MyGroceryPal privacy policy
Version 2026-11-15. Last updated 15 November 2026.
MyGroceryPal compares UK supermarket prices. This policy says what we collect, why we are allowed to collect it, who else sees it, how long we keep it, and how you change your mind.
Who we are
MyGroceryPal is the controller of the personal data described here. It is run independently in the United Kingdom.
Write to hello@mygrocerypal.co.uk about anything in this policy, including to exercise any of your rights. We have not appointed a data protection officer, because we are not required to.
This policy covers the MyGroceryPal app on iOS and Android, the website at mygrocerypal.co.uk, and the MyGroceryPal browser extension.
Your choices
Profile › Privacy & data has three switches. One is off until you turn it on. The other two are on, and turning one off is how you object to it.
- Product improvement is off until you turn it on. It covers usage analytics and masked recordings of the app and website, both with Amplitude, and helps us improve MyGroceryPal. Recordings hide all text and everything you type, block loyalty card barcodes and the barcode scanner's camera view, and cover only some visits. Until you allow analytics, its client is never started: it writes nothing to your device and sends nothing to our analytics provider. The browser extension asks in its own popup, and sends nothing to our analytics provider until you allow it there: see The browser extension below.
- Crash reports are on by default, under our legitimate interest in a working app: they help us find and fix bugs. You can object at any time by turning them off, and they stop.
- Usage statistics are on by default, under our legitimate interest in knowing how many people use MyGroceryPal. They count the days you use it, signed in or not, and, when you are signed in, which features you use, such as your list, comparisons, alerts and scanning. You can object at any time by turning them off, with or without an account, and they stop.
On the website, Google also asks whether its ads may use cookies, and in the app it may ask the same about its ads. Those choices are Google's to record, not ours, and changing them changes nothing above: see Advertising on the website and Advertising in the app.
On the website, if you are signed in to Google in your browser, Google may offer to sign you up to MyGroceryPal with your Google account in one tap. The page loads Google's sign-in code for this only once our privacy prompt has been shown, and Google sees that you visited. We receive your name and email address from Google only if you choose to continue, as with Continue with Google.
Usage statistics means our servers note each day you use MyGroceryPal, whatever your analytics choice. If you are signed in, we keep the date against your account, with the platform (app, website or extension) and app version you last used, and, if you created your account on the website, the device identifier you created it from, to compare versions of our sign-up screens. If you are not, we keep the date against your device identifier, on the website and in the app from version 2.3.12; the browser extension does not report these. On the website we also note, with the date, whether it opened inside another app's built-in browser (TikTok, Instagram or Facebook, say), read from the browser name every website receives; if you allow analytics, we keep the campaign or website that brought you with it too, and keep both with your account when you sign up, to tell which channels bring people in. If you are signed in, we also note when you add products to your shopping list, tick them off or clear it, open a store-by-store comparison of your basket, choose a swap in it, share or export your list, price a pasted list, scan a barcode, start a voice search, get a result from it or open a product from its results, say a list, set a price alert, open a price alert we sent you or your inbox, open an own-brand alternative, and see the Pro offer, and when the app asks you to rate it, but never which products, barcodes or what you searched for. We also count which features you use from the records those features already keep, such as your saved products and alerts, storing nothing new for it. We use these only to count how many people come back each week and on which platform, how many of those not signed in go on to sign in, and which features the people who come back use, and share them with no one. Nothing is stored on your device for it: we read the device identifier the app already sends, which the law allows for statistics like these without asking first, as long as you can object. If you sign in, the dates kept against your device identifier move to your account, and we note against your account the day you signed in, the dates that moved, the platform and whether the account was new. We keep each date and each feature note for 13 months, and delete those kept against your account when you delete it. To object, turn off Usage statistics in Profile › Privacy & data, signed in or not, or email us. We stop counting your days and features and delete what we kept.
When you open a product on a shop's website from MyGroceryPal, our servers note the shop, the product, the screen you opened it from, the platform (app or website) and when, whatever your analytics choice, so we can count the visits that earn us commission. If you are signed in we keep it against your account; if not, we keep no identifier with it at all. The browser extension does not report these. We keep each click for 13 months, and delete them when you delete your account. It is under the same legitimate interest; to object, email us and we will stop.
To change any of them:
- On the website: choose in the privacy prompt, or open Profile › Privacy & data at any time. Ads have their own Change ad choices button there.
- In the app: choose in the privacy prompt, or open Profile › Privacy & data at any time.
- In the browser extension: choose in the privacy prompt in its popup, or open Privacy choices at the bottom of the popup at any time. The extension has its own device identifier, so its choices are its own: changing them does not change the app or the website, and changing those does not change the extension.
