1. Who we are

CartSmart is operated by [LEGAL ENTITY NAME]. [ADDRESS]

Questions, requests or complaints: [privacy contact email]

2. What CartSmart does

You type a grocery list. CartSmart signs in to the grocery stores you have connected, using logins you have given it, reads the prices available to you at each store, works out the cheapest realistic plan including the cost of driving, and prepares the order.

Nothing is ordered without you approving it — two explicit taps. Payment happens on the retailer’s own website, against the card in your own account with that retailer. CartSmart cannot accept, store or enter payment details.

3. What we collect

You give us

Collected automatically

Never collected

No payment card numbers, bank details, wallets, tokens, or even the last four digits. Not anywhere, not ever. The credential vault can hold only a username and a password — there is no field for anything else, and a test exists that proves a card number cannot be placed in it.

We do not read your email. We do not read websites other than the grocery stores you have connected. We do not collect your date of birth, government identifiers, or health information.

4. Your retailer logins

This is the most sensitive thing we hold, and we hold it only because the product cannot work without it.

How it is protected

• Encrypted in your own browser before it ever leaves, using AES-256-GCM (authenticated, so tampering fails rather than producing nonsense), with a fresh random 96-bit IV for every save.
• The key is derived from your passphrase using PBKDF2-SHA256 with 600,000 iterations and a random 16-byte salt unique to you. The key is created non-extractable, meaning it cannot be read back out of the browser’s crypto layer, logged, or transmitted.
• We cannot decrypt your logins. There is no key column in the database, no key escrow, no server-side key in any configuration. We hold ciphertext we cannot open.
• Your passphrase cannot be reset or recovered. Nobody holds a copy, including us. If you forget it you delete the vault and re-enter your logins. We chose this deliberately. Minimum 12 characters.
• Your logins are decrypted in your browser and passed to the CartSmart browser extension within the same browser. They are never sent to our servers. No CartSmart server route accepts a password.
• Logins are never written to disk by the extension. They live only in memory, and are blanked and released when a run concludes — every store you approved has finished or been handed back to you — or when you cancel a run.
• If you abandon a run — price a list and never approve it, or close the tab mid-run — the logins stay in the extension’s memory until your next run, until you cancel, or until your browser stops the extension, which is usually a few minutes. They are never written to disk in any of those cases.
• You can remove any store’s login at any time in the app, which deletes it.

What is not encrypted, and you should know it

The name of each store you have a login for (for example “publix”), the time the row was updated, your vault’s salt and iteration count, and your account email. So our database shows which retailers you have connected — not the logins themselves.

The retailer sees your login, by design

The extension types it into that store’s own sign-in page, exactly as you would.

5. How we use it

Only to run the service: find your nearby stores, price your list, build the cheapest plan including driving cost, prepare orders for your approval, remember your corrections, show your savings, fix faults, keep the service secure, and contact you about your account or an order.

No advertising, ever. We do not build advertising profiles, do not serve personalized, re-targeted or interest-based ads, and do not let anyone else use your data for advertising.

We never sell your personal information. We never share it so someone else can market to you. We do not use it to assess creditworthiness or for lending.

6. Who sees what

We share your personal information with no one for their own purposes. No data broker, no ad network, no partner receiving your lists or your habits.

CartSmart does use service providers, which process data on our instructions only:

How long Anthropic keeps what we send it: [STATE ANTHROPIC’S RETENTION TERM AND LINK TO IT — read your agreement]

The retailers’ own privacy policies govern what they do with your order, and we do not control that. Read the policy of any store you connect.

We will disclose information if legally compelled — subpoena, court order, valid legal demand — and where necessary to investigate fraud or protect someone’s safety. If CartSmart is sold or merged, your information may transfer, subject to this policy.

Billing. CartSmart does not take payment for itself yet. When paid subscriptions begin, payment for the CartSmart subscription will be handled by a payment processor, which will receive your billing details and nothing about your lists, addresses or retailer logins. We will update this policy, and tell you, before that begins.

