Grocery List Plus, Inc. ("GLPlus", "we", "us") is a North Carolina corporation located at 4800 Express Dr #19769, SMB 9347, Charlotte, NC 28208, USA. This policy applies to everything we do online: our websites, mobile apps, emails, and customer support.

Privacy questions? Email support@glplusinc.com or use the data-request form linked below.

Information you give us:

• Account info: name, email, phone, password (hashed), avatar
• Profile info: address(es), dietary preferences, allergies, favorite stores, household size
• Content you create: grocery lists, saved recipes, reviews, messages, inventory items
• Payment info: handled by Stripe / Apple IAP / Google Play — we store only subscription state, never full card numbers
• Support correspondence: what you send us and our replies

Information collected automatically:

• Device info: IP address, browser/OS version, crash logs, install ID
• Usage info: pages/screens viewed, buttons tapped, session duration, referrer
• Location (only if you allow): GPS, Wi-Fi, cell signals, Bluetooth beacons — used for "stores near me" and can be turned off in your OS settings at any time
• Scanning features: camera permission (for barcodes, prescription bottles, receipts) — images are processed but not retained unless you explicitly save them
• Cookies and similar: see our Cookie Policy

Information from third parties:

• Sign-in providers (Apple, Google) when you use social login
• Retailer APIs (Kroger, Walmart) for pricing and store data
• Recipe and nutrition providers (Spoonacular, Edamam) for content
• Ad and analytics partners (if you consented — see Advertising)

• Provide the service: create your lists, suggest products, show recipes and prices, process purchases, run the app
• Personalize: surface recipes and products that match your dietary preferences, location, and past activity
• Communicate: send transactional messages (password resets, order confirmations, recall alerts) and, with your opt-in, marketing
• Measure and improve: understand how people use GLPlus, debug issues, run A/B tests (anonymized)
• Advertise: show relevant ads if you consented to advertising cookies
• Protect: detect abuse, fraud, and security incidents; enforce our Terms
• Comply with law: tax, legal process, government requests where required

If you are in the EU or UK, we process your personal data on the following legal bases:

• Contract — to provide the features you signed up for
• Consent — for marketing, advertising cookies, precise location, SMS
• Legitimate interests — for analytics, fraud prevention, basic product improvement (balanced against your privacy)
• Legal obligation — for tax, accounting, and responding to lawful requests

You can withdraw consent at any time without affecting processing already done.

We use Google AdSense and (on mobile) Google AdMob to serve ads, and may use analytics providers including Google Analytics. When you allow "Advertising" cookies, Google and other partners may use cookies, device IDs, and pixel tags to show you ads they think are relevant and measure ad performance.

You can control Google's use of your data via Google's Ad Settings. You can also opt out at the industry level at aboutads.info. You can change your cookie choices in GLPlus anytime via the "Cookie settings" link in our footer.

We also operate a first-party sponsor-contract system ("tblcreatives") that tracks impressions, clicks, and conversions on in-app ad placements to measure sponsor ROI. This data is tied to your account only when you are signed in; otherwise it is aggregated.

We do not sell your personal information for money. Under some laws (e.g., CCPA) the term "sale" or "share" covers certain ad-tech data flows; you can opt out of those flows via our cookie settings or the "Do Not Sell / Share" link below.

We share limited information with:

• Service providers who help us run GLPlus (hosting, payments, email, SMS, recipe APIs, crash reporting, customer support) under contracts that restrict their use of the data
• Ad and analytics partners (only when you consent)
• Other users when you explicitly share content with them (shared grocery lists, friend connections, public reviews)
• Legal authorities when required by valid legal process, to enforce our Terms, or to protect rights and safety
• A successor entity in the event of a merger, acquisition, or asset sale (data rights transfer with the company)

Retention schedule (approximate; may extend where law requires):

• Account info: for the life of your account; deleted 30 days after account closure unless needed for law/fraud/dispute
• Transaction records: 7 years (US tax retention)
• Usage analytics: 26 months in identifiable form, then aggregated
• Advertising / tracking data: per the partner's retention (typically 13–26 months)
• Support tickets: 3 years
• Consent records (tblpolicyconsents): kept indefinitely as a compliance audit trail
• Inactive accounts: accounts with no sign-in for 24 months may be deleted along with associated data

Security measures include: encryption in transit (TLS 1.2+), encryption at rest for databases and backups, role-based access control for employees, logged admin access, regular vulnerability scans, and segregated production environments. Payment card data is tokenized and handled only by our PCI-compliant processors (Stripe, Apple, Google); we never see full card numbers.

Breach notification: if a security incident puts your personal data at risk, we will notify affected users and applicable regulators without undue delay (within 72 hours where required by GDPR, and according to state law in the US).

No matter where you live, you can:

• Access the personal data we hold about you
• Correct information that is inaccurate
• Delete your account and associated data ("right to be forgotten")
• Export your data in a portable format (JSON)
• Withdraw consent to anything you previously consented to

To exercise these rights, email support@glplusinc.com with "Data Request" in the subject. We verify your identity before acting and respond within 30 days (GDPR) or 45 days (CCPA). There is no fee for most requests.

Residents of California (CCPA/CPRA): in addition to the above, you have the right to know what categories of personal information we collect, the sources, the business purposes, and the categories of third parties we share with; the right to opt out of "sale" or "sharing" for cross-context behavioral advertising; and the right to limit our use of sensitive personal info. Exercise these via the "Cookie settings" link in our footer or by emailing support@glplusinc.com. We do not discriminate against you for exercising these rights.

Residents of the EU/UK, Brazil, and similar jurisdictions: in addition, you have the right to object to certain processing, to restrict processing, and to lodge a complaint with your local data-protection authority. Our EU representative will be identified here once appointed.

GLPlus is operated from the United States. If you access us from outside the US, your data will be transferred to the US (and potentially other countries where our service providers operate). For EU/UK users, we rely on Standard Contractual Clauses or equivalent lawful transfer mechanisms. Where required, we implement supplementary measures such as encryption and access controls to protect the data.

Grocery List Plus is not intended for users under 13. We do not knowingly collect personal information from users under 13, and we do not offer accounts or features for under-13 users. The signup flow enforces this with an age gate that blocks account creation for any user whose date of birth would make them under 13.

If we learn that an account belongs to a user under 13, we will delete it upon discovery, along with any associated personal information. If you believe an under-13 user has created an account, email support@glplusinc.com and we will investigate and delete it promptly.

Transactional messages (security alerts, password resets, order confirmations, food recalls) are sent as part of the service. Marketing messages require your opt-in and you can opt out anytime — reply STOP to any SMS, click "unsubscribe" in any marketing email, or disable push notifications in your OS settings.

SMS message and data rates may apply. We use Twilio to send SMS and follow their TCPA-compliant consent model. You represent that the phone number you provide is yours or that you are authorized to consent for it.

We do not respond to browser Do-Not-Track signals because no consistent industry standard exists. Instead, we use our cookie consent banner as the primary opt-out mechanism. Rejecting "Performance" and "Advertising" cookies stops cross-site tracking by us and our partners on this site.

For mobile, you can also use your device's "Limit Ad Tracking" (iOS) or "Reset Advertising ID" (Android) settings.

We'll update this policy as the product, laws, and our partners evolve. Material changes will be announced in the app, emailed to registered users where we have email permission, and posted here with a new version number and effective date. If a change materially reduces your privacy, we will request fresh consent where required by law.