Turning something off is exactly as easy as turning it on, in the same place, and takes effect at once. Withdrawing consent does not make our earlier processing unlawful, but it stops the processing from then on.
Recordings now cover the app as well as the website, so we ask again anyone who chose about recordings before 15 September 2026. That answer covers analytics and recordings together.
We keep any earlier choice to allow analytics without recordings. We change it only when you use the Product improvement control or make a new choice in the prompt.
On the website and in the app, allowing or declining analytics and recordings in the prompt does not change your crash-reporting or usage-statistics choice. You can turn either off separately in Profile › Privacy & data.
The extension's prompt answers both of its choices at once: Accept all allows product analytics and keeps crash reports on, and Reject all refuses analytics and turns crash reports off. Choose Manage to answer them separately.
We keep a record of each choice you make, so we can show what you agreed to and when. That record is in the table below.
What we process, and why
| Purpose | Lawful basis | What we collect | Who processes it | Where | How long |
|---|---|---|---|---|---|
| Running the service — showing prices, saving your basket, keeping you signed in | Contract, and legitimate interest for guests who have no account | Your device identifier; your saved products and basket, with any notes, swaps and target prices you set; the alerts you set up, including any words or brands you ask us to watch; loyalty card numbers you add; your store and region settings; your email address and account identifier if you sign in | MyGroceryPal; Auth0 for sign-in; Cloudflare in front of our servers | United Kingdom. Auth0 is hosted in the United States. | Until you delete your account. Guest data is held against the device identifier only. |
| Personalising deals | Legitimate interest in showing you relevant deals, and in checking that the order we show them in helps | If you are signed in, the products you view and share, which deals and search results we showed you and in what order, and a taste profile we work out from the last 90 days of what you viewed and from what you save and set alerts for. Never your search text. | MyGroceryPal | United Kingdom | 90 days. The taste profile is kept up to date and deleted with your account. |
| Counting visits to shops | Legitimate interest in knowing which shops and products people open from MyGroceryPal, which is how it earns commission. You can object by email. | The shop, product and screen of each product you open on a shop's website, the platform, and when. Your account if you are signed in; nothing that identifies you if not. Recorded whatever your analytics choice. | MyGroceryPal | United Kingdom | 13 months, and deleted with your account |
| Counting returning users | Legitimate interest in knowing whether MyGroceryPal is useful. You can object to the dates and features in Profile › Privacy & data, signed in or not, and to the rest by email. | If you are not signed in, the dates you used the website or app, against your device identifier; when you then sign in, the day you signed in, the dates that moved to your account, the platform and whether the account was new. If you are signed in, the dates you used the app, website or extension, the platform and app version you last used, whether you created your account in the app or website, the extension, or an AI assistant such as ChatGPT or Claude, and which screen asked you to sign up, such as Saved. Recorded whatever your analytics choice. Of that screen we keep only its name, to learn which screens help people get started; nothing links it to other sites, and unless you allow analytics the app holds it only in memory while you sign up and never saves it to your device. On the website, with each date we also record whether it opened inside another app's built-in browser (TikTok, Instagram or Facebook, say), whatever your analytics choice, and keep that with your account when you sign up. If you allow analytics, we also record the campaign or website that brought you to MyGroceryPal (on Android, the one the Play Store says you installed from), and for a guest keep it with the first date and move it with you when you sign in. When you add products to your shopping list, tick them off or clear it, open a store-by-store comparison of your basket or choose a swap in it, share or export your list, price a pasted list, scan a barcode, set a price alert or open one we sent you, open your inbox, open an own-brand alternative, see the Pro offer, or are asked by the app to rate it (not which products or barcodes). Also when you first saved a product or set an alert, and, if you created your account on the website, the device identifier you created it from, which we use only to compare versions of our sign-up screens. | MyGroceryPal | United Kingdom | 13 months, and deleted with your account. Where you created your account is kept until you delete it |
| Recording your privacy choices | Legal obligation — we must be able to show what you agreed to | The purpose, whether you allowed it, the policy and consent version, how and where you decided, the browser or app you used, and a truncated IP address | MyGroceryPal | United Kingdom | 24 months from the decision, even if you delete your account |
| Security and abuse prevention | Legitimate interest in keeping the service available | Request logs, daily rate-limit counters keyed on your account, your device identifier or your IP address, and short-lived sign-in codes | MyGroceryPal; Cloudflare | United Kingdom | Rate-limit counters 90 days. Sign-in codes 24 hours. |
| Crash reporting — diagnosing errors so the app keeps working | Legitimate interest. You can object, and it stops. | The error and where in the code it happened, your app version and platform, your device identifier, your analytics identifier if you allow analytics, and your account identifier if you are signed in. Not your IP address, and not your email address. | Sentry | Germany | Deleted automatically at the end of Sentry's retention period, currently 30 days |
