Privacy Policy

Welcome to GrocSnap ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our grocery receipt scanning and price tracking application.

By using GrocSnap, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies, please do not use our services.

Account Information

• Email address (for account creation and communication)
• Name (for personalization)
• Profile picture (optional, from Google Sign-In or manual upload)
• Password (encrypted, for email/password authentication)

Receipt Data

• Receipt images you upload
• Extracted information: store name, items purchased, prices, dates
• Currency and country information (for international receipts)

Location Data (Optional)

• ZIP code or city (for finding nearby stores)
• Browser geolocation (only with your explicit permission)

Usage Data

• App interactions and feature usage
• Device type and browser information
• Session information for authentication

GrocSnap offers Google Sign-In as a convenient authentication option for both web and mobile applications. When you choose to sign in with Google:

What We Receive from Google

• Email address: To identify your account
• Name: To personalize your experience
• Profile picture: To display on your profile (optional)
• Google ID token: To verify your identity securely

What We DON'T Access

• Your Google password
• Your Google contacts or calendar
• Your Google Drive files
• Any other Google account data

Token Verification

We verify Google ID tokens server-side using Google's official OAuth 2.0 endpoints to ensure the authenticity of sign-in requests. This verification confirms that the token was issued by Google for our application and has not been tampered with.

Mobile App Authentication

Our mobile applications use native Google Sign-In SDKs (Google Sign-In for Android/iOS). The authentication flow is identical to the web version, with the same limited data access and server-side token verification.

• Provide Core Services: Process your receipts, track prices, and maintain your shopping history
• Personalization: Show relevant store recommendations and price comparisons based on your location
• Analytics: Generate spending insights and budget tracking features from your receipt data
• Service Improvement: Analyze usage patterns to improve our AI receipt scanning accuracy and user experience
• Communication: Send important updates about your account or service changes (we don't send marketing emails without consent)
• Security: Protect against unauthorized access and detect potential security threats

We Do NOT Sell Your Data

We will never sell your personal information or receipt data to third parties for advertising or marketing purposes.

Aggregated & Anonymized Data

We may share aggregated, anonymized price data (not linked to any individual) to provide public price insights and store comparisons. This data cannot be used to identify you.

Service Providers

We use trusted third-party services for:

• AI Processing: OpenAI for receipt text extraction (receipt images are processed securely)
• Payments: Stripe for subscription billing (we never see your full card number)
• Authentication: Google OAuth for social sign-in
• Hosting: Cloud infrastructure providers with SOC 2 compliance

Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights, safety, or property.

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS/HTTPS) and passwords are securely hashed using bcrypt
• Secure Authentication: Session tokens with automatic expiration, server-side token verification for OAuth
• Access Controls: Role-based access control for administrative functions
• Database Security: MongoDB with authentication and access restrictions
• Regular Updates: We keep our systems updated with the latest security patches

While we strive to protect your data, no method of transmission over the Internet is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.

Our mobile applications (iOS and Android) follow the same privacy principles as our web application:

Camera Access

We request camera access solely for scanning receipts. Photos are processed and uploaded to our servers for AI extraction. We do not access your photo library without explicit action from you.

Local Storage

Session tokens are stored securely on your device to keep you logged in. We use secure storage mechanisms appropriate for each platform.

Background Activity

Our app does not run background processes or track your location when not in use.

Third-Party SDKs

Our mobile apps use Google Sign-In SDK for authentication. No advertising or tracking SDKs are included.

You have control over your data:

• Access: View all your data through your profile and receipt history
• Edit: Update your profile information, edit or delete individual receipts
• Delete: Request complete account deletion through our Account Deletion page
• Export: Download your receipt data (feature coming soon)
• Opt-out: Disable location services or switch to manual location entry
• Revoke Google Access: Disconnect Google Sign-In through yourGoogle Account settings

GrocSnap supports receipts from multiple countries and currencies. When processing international receipts:

• We detect and store the currency (USD, EUR, GBP, etc.) from your receipts
• Country information may be inferred from store names and receipt formats
• All currency data is displayed in its original form without conversion
• Data is stored on servers located in the United States

For users in the European Union: We process your data based on your consent when you create an account. You may request data deletion at any time.

If you have questions about this Privacy Policy or your data, please contact us:

We aim to respond to all privacy inquiries within 48 hours.