Privacy policy | Cartworth

The short version. Cartworth has no accounts and no sign-up, so there is nothing about you for us to hold. There is no analytics SDK, no advertising SDK and no tracking of any kind, and nothing is sold or shared with data brokers. The one thing that genuinely leaves your device is the thing that has to: to look up a price, your ZIP or approximate area and your search term are sent to the retailer's own website, exactly as they would be if you typed them into that site yourself.

There is no account

Cartworth has no sign-up, no log-in, no email address field and no password, anywhere, on any platform. We do not know who you are, we cannot look up "your" data because there is no identity to look it up by, and we could not hand a list of users to anybody because no such list exists.

This is not a slogan. It is a structural decision, and everything below follows from it.

The iPhone app

Cartworth for iPhone has no Cartworth server behind it. There is no backend that we run, no database of yours that we keep, and no synchronisation service. Everything the app creates is written to storage on your iPhone.

What stays on your iPhone

Your ZIP code, chosen search radius, and which stores you have selected.
Your recent searches.
Your shopping list.
Your price watches, their target prices, and your favorite brands and ingredients.
The price history Cartworth builds for the products you follow: what each store was charging, and when.
Your settings, including whether loyalty card prices are counted and whether alerts are on.
A short-lived cache of retailer responses, so that repeating a search a minute later does not hammer the retailer's site.

This is stored in the app's own on-device database and settings store. It is not backed by iCloud sync inside the app. It is covered by your iPhone's encryption, and it is included in your own iPhone backups if you make them, which is between you, your device and whoever you back it up to. Deleting the app deletes all of it.

What leaves your iPhone, and where it goes

A price lookup is, by its nature, a request to somebody else's website. Here is every category of outbound request the app makes, and why.

1. Retailer websites, to get prices

When you search, your device contacts the public websites of the retailers whose stores are near you and asks them what an item costs at the store nearest your area. The request carries your ZIP code or approximate coordinates and your search term, because that is the information the retailer's own site needs to answer the question. It does not carry your name, an email address, an account, a device identifier or an advertising identifier, because the app does not have any of those.

These requests go directly from your iPhone to the retailer, not through us. The destinations are the retailers' own storefronts and the online storefront platform that many chains use to publish their catalogues, the store locator service one chain uses, and the weekly circular service that chains themselves distribute their weekly ads through.

What those companies log about a visit to their own site is governed by their privacy policies, not by this one, in exactly the same way as if you had opened their site in Safari. We have no relationship with them, no data sharing agreement with them, and no visibility into their logs.

2. Apple, for maps and geocoding

To turn a ZIP code into a location, and to find the grocery stores on the map around you, the app uses the mapping and geocoding services built into iOS. Those lookups are handled by Apple under Apple's own privacy terms. We do not receive the results of that as data about you; the app simply gets back a list of nearby places and uses it on the device.

3. Apple, for purchases

If you buy Cartworth Pro, the entire transaction is handled by the App Store. See purchases below.

4. A recipe page you choose to import

If you paste a recipe link, the app fetches that page so it can read the ingredient list. That request goes to whatever site you pasted, and it happens only because you asked for it.

5. Links you tap

Tapping a link in the app, for example to this website or to the App Store, opens it in Safari in the ordinary way.

Location

Location is optional. You can type a ZIP code instead and never grant location access at all; the app works identically either way.

If you do grant it, the app asks only for "while using the app" access. It never asks for background or always-on location, and it requests location at roughly one kilometre accuracy rather than pinpoint accuracy, because finding which supermarkets are near you does not need to know which room you are in. The coordinates are turned into a ZIP, city and state by the geocoder built into iOS, which is an Apple service, and the result is then used on your device to look for stores. They are not sent to us, because we have no server to send them to.

Your area travels in two places. Apple's geocoder receives your coordinates in order to turn them into a ZIP, under Apple's privacy policy. And a ZIP or approximate coordinates form part of the request to a retailer's website, because that is how the retailer knows which store's prices to quote.

Camera, photos and recipes

The recipe import feature can use the camera or a photo you pick from your library. The photo is read on your device: the text recognition and the ingredient parsing both run locally. The image is never uploaded, never sent to us, and never sent to any third party service for processing. The app does not ask for or receive access to the rest of your photo library beyond the picture you choose.