| Analytics — understanding which features get used | Consent. Off until you allow it. | Which screens and features you use, searches you run, an analytics identifier created by Amplitude, and your account identifier if you are signed in. Not your IP address, advertising ID, mobile carrier or device manufacturer. | Amplitude | European Union | 12 months. On request, and when you delete your account, we send Amplitude an erasure request for everything it holds against your account identifier, and keep retrying it until it succeeds. That request only takes an account identifier, not a device identifier, so it cannot reach anything you sent before you first signed in: those events carry only an identifier Amplitude assigned before you had an account, and they are deleted after 12 months instead. |
| Session replay — a replay of your use of the app or your visit to the website, to find usability problems | Consent. Off until you allow Product improvement, which includes analytics and masked recordings of the app and website. | A recording of the screens and pages you saw and what you tapped, with all text and everything you type masked out, and loyalty card barcodes and the camera view blocked. Only some of those visits. | Amplitude | European Union | 30 days from when Amplitude receives the recording, or 90 days if we bookmark it to look into a problem. Erased by the same request as your analytics profile. |
| Notifications — price drops, restocks and reminders you asked for, and a weekly summary of how the products you saved are priced | Contract for messages about something you set up, such as a price alert or a saved product. Legitimate interest for alerts about deals on products you have looked at, which you can turn off in Notification preferences. Consent for other marketing messages. | Your push token, your notification settings, and a record of what we sent | MyGroceryPal; Expo for push delivery; Apple and Google for delivery to the handset | Expo is hosted in the United States | Until you turn notifications off, or delete your account |
| Email — email about your account and the alerts you set up, including a weekly summary of the products you saved, and separately email about deals and features | Contract for account and alert email. Consent for marketing email, recorded per type. | Your email address, your per-type email settings, and delivery events such as bounces | MyGroceryPal; Amazon Web Services (SES) | London (AWS eu-west-2) |
Until you delete your account. A list of addresses that bounced or unsubscribed is kept indefinitely, so we do not email them again. |
| Feedback and product reports | Legitimate interest in fixing what you tell us is wrong | Your message, its type and the screen you sent it from, your app version and platform. What you were looking at in the app: the screen before, and the last few products and shops you opened in that session, with the prices we showed you. If you are signed in, your account. If you gave one, a reply address, which is used only to answer you. | MyGroceryPal. A copy is emailed to us so we can read and reply to it; that mailbox is a personal Google Gmail account. | United Kingdom. The emailed copy is held by Google, which may store it outside the UK. | Kept. If you delete your account the message stays but is detached from you. The emailed copy is a separate record in our own mailbox. |
| Product survey — once you have used MyGroceryPal for two weeks, we ask you once how you would feel if you could no longer use it | Legitimate interest in knowing whether MyGroceryPal is useful enough, so we work on the right things. Answering is optional, and Not now means we never ask again. You can object by email. | Your account, when and on which device type we asked, your answer, and the main benefit you get if you choose to type one | MyGroceryPal | United Kingdom | Until you delete your account |
| MyGroceryPal Pro — selling the optional subscription and giving you what it includes | Contract. Checking whether you can have the free trial before you buy: legitimate interests (telling you the offer that actually applies to you) | Your account identifier, which RevenueCat uses as your subscriber id; which plan you bought; your purchases, renewals and cancellations as the App Store, Google Play or our website checkout reports them; the email address you give at website checkout, for receipts; whether Pro is active and until when; and the store you bought it in. When you are signed in to the app and it shows you Pro or an ad, it sends your account identifier to RevenueCat to ask whether you can still have the free trial. We never see your card or payment details. | MyGroceryPal; RevenueCat. Apple or Google take an in-app payment under their own terms; Stripe takes a website payment for us, and we never see your card details. | RevenueCat and Stripe are hosted in the United States | Until you delete your account. When you do, we ask RevenueCat to delete its record of you too. Deleting your account cancels a subscription bought on the website, but not one bought in the App Store or Google Play: cancel that there. |
| App updates — delivering fixes to the app between store releases | Legitimate interest in keeping the app you installed working | When the app checks for an update: your IP address, the platform, which version and update of the app you have, and a random identifier Expo's software creates for this installation | Expo | United States | Set by Expo. We keep none of it. |
| Website page statistics | Legitimate interest in knowing which pages are visited and how fast they load | The page you opened, the page that linked to it, and how quickly it loaded, sent by a small Cloudflare script. No cookies, nothing stored on your device, and no identifier. | Cloudflare | Global network | Set by Cloudflare. We see only totals. |
| Improving search | Legitimate interest | The search text and filters used, and how many results came back. Not linked to you, your account or your device. | MyGroceryPal | United Kingdom | 90 days |
We do not process special category data. We do not sell your data. We do not use it for advertising ourselves: ads on the website and in the app are served by Google, as Advertising on the website and Advertising in the app below explain. There is no automated decision-making that produces legal effects for you.
