Cart & Card
Privacy policy
The short version
- We collect only what the app needs to work: your sign-in details and what your family puts in the app.
- Your list, stores, and rewards cards are shared only with the people in your family.
- No ads, no tracking or analytics, and we never sell or rent your information.
- You can ask us to delete your account and data at any time.
Who runs Cart & Card
Cart & Card is a free shared grocery list and rewards-card app made by Tommy & Co. and run by Tommy. In this policy, "we" and "us" means Cart & Card and Tommy & Co. Questions? Email support@tommyandco.app.
What we collect
| Information | Examples | Why |
|---|---|---|
| Account | Your email address and name. If you sign in with Google, the basic profile Google shares (name, email, and a link to your profile picture). | To sign you in and show your family who added what. |
| Family details | Family name, members, nicknames, invite code, and your family's stores, categories, flags, and favorites. | To set up and share your family's list. |
| List items | Item names, quantity, brand, notes, store, aisle, flags, prices, who added or checked off an item and when, and item photos you choose to add. | To run the shared list, remember past items and prices, and show the family's activity. |
| Rewards cards | Store, card or member number, barcode type, the phone or email on the store account, notes, and renewal dates. | So your family can show the card at checkout. |
| Technical information | IP address, browser and device type, and similar details recorded by our hosting provider when the app loads. | To deliver the app and keep it secure. |
Saved only on your phone: some settings stay on your device and are never sent to us, such as your theme, Shopping Mode settings, an in-progress shopping trip, and tips you've dismissed.
Camera: the camera is used only when you choose to scan a barcode or take an item photo. Barcode scanning happens on your phone. Only the card number it reads, or the photo you choose to add, is saved.
What we don't collect: payment information, contacts, or your location.
Who can see your information
- Your family. Everyone in your family can see and change your family's list, stores, favorites, and rewards cards, including card numbers and the phone or email on those cards. Only add cards you're comfortable sharing with them.
- The person who runs Cart & Card. As the app's administrator, Tommy can access the database to keep the app running, fix problems, and help with account issues (for example, moving someone to the right family). He doesn't look through families' data for any other reason.
- Service providers. Cart & Card runs on Google Firebase (Google LLC), which handles sign-in, stores the app's data, and hosts the app. Some free code libraries (for barcodes and scanning) load from the jsDelivr network, which sees standard technical information like your IP address when they download. These providers handle data under their own privacy terms.
- When required by law. We may share information if we must to comply with the law or to protect the safety of users or others.
We don't sell or rent your information, use it for advertising, or share it with data brokers.
How it's protected
Data travels over encrypted connections and is stored by Google Firebase in the United States. Database rules allow only signed-in members of a family to read or change that family's data. No system is perfectly secure, so please don't store anything in Cart & Card you couldn't afford to have exposed, like bank card numbers or passwords.
How long we keep it
- Checked-off items, along with their photos, delete themselves 48 hours after being checked off. Deleting an item removes it right away.
- Rewards cards and other family data stay until a family member deletes them.
- If you leave a family, you lose access to its data. Items you added stay on that family's list unless someone deletes them.
- Past item names and prices are remembered to suggest them again. Your family's oldest suggestions are removed once the list of past items gets long.
Your choices
- See or change your information anytime in the app.
- Delete your account: email support@tommyandco.app from the address you signed in with. We'll delete your account within 30 days and let you know when it's done. Shared family data you added (like list items and cards) stays with the family unless you ask us to remove it too.
- Depending on where you live, you may have other privacy rights, such as asking what information we hold about you. Email us and we'll help.
Children
Cart & Card isn't meant for children under 13 to use on their own accounts, and we don't knowingly collect information from them. If you believe a child under 13 has created an account, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. For important changes, we'll also let you know in the app.
Contact
Questions or requests: support@tommyandco.app.