. We may ask you to verify your identity before acting on the request.

9. Access, correction, and complaints

You may ask us to access or correct personal information we hold about you by emailing contact@mygrocerylist.net. We may need to verify your identity before acting on a request. If we refuse a request, we will explain why where the law requires or permits us to do so.

If you have a privacy concern or complaint, contact us at contact@mygrocerylist.net with a description of the issue and how you would like it resolved. We will acknowledge and investigate your complaint and respond within a reasonable period. If the Australian Privacy Act 1988 applies to us and you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner (OAIC).

10. Children

The Service is not designed for children to use independently. If you believe a child has provided personal information without appropriate authority, contact contact@mygrocerylist.net so we can assess the request and applicable law.

11. Changes to this policy

We may update this policy when our practices, providers, or legal obligations change. We will publish the current version at mygrocerylist.net/privacy-policy.html and update the effective date above. Where required, we will notify affected users of material changes. Please review this policy periodically.

12. Contact details

Jordan Taylor Reynolds, individual operator. Privacy contact and general support: contact@mygrocerylist.net.