Voice search
When you tap the microphone in search or on Price my list, your speech is turned into text by your phone or browser, not by us. MyGroceryPal never receives, records or keeps your voice. The microphone is on only while the mic shows it is listening, and it stops when you pause, tap it again, cancel or leave the screen. The app asks for microphone and speech recognition access the first time you tap the mic, never before.
- iPhone and iPad: the app offers voice search only where iOS can recognise speech on the device itself, so your voice does not leave it.
- Android: the app asks Android to recognise speech on the phone. Where the phone cannot, Android’s own speech service, usually Google’s, does it under Google’s terms; the app never handles the audio.
- Website: your browser’s speech service does it, under the browser maker’s terms. Chrome and Edge send the audio to Google or Microsoft, and Safari to Apple. Browsers without one do not show the mic.
The words recognised become your search or list, exactly as if you had typed them, and are then handled as this policy describes for searches and lists.
The device identifier
Your device has a random identifier, and it is not optional. Every request the app makes to our servers carries it. It is how our servers know that a request from someone who is not signed in comes from a real MyGroceryPal app, and which saved data belongs to it. The app cannot work without it, so it is not covered by the choices above.
It is a random value we generate on first launch. It is not your device's serial number, not an advertising ID, and not any identifier your phone gives to anyone else. On its own it tells us nothing about you.
Using that identifier for telemetry is a separate matter, and it does follow your choices. Tagging a crash report with it rides the crash reporting basis, which you can object to. Counting the days you use MyGroceryPal with it, while you are not signed in, rides the usage statistics basis, which you can object to as well. Attaching it to an analytics profile happens only if you allow analytics. Turn analytics off and there is no analytics profile for it to be attached to. Object to crash reporting and no crash report is sent at all. Object to usage statistics and your days are no longer counted.
What we store on your device
This is everything MyGroceryPal writes to your device. On the website most of these are entries in your browser's local or session storage. Three are cookies instead: one from Auth0, always; two from Amplitude, only if you allow analytics. A fourth, mgp_internal, is set only for our own team. Cloudflare, which serves the site, may also set cookies of its own to tell people from bots. If the website shows ads, Google's ad code sets its own cookies: see Advertising on the website. Clearing site data removes all of them. In the app they are app storage, and uninstalling removes them. If the app shows an ad, Google's ad software keeps its own data and your ad choice in app storage too: see Advertising in the app.
Strictly necessary
These are needed for the service to work, so they are not covered by the choices above.
| Key | What it is for | How long it lives |
|---|---|---|
device_id | The device identifier described above | Until you clear site data or uninstall |
@mygrocerypal:consent:<subject> | A copy of your privacy choices, so the app can honour them before it has reached our server. <subject> is your account identifier, or guest if you are not signed in, so a choice you made on an account cannot carry over to the next guest who uses this device. | Until you clear site data or uninstall |
@mygrocerypal:consent:<subject>:pending | A choice you made that has not reached our server yet, so it is not lost if you are offline | Until it reaches our server |
Auth0 sign-in entries. On the website, keys beginning @@auth0spajs@@ in local storage. In the app, credentials in the iOS Keychain or the Android Keystore. | Keeping you signed in. Written and named by Auth0's own SDK, not by us. | Until you sign out |
auth0.jq9nHgG8IGKC30uNRxOav7PEl1TRIOCs.is.authenticated (website, cookie) | Strictly necessary. Tells Auth0's SDK a session probably exists, so it can skip an extra check with Auth0 before it asks. Holds no token, just a marker. Written and named by Auth0's own SDK, not by us. | 1 day from when it was last set |
AMP_2001dd3b9d, AMP_MKTG_2001dd3b9d (website, cookies) | Amplitude's analytics device id, session id and opt-out state, and the referrer or campaign the page was opened with. Written only if you allow analytics, and deleted when you withdraw it. In the app the same values are app storage, not cookies. | Up to 365 days |
session.started.v2.<account id> | Marks that this sign-in has been registered, so it is not registered twice | Removed when you sign out or switch account |
authCallbackRecoveryAt (website) | Stops a failed sign-in redirect from looping | Written once, acted on for 5 minutes |
@mygrocerypal:onboardingSignInPending | Remembers that you chose to sign in during onboarding, so onboarding finishes once you are back | Removed once you are signed in |
