Grocery RatPrivacy policy
Effective October 12, 2026. This covers the Grocery Rat website (groceryrat.com) and the Grocery Rat iPhone app.
Grocery Rat is run by Will Loughlin. It collects as little as it can to plan your grocery trip. There are no ads, no tracking across other apps or sites, no analytics, and your data is never sold.
You don't need an account
You can plan meals, build a list and get a route without signing up. Without an account, your list, chosen store and route are kept only on your device (in the browser's local storage, or in the app's own storage on your iPhone).
What we store if you create an account
- Your email address, used to sign you in, send password reset links, and send a trip to yourself when you ask.
- Your password, stored only as a salted scrypt hash. We can't read it.
- Your saved trips: the meals, recipes, shopping list, the store you picked, the planned route and what you've ticked off.
- A sign-in session token (a cookie), stored as a hash on our side.
Who else sees what
| Service | What it receives | Why |
|---|---|---|
| Anthropic (Claude API) | The meal names you type, meal photos you add, servings, and the shopping list with the store's product search results | To write the recipes, merge the list, and choose products. Photos are sent once to write the recipe and are never stored by Grocery Rat. |
| Kroger (public Locations and Products API) | Your ZIP code, or your approximate coordinates if you choose "Use my location", and the ingredient searches for your chosen store | To find nearby stores, in-stock products, prices and aisle locations. Your location is used only for that search and isn't saved on our server. |
| OpenStreetMap (Overpass API) | The coordinates of the store you picked | To find other food stores near it for items your store doesn't carry |
| Resend | Your email address and the email's contents | To deliver password reset emails and trips you email to yourself |
| Cloudflare | Standard web traffic, including your IP address | Hosting, security and delivering the site |
Our server keeps a count of requests per IP address for the current day to enforce the daily limit, in memory only. Server logs may include errors and IP addresses and are kept briefly for troubleshooting.
Location and camera on iPhone
The app asks for your location only when you tap "Use my location" to find a store, and the camera or photo library only when you add a meal photo. Both are optional; you can always type a ZIP code or a meal name instead.
Deleting your data
You can delete your account at any time. In the iPhone app, go to Account, then Delete account. On the website, open the account menu, then Delete account. This permanently removes your email, password hash, sessions and every saved trip right away. You can also delete single trips from Saved. Data on your device goes away when you clear the browser's site data or delete the app.
Children
Grocery Rat isn't directed at children under 13, and we don't knowingly collect their information.
Changes and contact
If this policy changes, the new version will be posted here with a new effective date. Questions or requests: [email protected].