Privacy policy

This policy explains what personal information ManyStops collects and why. It also says who handles that information, how long we keep it and what choices you have.

It applies to the ManyStops website, the web app, the phone apps and related services. We call them the Service.

ManyStops operates the Service from the United States. We are the business responsible for your personal information. You can reach us at hello@manystops.com.

1. Information we collect

Some of this information you give us directly. The rest is created when you use the Service.

• Account information. This is your email address and a hashed form of your password. If you sign in with Google or Apple, it also includes the name and email address they share with us. If you sign in with Apple and hide your email, Apple gives us a private address that forwards to you. It also includes the name you give us when you set up your account. Members of your groups see it.
• Your items and their stock levels. This includes any note or photo you attach to an item, any barcode you scan or type, and any date you set to use an item by.
• How the people in your group work together, if they use these features. This covers which items are one person's own, who asked for an item and who said they would get it. It also covers who paid for a trip and each person's share of it.
• The stores you add. This includes the name and address of any store you find through place search, and the distances and drive times worked out for it.
• The prices you record for each item at each store. We keep the quantity you bought and any brand or size you enter.
• Your shopping trips. This means which items you picked at which store and any budget you set. It also means the receipt totals you type in and any photo of a receipt you attach.
• The home address you choose to set, with its position on a map. It is optional. The people in your group can see it.
• Your meals and the settings you choose, such as the numbers the planner uses.
• Payment information. This is a record that a plan was bought, its kind and amount, and the account or group it applies to. We also keep the identifiers Stripe gives us for your customer record and your subscription. We use them to show your plan and to open your page at Stripe. When Plus is bought without an account, we keep the email address given at checkout. We use it to find or create the account it belongs to. Stripe collects your card details and billing address. We do not see or store them. Your free period of Plus starts on the day you finish your first trip, or a set number of days after your account was created if you have not shopped by then. When a plan is bought through Apple in the iPhone app, we keep the identifiers Apple gives the purchase, its product, its dates and whether it renews. Apple takes that payment, and we do not see how you paid. When a plan is bought through Google Play in the Android app, we keep the purchase token and order number Google gives it, its product, its dates and whether it renews. Google takes that payment, and we do not see how you paid.
• A record of each receipt, shelf label or aisle sweep you ask the Service to read. It holds the group, the trip, the day, the kind of reading and how many lines were read.
• Prices you see on shelves and ask the Service to read, with the size and brand printed on the label. We keep them as prices seen, apart from the prices you paid.
• The web address of any recipe you import. Our server fetches the page once to read the recipe's name and ingredients. It does not store the page.
• Invitations. We keep the email addresses of people you invite and whether they accepted, and the email address of a person you share Plus with.
• Referrals. If you joined through somebody's link, we keep whose link it was and whether they were given their reward.
• List links. When you share a list by link, we keep the link, the list it shows and when it expires. Anyone with the link can see the list's name and the items on it that are low or out, with the store each is bought at, until it expires or somebody in your group turns it off.
• Loyalty card numbers you save for a store, with the name you give each card. They are kept for your account only. Nobody else in your group sees them.
• Reports. We keep what you write when you report a person or something in a group, who it is about and who sent it. We use a report only to deal with it. The person reported is never told who sent it.
• Messages you send us. This includes emails to hello@manystops.com and our replies. It also includes feedback and recipe reports you send from inside the app. We keep those with your email address, the screen you sent them from and the version of the app.
• Your consent to the features that use artificial intelligence, and when you gave it. Section 5 explains what those features send.
• Notification settings, if you turn notifications on for a device. We keep the address your browser or our app gives us for that device, any encryption keys, the kinds of notification you switched off and the kind of device. We delete them when you turn notifications off on that device, sign out there or delete your account.
• A device identifier. The app keeps a random number on each device it is used on. We record it against each account that signs in there. We use it only to prevent abuse of the free period of Plus. It stays on the device after you sign out.
• Error reports. When the app stops working properly, it sends us the error message, the screen it happened on and the version of the app. An error report carries no account and no group. We keep it for a few weeks.
• Technical information. This includes your IP address, browser type, device type and the times and pages of requests. Our hosting and database providers record it in their logs. We use it for security and to fix faults.

The Service asks your device for its location in three cases. The first is when you switch on Offer to shop at the store I am standing at, under My device. That position stays on your device and is never sent to us. The second is when you tap Use my current location while adding a store. That position goes to Google, to list the places around you. We keep it only if you save the store at your location. The third is when you choose My current location as the start of a trip. That position goes to Google, to find the address nearest you. It also goes to our server to work out that plan, and we do not keep it. The other location information we keep is an address you type or select, with its map position.

The camera is used only when you take a photo or scan a barcode. A barcode is read on your device, and the camera's picture is not kept or sent to us. A photo you take of an item, a receipt or a shelf is used as this policy describes.

Prices can show in the money your country uses. Our hosting provider works out your country from your IP address when a page shows prices. We do not keep the country or the address. The exchange rates come from ExchangeRate-API.

