Designed for customer-controlled shopping.

To plan a trip we use your shopping list, household preferences, budget, the exact store you choose, and official retailer catalog, availability, and price data for that store. Approvals, cart estimates, and savings records you create in the app are stored so your trip history stays yours.

GroceryShop.ai never collects retailer passwords, one-time codes, CAPTCHA answers, or payment card details. The public beta does not read retailer carts or purchase history and does not perform retailer cart, offer, checkout, or payment actions. Every retailer action shown in the product requires a separate, explicit approval from you first, and nothing is placed as an order on your behalf.

Retailer OAuth tokens are encrypted server-side. Pairing codes and browser grants are stored as one-way hashes and expire automatically. Operator and diagnostic endpoints are token-gated and never expose secret values.

When you ask the shopping assistant a question, only the text you type, your current list, and the store context needed to answer are sent to an AI model provider. Card numbers, passwords, and retailer credentials are never part of that request. Assistant usage is metered per household with a daily fair-use ceiling and a platform-wide daily spend stop, so a runaway conversation cannot run up unbounded cost or repeat itself indefinitely.

The separate, unpublished developer companion pauses on sign-in, verification, CAPTCHA, checkout, and payment pages and contains no order-placement permission. It is used only in owner-present controlled validation and is not a public-beta capability.

We use a small set of providers, each receiving only what its job requires: hosting and edge delivery, a managed Postgres database, account authentication, subscription billing, AI model inference, and official retailer APIs for store, catalog, and price research. Providers never receive your retailer passwords or payment card details from us, and we do not sell or share grocery, browsing, or household data for advertising.

Session pairing credentials expire on their own. Assistant usage records keep token counts and cost only, never the conversation text. You can download your account data from Settings and request deletion of your household through Support; we confirm when it is complete. Legal, fraud-prevention, or financial records may be retained where required.

If you believe you found a security issue, use the Support page and choose Security report. Do not include passwords, payment details, or active access tokens. We acknowledge reports and share what we changed once the issue is resolved.