7. Product matching data, shared across customers

When we work out that a list line like “Jif peanut butter” means a particular product on a particular shelf, we keep that judgement and reuse it for every CartSmart customer, permanently. It makes matching better, faster and cheaper for everyone.

Each record holds the list line with the brand removed, the product name, the verdict, a fingerprint of the model and prompt used, and the time. Before the line is judged or stored it is stripped of email addresses, phone numbers and numbered street addresses.

These records carry no name, email, address, account identifier, or even a run identifier — nothing links one to you. They are grocery words and product names. But they are shared across all customers and they are kept indefinitely, and you should know that.

8. What the browser extension does on your computer

• Reads pages on 87 named grocery retailer hosts, and on other grocery sites only if you specifically allow it.
• Reads the price data those pages already load, and sends only product name, price, size and store back to us.
• Signs in with your stored login, searches, and builds carts.
• Presses the store’s own place-order button only after your two explicit taps.
• Uses Chrome’s debugger permission for two narrow things: sending the Enter key, and a 2×2-pixel screen capture whose only purpose is to make a hidden tab render. Those frames are counted and immediately discarded — never stored, never sent. No typed text is ever sent through the debugger.
• Does not read your email, does not read non-grocery sites, does not store a card.

9. When a run fails — diagnostics

If a step cannot find what it needs, CartSmart records what it was looking at so the fault can be fixed. We would rather describe this plainly than bury it.

What the record contains: the address text for that run, ZIP, radius, which stores were tried and how far each got, your list lines, and a description of the page — button and link labels, and the names and labels of input fields.

What it does not contain: anything you typed, and no retailer password. Field values are not copied from text, email, phone, number or password boxes — only the label of a choice you picked from a radio button or checkbox. Email addresses, phone numbers and street addresses are stripped from the step text before it is saved or sent.

Two things remain in the record, and we would rather say so:

• A store’s page prints your name on its account button when you are signed in. Names cannot be detected automatically, so a diagnostic record may contain your name.
• The address text for that run is kept in full, including the street. The street is sometimes what explains why store discovery picked the wrong stores or costed a drive wrongly, and we would rather be able to fix your problem. It is deleted with the rest of the record.

Who reads it: the CartSmart developer only, and only to fix the fault. A short failure summary also reaches our Slack, containing the run id, version, ZIP, radius and store phases, with quoted values and numbers stripped.

If you send us a report, we receive your message along with the run id, ZIP and radius.

Diagnostic records are deleted after 30 days, automatically and daily.

10. How long we keep things

Close your account and we delete your personal information, including your credential vault, within 30 days (the delete-account button in the app removes your account and the rows tied to it), except billing records we must keep.

11. Your rights

• See it. Email us for a copy.
• Correct it. Edit lists, addresses and preferences in the app.
• Delete it. Remove any store’s login in the app. Close your account and the rest goes with it.
• Disconnect. Removing a login stops CartSmart signing in there.
• Cancel your subscription whenever you like, once subscriptions begin.

Our database enforces row-level security, verified by test: one customer’s rows cannot be read by another.

Depending where you live you may have further rights — access, correction, deletion, portability, objection, and freedom from retaliation for exercising them. Email us and we will act within the time the law allows.

12. Security

Data is encrypted in transit. Your retailer logins are encrypted in your own browser with a key only you can produce, and we cannot decrypt them. Row-level security separates every customer’s data. Access to our admin data is restricted.

No system is perfectly secure. If a breach affects your personal information we will tell you, and any regulator we must tell, as promptly as the law requires.

13. Children

CartSmart is not for anyone under 18, and we do not knowingly collect information from children. If we learn we have, we delete it.

14. Changes

If we change how we handle your data we will update this policy and tell you directly, in the app and by email, before the change takes effect. We will not quietly broaden what we collect or who sees it.

15. Contact

[LEGAL ENTITY NAME] · [ADDRESS] · [privacy contact email]