signedOutNotice | A message telling you that you were signed out, shown once the app has reloaded | Removed once shown |
pendingSignupAttribution (website, session storage) | Written only if you allow analytics. Remembers the campaign or website that brought you here, across that same redirect, so it can be saved with your new account | Until sign-up finishes or the tab closes; ignored after 1 hour |
pendingSignUpSource (website, session storage; app storage in the app) | Written only if you allow analytics. Remembers which screen sent you to sign up, across that same redirect, so it can be saved with your new account. Without analytics the app keeps the screen in memory instead, so it is lost if sign-up redirects | Until sign-up finishes; ignored after 1 hour |
expo.eas-client-id (iPhone) or eas-client-id (Android) (app) | A random identifier for this installation, sent when the app checks for an update so Expo can deliver the right one. Written and named by Expo's update software, not by us. | Until you uninstall |
@mygrocerypal:registeredPushToken | The push token already registered, so it is not registered again | Removed when you sign out or turn notifications off |
mgp.staleBundleReload:<page>, mygp:chunk-load-reloaded-at (website, session storage) | Reloads a page once if the website was updated while you had it open, without looping | Until the tab closes |
mgp:document-first-history-entries (website, session storage) | Lets the back button take you to the right page | Until the tab closes |
Your settings, and what the app remembers
None of these are sent anywhere, unless a row says so. They exist so the app opens the way you left it.
| Key | What it is for | How long it lives |
|---|---|---|
@mygrocerypal:themePreference | Light or dark | Until cleared |
@mygrocerypal:hasCompletedOnboardingV2 | Whether you have been through onboarding | Until cleared |
@mygrocerypal:notificationStores | Which stores you want alerts for | Removed when you sign out |
lidl-region | Your selected Lidl region | Removed when you sign out |
@mygrocerypal:dealsFilters, @mygrocerypal:selectedStorePills, @mygrocerypal:dealsOnlyFilter, @mygrocerypal:freeFromOnlyFilter, @mygrocerypal:dietaryLabelsFilter, @mygrocerypal:savedFilterChoice, @mygrocerypal:savedStoreView, @mygrocerypal:uncheckedOnly | The filters and views you last chose | Until cleared |
@mygrocerypal:dealsSort, @mygrocerypal:lidlSort, @mygrocerypal:savedSort | The sort order you last chose | Until cleared |
@mygrocerypal:comparisonCollapsed | Whether the price comparison panel is collapsed | Until cleared |
@mygrocerypal:searchHistory | Your last 8 searches, offered back as suggestions. You can clear this in the app. | Until you clear it |
@mygrocerypal:firstSearches | Your first 3 searches, so the app can offer to set alerts for them | Until cleared |
@mygrocerypal:queryCache | A copy of the deals, saved items and plan the app last loaded, so it opens quickly and works offline | Removed when you sign out, and replaced when the app updates |
@mygrocerypal:brandAlertsSeenAt | When you last looked at brand alerts, so the badge is right | Until cleared |
@mygrocerypal:priceDropsLastSeen:<account id> | The savings total you last saw, so the app can show what is new | Until cleared |
@mygrocerypal:hasSeenSavedRenameSheet, @mygrocerypal:firstSaveNudgeShown, @mygrocerypal:savedEmailCaptured, @mygrocerypal:alertOfferClosed:<screen>, @mygrocerypal:postOnboardingPromptResolved | Tips and prompts you have already seen or dismissed, so you are not asked twice | Until cleared |
@mygrocerypal:compareSavedCtaDismissedAt, @mygrocerypal:compareBasketCardDismissedAt, @mygrocerypal:guestPriceDropAskDismissedAt, @mygrocerypal:keywordAlertsBannerDismissedAt, @mygrocerypal:marketingNudgeDismissedAt:<type>, @mygrocerypal:postOnboardingPromptDismissedAt, @mygrocerypal:savedEmailCaptureDismissedAt, @mygrocerypal:storeLinkInterceptSeenAt, @mygrocerypal:storeShareTipRetiredAt, mygrocerypal:getAppBannerDismissedAt (website) | When you dismissed a banner or prompt, so it is not shown again straight away | 7 to 90 days, then it can show again, depending which one. Two of them, once dismissed, do not come back at all. |
@mygrocerypal:postOnboardingPromptEngagement | How many products you have opened and searches you have run since onboarding, counted on your device only, so a tip appears at a sensible moment | Until cleared |
mygrocerypal:firstVisitAt, mygrocerypal:visitKind (website; the second in session storage) | When you first visited and whether this is a return visit, so we only suggest the app to people who come back | Until cleared; the second until the tab closes |
@mygrocerypal:reviewActiveDays, @mygrocerypal:lastNativeReviewAskDate, @mygrocerypal:firstOpenDate, @mygrocerypal:lastReviewPromptDate (app) | How many days you have opened the app and when it last asked you to rate it, counted on your device only, so it asks rarely and only once you have used it on a few days | Until cleared |
@mygrocerypal:pendingDeepLink, @mygrocerypal:pendingNotificationUrl | Holds a link you tapped until the app has started enough to open it | Removed as soon as it is used |
