Privacy

What we collect

Only what the service needs in order to work:

• Your account. Name, email address, and a phone number if you give us one. Your password is stored only as a hash — we cannot read it.
• Your household. The people in it (a household member does not need an account of their own), delivery addresses, and the instructions attached to them, such as “call on arrival” or a note about mobility.
• Your preferences. Brands, sizes, stores you like and stores you would rather we skip, substitution rules, and free-text notes you write for your shopper.
• Your requests. What you asked for, the items, budget, delivery window, messages between you and your shopper, and any photos you attach.
• Trip records. What was bought and at what price, photographs of receipts, and the mileage and time your shopper recorded for the trip.

We do not buy data about you, we do not build advertising profiles, and there are no third-party trackers or advertising cookies on this site. The only cookie we set is the one that keeps you signed in.

Who can see it

• Your shopper sees the households they are assigned to, and only those. For a trip they are working, that includes your list, your preferences and your address.
• The owner of the business can see all households, because they run the schedule and handle problems.
• Other customers can never see your household. Access is checked on every read, and the checks are covered by tests that specifically try to cross the line.

Notes have two channels. Anything written in a customer-visible note is shown to you. Internal operational notes are kept between the shopper and the owner and are stripped out of everything the customer side of the app can read.

Payments

Card numbers are never stored on our systems. When card payments are enabled, they are handled by a payment processor that is certified to hold card data, and we keep only the record of what was charged for which trip.

Where it lives and how it is protected

Data is stored in a private database, and photographs of receipts and lists are kept in a private object store that is not publicly readable — images are served through short-lived links generated for you at the moment you view them. Access to production systems is limited to the owner. Meaningful business events are written to an append-only audit log so there is a record of who changed what.

Service providers

We use a hosting provider to run the application and its database, and an object storage provider for images. Where SMS or email notifications are enabled, a messaging provider delivers them. These providers process data on our instructions in order to run the service, and are not permitted to use it for anything else. We do not sell or rent your information to anyone.

How long we keep it

Your household and its preferences are kept for as long as your account is open — that memory is the point of the service. Completed trips, receipts and financial records are kept as long as we need them for tax and accounting purposes, and then deleted. If you close your account we delete your personal data as described below, keeping only what the law requires us to keep for our own books.

Getting your data, or deleting it

Email ianwalmsley@ianlan.net from the address on your account and ask for either a copy of your data or the deletion of your account. We will confirm it is you, and act within 30 days.

Deleting your account removes your profile, household, addresses, preferences, requests, messages and photographs. Financial records of trips already completed are retained where we are required to keep them, with your personal details removed from them where that is possible. This is the same route whether you signed up on the web or installed the app from an app store.

Children

This service is for adults. We do not knowingly create accounts for anyone under 18. A household may of course include children — we simply do not need or ask for information about them.

Changes, and how to reach us

If this policy changes in a way that affects you, we will tell you before the change takes effect. Questions, corrections and complaints go to ianwalmsley@ianlan.net.