The microphone is used only when you tap the microphone in the app and speak a command. Your browser or your phone turns what you say into text. The Android app does this on the phone where the phone can. Otherwise the recording can go to the browser's or the phone's maker, such as Google or Apple, under that company's own policy. We receive only the text. If you have allowed it, that text can be sent to our artificial intelligence provider to work out what you asked. We keep no recording.

2. What we do not do

The Service carries no advertising. It loads no analytics or advertising trackers. We do not sell personal information or share it with anyone for advertising.

We do not make decisions about you by automated means that have legal or similarly significant effects. The suggestions the Service makes, such as a cheaper store, are only suggestions. You are free to ignore them.

3. How we use information, and why

We use your information to provide the Service. That includes creating your account and syncing your group's data between devices. It includes working out plans and suggestions, and letting the people you invite share a group. We do this because it is necessary to perform our agreement with you.

We use it to take payments and keep the records that tax and accounting law requires. We use it to send the emails the Service depends on, such as sign-in links and invitations. We also send a summary of your week each Sunday. After you join, we send a few tips on getting started, and one email after your free period of Plus ends. From time to time we send news about ManyStops, such as a new feature or a request for feedback. Each of these has a link to stop it. Manage account has a switch for each. We also use it to answer the messages you send us.

We use it to keep the Service secure and reliable, to prevent abuse and to fix faults. We do this in our legitimate interest, and yours, in a Service that works safely.

We use it to improve the Service, including by analyzing de-identified data as the next section describes. We do this in our legitimate interest in making the Service better for everyone who uses it.

Where the law of your place requires a legal basis for processing, we rely on performance of a contract, our legitimate interests and compliance with legal obligations. For what goes to our artificial intelligence provider, we rely on your consent. For the place and barcode lookups you start yourself, we rely on your own request.

4. De-identified data and how it is used

While your account is open, we contribute part of what your group records to pooled datasets shared across all groups. This is a purpose of collecting the information, and it is disclosed here at the point of collection.

This is shopping data such as the items you add, the prices you record, where an item is found in a store you identified from its map listing, and how the Service's suggestions are used.

We also contribute the name and ingredients of each meal your group saves, with anything that could identify a person removed first.

We never contribute your name, email address, home address or photos. We never contribute anything you typed into a note, or any link back to your login or your group.

Pooled figures never show which group they came from. Pooled figures also include how long items last in groups of a similar size, by month and pack size.

You can stop your group contributing at any time. The switch is in Settings, under the heading Help improve ManyStops for everyone.

When you delete your account, we keep the purchase history, store layouts and aisle information from your group in a de-identified form. We use that data, with similar data from other groups, to improve the Service for other people. This is a purpose of collecting it, and it is disclosed here at the point of collection.

De-identified means that your name, email address and home address have been removed. So have the map positions of your stores, every free-text note and the link to your login. This is different from anonymous. A purchase history with a location and timing could, in principle, be traced back to a group.

We therefore keep it under this policy. We do not publish it, and we do not try to re-identify it. Anyone who receives it from us must make the same commitments. This is how California law describes deidentified information.

Store names, and the kind and distance of each store, are kept. Map positions and street addresses are removed. If you would like your group's data removed completely, you can ask us at hello@manystops.com. We will consider the request under the law that applies to you.

5. Who we share information with

We share personal information only with the service providers that help us run the Service, with the people in your group, and when the law requires it. The details are below. We do not sell it.

• Supabase stores your group's data and photos and runs the sign-in system, on servers in the United States.
• Netlify hosts the website and our server functions.
• Google receives what you type into the store and address search boxes, to suggest places. If you have set a home address, its map position goes with the search to rank nearby places. When you tap Use my current location while adding a store, Google receives your device's position, to list the places around it. When you choose My current location as the start of a trip, Google receives your device's position, to find the address nearest it. Google also handles your sign-in if you sign in with Google. Google Play takes the payment for a plan bought in the Android app, and tells us when that plan renews or ends.
• Apple handles your sign-in if you use Sign in with Apple. It also takes the payment for a plan bought in the iPhone app, and tells us when that plan renews or ends.
• Stripe processes payments and calculates sales tax. It keeps the card details and billing address that we do not see.
• An artificial intelligence provider runs the features that use artificial intelligence. The app asks for your consent before it first sends anything about you to that provider. You can revoke it under Manage account. It receives only what the feature you use needs, such as a photo you ask it to read, the text of a command, a meal search, or a recipe page. The provider does not use what we send to train its models, and it deletes it within 30 days.
• Resend delivers every email we send.
• Instacart, a grocery delivery service, receives the names and counts of the items you choose when you choose Order on Instacart, to build your shopping list on its site. Nothing else about you is sent with them. What happens on Instacart's site is under Instacart's own policy.
• Open Food Facts receives a barcode number when you scan or type one, to suggest the product name. Nothing else about you is sent with it.
• We share the approximate area of your entered address with a weather provider. We use local temperatures to learn how long food lasts.
• Zoho hosts the mailbox for hello@manystops.com.
• If you turn notifications on, a push service delivers them. In the iPhone app that is Apple. In the Android app it is Google. In a browser it is the browser's maker: Google for Chrome, Apple for Safari and Mozilla for Firefox. A notification to a browser is encrypted for your device before it leaves us. That push service cannot read it. A notification to the iPhone or Android app travels encrypted. Apple or Google can read it, under its own policy.