Notifications and background refresh

If you turn alerts on, the app registers a background refresh task with iOS. When iOS grants it a moment to run, the app re-checks your watched items and your favorite brands using the same public retailer requests described above, and posts a local notification if something hit your target price or turned up in a weekly ad.

These are local notifications, generated on your device. There is no push server, no push token sent anywhere, and no remote notification service involved. Turning alerts off in Settings stops the background work entirely.

Purchases

Cartworth Pro is sold only through Apple's In-App Purchase. Your payment method, billing address and Apple Account details go to Apple and never to us; the app cannot see them and does not ask for them. The app checks with the App Store on your device whether a valid purchase exists and flips Pro on if it does. That check happens on your iPhone.

Apple gives us aggregate sales and subscription reports, which are Apple's own reporting about our business. They are not linked to individual people.

Tracking, analytics and advertising

There is none. Specifically, and verifiably:

The app contains no third-party SDKs at all. No analytics framework, no crash reporting SDK, no advertising network, no attribution or install-tracking library, no social login library.
The app's privacy manifest declares tracking as false, declares no tracking domains, and declares no collected data types.
The app does not use the advertising identifier and never presents an App Tracking Transparency prompt, because it has nothing to track you with.
Nothing is sold, rented, licensed or shared with data brokers, advertisers, or anyone else. We have no such arrangements and no way to fulfil one.
There is no profile of you, no behavioural segment, no cross-app or cross-site measurement, and no fingerprinting.

The free web version of Cartworth

The free web version of Cartworth, which does the comparison and the weekly ads in a browser, is a server-side application. Unlike the iPhone app, the price lookups are made by that server on your behalf rather than by your browser directly. That difference matters, so here it is plainly.

Still no account. There is no sign-up, no email address and no password on the web version either.
What it keeps, and where. The ZIP code and search radius you set, the stores you selected, your shopping list and your price watches are stored in this browser, using its local storage. They are never sent to us and never leave your device. The practical consequence is worth knowing: clearing your browsing data, using a private window, or switching to another browser or device means starting fresh, because there is no account holding any of it. You can export a copy from Settings at any time.
What the server keeps. A short-lived cache of retailer responses, and a record of what each product has cost over time. Neither is keyed by a person: there is no account, no visitor identifier and nothing that records which searches belonged to whom. To be exact about the cache, because it matters: its key is the store, the ZIP and the search term, so a ZIP and a term you searched do sit in it for the twenty minutes it lives. What is not there is any way to connect them to you, or to each other, or to anything else you looked up. They exist so that everyone's searches are faster and so that we ask the retailers for the same page far less often.
Where price requests come from. Your ZIP and search term reach the retailers' websites from the server, not from your browser, so the retailer sees the server's request rather than your browser's.
No analytics, no advertising, no third-party scripts. The web version loads no analytics, no advertising and no third-party tracking code, and sets no advertising or tracking cookies.
Server logs. Ordinary web server and hosting logs may record request information such as IP address, timestamp and the page requested, as they do for any website. These are operational records used to keep the service running and are not used to build a profile of you or shared for advertising.

If you would rather nothing at all sat on a server, use the iPhone app, which has no server of ours in the path.

This website

The marketing pages you are reading now are plain static pages. They set no cookies, load no analytics, load no advertising, embed no third-party scripts, no fonts from a third-party font service, no social widgets and no tracking pixels. Your visit is recorded only in ordinary web server logs as described above.

Deleting your data

Because there is no account, there is nothing held about you to request the deletion of. What exists, you control directly:

iPhone app: Settings has "Clear cached prices" and "Delete price history". Deleting the app removes everything it has stored, including your list, watches, favorites, settings and history.
Web version: remove list items and watches in the app itself, and clear your browser's storage for the site.

Your rights, children, and changes

Your rights. Privacy laws including the California Consumer Privacy Act and the GDPR give you rights over personal information a business holds about you: to know what it holds, to get a copy, to correct it, to delete it, and to opt out of its sale or sharing. We do not sell or share personal information, and we do not hold an identified profile of you to produce, correct or delete. If you believe we hold something about you, write to us using the contact below and we will tell you honestly what we find.

Children. Cartworth is a general audience grocery pricing tool. It is not directed at children, does not knowingly collect information from children, and has no account system through which a child could provide any.

Changes. If this policy changes, the date at the top of this page changes with it. Material changes will be described here rather than slipped in quietly.

Contact

Privacy questions, or a correction to anything on this page:

Email: support@cartworth.app
Support: cartworth.app/support