Privacy Policy

Smart Shop ("we", "us") is a receipt-scanning and price-comparison service. This policy explains what we collect, how we use it, who processes it, and your choices. You can use the core search and upload features without an account ("guest mode").

Data we collect

• Account data (if you register): your email address and an optional display name.
• Receipt images you upload, and the store, item, price, date, and language data extracted from them.
• Location data: approximate coordinates you provide or that your browser reports when you tap "Use my location", and any addresses you enter. Used to sort results by distance and to place stores on the map. Precise device location is used only in the moment you request it and is not tracked in the background.
• Grocery lists and saved locations you create while signed in.
• A strictly-necessary authentication cookie (see below). We do not use advertising or third-party tracking cookies.

How your data is shared publicly

Receipt data you submit (store name and address, item names, prices, and dates — including guest uploads) is pooled into a public, unauthenticated search available to all users of the service, so that everyone can compare prices. Your account identity (email/display name) is not attached to that public data, and your uploaded images are not served publicly. Do not upload a receipt if you do not want its store/price contents to be publicly searchable.

Processors and international transfers

• AI extraction: uploaded receipt images are sent to a third-party AI provider (OpenRouter, which may route the request to an underlying model provider such as Google) for text extraction. This may involve transferring the image to servers in the United States.
• Geocoding / maps: addresses and coordinates are sent to OpenStreetMap's Nominatim service to resolve locations.
• Product lookup: barcodes are looked up against Open Food Facts and a public price-transparency catalog to enrich product names.

These providers process data under their own terms. Where required, we rely on appropriate safeguards for international transfers; a formal data-processing assessment is pending (this is draft copy).

Cookies

When you log in we set a single access_token cookie. It is HttpOnly and used solely to keep you signed in — it is strictly necessary for the authenticated features and is not used for analytics or advertising.

Retention

We keep account data for as long as your account exists. Receipt data may be retained to keep the public price history useful; uploaded image files may be purged on a retention schedule. When you delete your account we remove your personal account data as described below.

Your rights

Subject to applicable law, you may request access to, export of, or deletion of your personal data. Signed-in users can delete their account, which removes the account and its lists and saved locations and unlinks your receipts from your identity. To exercise other rights, contact us at the address published for the service.

This is placeholder text pending legal review and does not constitute legal advice.