mygrocerypal:pending_save | Holds something you tried to save before signing in, so it is not lost | Until it is used; ignored after 1 hour |
pro-web-checkout-source (website, session storage) | Which screen you opened Pro checkout from, so the right screen greets you when you come back | Removed when you come back |
storeLinkInterceptArmed (website, session storage) | Remembers that you were about to visit a supermarket, so we can ask how it went when you come back | Until the tab closes |
@mygrocerypal:installReferrerConsumed (Android) | Marks the Play Store install referrer as read, so it is read once | Until cleared |
mgp_internal (website, cookie) | Set only if you open one of our own team's test links. It marks the browser as ours, and the website tells our servers so, so its visits are left out of our counts and it is shown no ads. | 1 year, or until a link clears it |
Written only if you allow analytics
In the app and on the website, if you allow analytics, Amplitude's SDK loads and writes entries of its own. On the website these are two cookies: AMP_2001dd3b9d, holding an analytics device id, a session id, and whether you have opted out; and AMP_MKTG_2001dd3b9d, holding the referrer and any campaign parameters the page was opened with. Both last up to 365 days, and withdrawing consent deletes both. In the app it is ordinary app storage, not a cookie — the SDK is told not to use cookies there — and its entries are named with an AMP prefix. Until you allow analytics, none of this runs, so none of it is written at all. Withdrawing consent stops it again. The extension does not load Amplitude's SDK at all, so it writes none of these entries; it sends its own events, and only if you allow analytics there. See below.
The browser extension
The extension stores four things of its own: local:device_id, its device identifier; local:consent, the privacy choices you made in it; local:auth_session, your sign-in tokens if you sign in; and session:auth_pkce, a short-lived value that secures the sign-in exchange and is discarded once sign-in finishes or the browser closes. Removing the extension removes all four.
On a supermarket product page the extension reads that page's web address and sends it to our servers, to look up prices elsewhere. It does not read your browsing history, and it does nothing on any other site.
The extension asks before it reports anything about how it is used. The prompt appears in its popup, the first time you open it, and covers two things: Product analytics, which is feature usage events sent to Amplitude, and Crash reports, which is errors sent to Sentry. Product analytics is off until you allow it, so nothing reaches Amplitude before you answer, and nothing reaches it at all if you say no. Crash reports are on from the moment the prompt appears, under our legitimate interest in a working extension, and you can turn them off in the same place. The extension does not record sessions.
To change either choice later, open the popup and choose Privacy choices. These are the extension's own choices, kept against its own device identifier, and separate from the ones you make in the app or on the website.
MyGroceryPal in ChatGPT, Claude and other AI assistants
You can add MyGroceryPal to ChatGPT, Claude or another assistant that supports MCP (how). When the assistant asks us something for you, it sends the product search text or product ids for that question; ChatGPT also sends OpenAI's pseudonymous identifier for your ChatGPT account. We use them to answer that one request. We do not keep the search text, we do not link the products to you, and we do not use any of it to build a profile. Product ids join the anonymous count of which products people look at. When an assistant prices a list and a store has nothing for one of its products, we count that product and store for the day, so we can see what our stores are missing; we keep the count for 90 days, and never with the words you asked for. The identifier, your account identifier if you have connected, or the IP address the request came from goes into the daily rate-limit counter described below, together with which assistant sent it, which we recognise from the address it came from. We count those counters to learn how many people use MyGroceryPal through each assistant.
Comparing a basket, setting an alert, saving products to your list, reading your saved items or removing items from them needs your MyGroceryPal account, and so does a price from more than 90 days ago. Connecting signs you in through Auth0, as the app does, and gives the assistant a token that can do only the things you agreed to on the sign-in screen: read your basket, add alerts, add to your list, read your list, and remove items from it. Reading your list shares the products on it, with their quantities and prices, with the assistant you connected. If you have no account, connecting creates one, and we record which assistant it was created from. Alerts set from an assistant are ordinary MyGroceryPal alerts and reach you however your notification settings say. You can disconnect in the assistant's settings at any time, and delete your account in the app as usual.