The people in your group can see everything stored in it, including the home address if one has been set. They can also change it. We tell you this before you invite anyone. Only the group owner can change the home address.

Our own staff can reach your account and billing information to answer a support request, and not your group's shopping data or its home address.

We may disclose information if we believe in good faith that the law requires it. We may also do so to enforce our terms, or to protect the safety and rights of people or of the Service. If the business is merged or sold, the new owner would be bound by this policy for the information it receives.

6. Cookies and similar storage

The Service uses no advertising or analytics cookies. It stores in your browser only what it needs to work. It keeps your sign-in session and a copy of your group's data, with any changes waiting to sync. It keeps a few preferences, such as the tab you last used. It also keeps the device identifier described in section 1.

This storage is strictly necessary for the Service you asked for. It is removed when you sign out, except for the device identifier and your preferences on that device. You can also clear it at any time in your browser settings. Doing that while changes are still waiting to sync would lose those changes.

We do not track you across sites. We therefore do not respond differently to Do Not Track or Global Privacy Control signals. Our practices are the same for everyone.

7. International transfers

The Service is operated from the United States. We and our providers process and store your information there. If you use the Service from another country, your information will be transferred to a country whose data protection laws may differ from yours.

Where the law requires a safeguard for such a transfer, we rely on the standard contractual clauses or similar mechanisms our providers offer. ManyStops is not directed at people in the European Economic Area or the United Kingdom. We still extend the rights described below to anyone who asks.

8. How long we keep information

We keep your group's data for as long as your account exists. When you delete your account, the personal parts are removed or de-identified as described above. The de-identified data is deleted 24 months after that.

We keep records of purchases for as long as tax and accounting law requires. Security and provider logs are kept for the periods those providers set. Backups kept by our database provider are overwritten on that provider's own schedule.

Emails and feedback you send us are kept for as long as we need to deal with your request. We keep them for a reasonable time afterwards in case of follow-up questions or disputes. If you delete your account, your email address is removed from any feedback you sent.

9. Security

We protect your information with encrypted connections and hashed passwords. Access controls keep each group's data to the people in it. No system is completely secure, and we cannot guarantee the security of information you send us.

If a security breach affects your personal information, we will notify you and the authorities where the law requires it. You can help by keeping your password secure. Tell us at once if you think your account has been misused.

10. Your rights and choices

You can see and change most of your information in the app. You can download your price history as a spreadsheet from the account screen whenever you like. You can delete your account there yourself. You can withdraw your consent to the features that use artificial intelligence under Manage account.

Depending on where you live, you may have the right to ask for access to the personal information we keep about you, or for a copy of it in a portable format. You may also have the right to ask for corrections or deletion, to restrict or object to some uses, and to withdraw consent you gave. You can use any of these rights by emailing hello@manystops.com.

We may need to confirm that a request really comes from you before acting on it. We will respond within the time the law allows, which is generally 45 days. We will not treat you differently for using a right.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to complain to your local data protection authority. If we refuse a request, you can ask us to reconsider it by replying to our answer.

An authorized agent may make a request for you if you give them written permission. We may ask you to confirm that permission with us directly.

11. Notice for California residents

This section adds to the rest of the policy for California residents. It covers the categories of personal information described above. In the past 12 months we collected them directly from you, from Google or Apple if you sign in with them, and automatically through our providers' logs.

• Identifiers, such as your email address and IP address, and commercial information, such as the record of a plan you bought. We use them to provide the Service and take payments.
• Internet or similar activity, such as the requests made to our servers. We use it for security and to fix faults.
• Geolocation data, limited to the addresses you choose to enter, their map positions, and your location when you save a store there. We use it to work out distances between your home and your stores.
• Electronic and visual information, limited to the photos you choose to upload, receipts included. We use them to show them to your group. When you ask, we also use them to read a receipt or a label.
• Inferences the Service draws from your own data, such as suggestions about what to buy. They are shown only to your group.
• Sensitive personal information. We collect none apart from your account login and password. We use those only to sign you in.

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.

California residents have the right to know what personal information we collect and how we use and disclose it. They can request its deletion or correction. They can opt out of sale and sharing, although we do neither. They can limit the use of sensitive personal information, although we use it only to sign you in. They have the right to be free from discrimination for using these rights. Requests can be made by email to hello@manystops.com.

Under California's Shine the Light law, a California resident may ask us once a year about disclosures of personal information to third parties for their direct marketing. We make no such disclosures.

12. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, please email us. We will delete it once we are told.

13. Other people's information and other sites

The Service may show links to other sites. Those sites have their own privacy practices, and we do not control them. Enter other people's personal information, such as an invitee's email address, only where you have a good reason to.

14. Changes to this policy

If this policy changes in a way that affects how your information is used, we will say so in the app and by email before the change takes effect. The date at the top shows when it was last updated. Earlier versions are available on request.

15. Contact

Send any privacy question or request to hello@manystops.com.