What you type into an assistant is handled by its provider under its own privacy policy: OpenAI for ChatGPT, Anthropic for Claude. We only see what the assistant sends us.
Who else processes your data
| Processor | What it does | What it receives | Where |
|---|---|---|---|
| Auth0 (Okta) | Sign-in and account credentials | Your email address, your login, and the profile you signed up with | United States |
| Cloudflare | Serves the website, protects our servers, and counts page visits and page speed on the website | Every request to the website, including your IP address, your browser and the page requested | Global network |
| Sentry | Crash and error reporting | Errors, app version and platform, your device identifier, your analytics identifier if you allow analytics, and your account identifier if signed in. Not your IP address, not your email address. | Germany |
| Amplitude | Product improvement: usage analytics and masked recordings of the app and website, if you allow them | Feature usage events and an analytics identifier. In the app, on the website and in the browser extension, only if you allow analytics. | European Union |
| Oracle Cloud | Hosts our servers: the database, the search index and the price data | Everything our servers hold | London |
| Amazon Web Services | Sending our email, and storing encrypted database backups | Your email address and the message; backups of everything our servers hold | London (eu-west-2) |
| Expo | Delivering push notifications, and app updates between store releases | Your push token and the notification text; for updates, your IP address, platform, app version and a random installation identifier | United States |
| Apple and Google | Delivering that notification to your handset | Your push token and the notification text | Global |
| RevenueCat | Running the MyGroceryPal Pro subscription, and its website checkout | Your account identifier, the email address you give at website checkout, and your subscription purchases and renewals | United States |
| Stripe | Taking payment for Pro bought on the website | Your card details, email address and billing country, entered in the checkout; we never see your card details | United States |
Everything else runs on our own servers, hosted by Oracle in London.
Nutrition facts, ingredients and the processing level (NOVA group) come from Open Food Facts, which we download in bulk. When you scan a barcode we do not recognise, our servers ask Open Food Facts, and its sister project Open Products Facts, for the product's name, sending only the barcode. Neither receives anything about you.
Sending data outside the UK
Auth0, Expo, RevenueCat and Stripe are hosted in the United States, and Cloudflare, Apple and Google run global networks. Auth0, Cloudflare, RevenueCat and Stripe transfers rely on the standard contractual clauses with the UK Addendum in each provider's data processing terms. Expo's rely on its certification under the UK Extension to the EU-US Data Privacy Framework. The emailed copy of your feedback sits in a personal Google Gmail mailbox, which Google may store outside the UK under its own consumer terms, not processor terms. Amplitude is on its European Union instance and Sentry is in Germany, so telemetry does not leave Europe. Ask us if you want more detail about any of these arrangements.
How long we keep things
- Your account and everything attached to it: until you delete your account, which you can do in the app.
- Your privacy choices: 24 months from each decision. This outlives your account on purpose, because we have to be able to show what you agreed to.
- Your product interaction history: 90 days.
- Search text and filters, which are not linked to you: 90 days.
- The days you used MyGroceryPal, the features you used, and the products you opened on a shop's website: 13 months.
- Rate-limit counters, which can hold an IP address, an account identifier or a ChatGPT identifier, and the assistant it came through: 90 days.
- Sign-in codes: 24 hours.
- Unsubscribed and bounced email addresses: kept indefinitely, so we do not email them again.
- Feedback and product reports: kept, but detached from you when you delete your account.
Crash reports are answered by retention, not by deletion
We want to be straight about this one. Sentry gives us no way to delete one person's crash reports on request, so we are not going to promise one.
Instead: a crash report carries no name, no email address and no IP address. The only identifiers on it are your device identifier, your analytics identifier if you allow analytics, and, if you were signed in, your account identifier. Every report is deleted automatically at the end of Sentry's retention period, currently 30 days, whether you ask or not. If you object to crash reporting, nothing further is sent from that moment and what exists ages out.
Affiliate links
Some links out of MyGroceryPal earn us a commission. We label those, and it never changes the price you pay or the order we show prices in.
- Morrisons links go through the affiliate network FlexOffers, at
track.flexlinkspro.com, which records the click and forwards you to Morrisons. These links are marked as sponsored. - Amazon links go straight to
amazon.co.ukwith one of our Amazon Associates tags attached, so Amazon can attribute the visit:mgpweb-21from the website,mgpapp-21from the app. A link to search Amazon carries the words you searched for. There is no third-party redirect. - The savings partners we suggest also earn us a commission: HelloFresh through FlexOffers, and TopCashback through the affiliate network Awin, at
awin1.com. - Links to every other supermarket are ordinary links and earn us nothing.
Once you follow any of these links you are on that company's site, under its privacy policy rather than ours.
Advertising on the website
The website may show ads served by Google AdSense. The browser extension shows no ads; the app's are covered in Advertising in the app below.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this website and/or other sites on the Internet.
- You can opt out of personalised advertising in Google's Ads Settings, and opt out of some other vendors' use of cookies for personalised advertising at youronlinechoices.eu.
- How Google uses information from sites that show its ads: policies.google.com/technologies/partner-sites.
Google's ad code loads on the website's Deals feed, search results, aisle and brand pages and product pages, once you have answered our privacy prompt either way, and on Profile › Privacy & data when you choose Change ad choices. The first time, Google's consent message, certified under the IAB Transparency and Consent Framework, asks whether ads may use cookies and similar technologies. If you decline, Google shows only limited, non-personalised ads. To change your answer at any time, open Profile › Privacy & data and choose Change ad choices.
We and Google are joint controllers for the data Google's ad code collects on our pages. Google alone decides how that data is used afterwards, under its own privacy policy. We receive only aggregate reports of impressions and earnings, never anything that identifies you.
Advertising in the app
The app may show ads in the Deals feed, among search results, on aisle and brand pages and at the foot of product pages, served by Google AdMob.
Nothing is asked of Google until you have answered our own privacy prompt either way. Then, before the first ad, Google's consent message, certified under the IAB Transparency and Consent Framework, asks where the law requires it whether ads may use your data. Its answer decides whether an ad is requested at all; if you decline, Google shows only limited, non-personalised ads, or none. On iPhone and iPad, from version 2.3.10, if Google's consent message allows personalised ads, the app then asks Apple's permission to track you across other companies' apps. Only if you allow both may Google personalise ads using your device's advertising identifier; otherwise the app asks Google for non-personalised ads only. You can change the tracking answer at any time in your iPhone's Settings, under Privacy & Security › Tracking. Earlier versions of the app never ask and request non-personalised ads only. On Android, Google may read your phone's advertising ID where your choice allows it; you can reset or delete that ID in your phone's settings.
To serve, measure and protect ads, Google's ad software collects your IP address, information about your device and the app, an advertising identifier where allowed, and your ad choice. To change your answer at any time, open Profile › Privacy & data and choose Change ad choices; the option appears wherever Google's consent message applies to you.
We and Google are joint controllers for the data Google's ad software collects in the app. Google alone decides how that data is used afterwards, under its own privacy policy: policies.google.com/technologies/partner-sites. We receive only aggregate reports of impressions and earnings, never anything that identifies you.
Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you, and get a copy of it.
- Rectify it if it is wrong or incomplete.
- Erase it. You can delete your account yourself in the app, which removes it and everything attached to it.
- Restrict what we do with it while a dispute about it is settled.
- Object to anything we do under legitimate interest, including crash reports, usage statistics and counting visits to shops.
- Portability — receive the data you gave us in a machine-readable form, or have us send it to someone else.
- Withdraw consent at any time, as easily as you gave it, using the controls described at the top of this policy.
There is no self-service data export yet. Email hello@mygrocerypal.co.uk and we will put your data together by hand and send it to you. We will answer within one calendar month of your request, as the law requires. If a request is unusually complex we may extend that by up to two further months, and we will tell you why inside the first month if we do. There is no charge.
To help us find your data, send your request from the email address on your account. If you have never signed in, give us the device identifier instead. We may ask you to confirm who you are before we release anything.
Complaints
If you are unhappy with how we have handled your personal data, tell us first at hello@mygrocerypal.co.uk, with "complaint" in the subject line. We will acknowledge it within 30 days and answer it properly as soon as we can. This is our complaints procedure under section 103 of the Data (Use and Access) Act 2025.
You can complain to the Information Commissioner's Office at any time, and you do not have to come to us first. The ICO is at ico.org.uk/make-a-complaint, or 0303 123 1113. You also have the right to a judicial remedy.
Children
MyGroceryPal is not aimed at children, and we do not knowingly collect data from anyone under 13. If you think a child has given us personal data, email us and we will delete it.
Changes to this policy
The version number at the top of this page changes whenever the policy changes materially. If a change affects something you consented to, we will ask you again about that specific thing rather than assume your old answer still stands. Minor corrections do not trigger a new request.