Your data stays yours.

If you join the list: your email address and ZIP code, your first name if you choose to give it, the stores you tell us you shop at, and the date you joined. If a friend invited you, we note whose invite it was so their level can go up. That's all.

If you compare a grocery list: the items on your list, your ZIP code, how you like to shop (delivery, pickup or in-store) and your tip setting. If you add screenshots of your cart, we use them only to read the items and their prices, then discard them; the prices stay in your browser so we can compare your cart with nearby stores. If you tap Use my location, your phone shares your approximate location (to about 100 meters) so we can find the stores nearest you. It's kept on your phone, used only for that store search, and not stored on our servers. You don't need an account, and we don't ask for your name, address, phone number or payment details.

If you join or create an account (optional): your email address and first name, the lists you save, how you like to shop, and a short record of each comparison (date, number of items, ZIP, winning store, total, what it saved you, and the usual total if you entered one), so you can see them on any device and track what you've saved. Joining signs you in on that device; on another device you sign in with a one-time link we email you; there's no password. We keep a session cookie so you stay signed in.

“Not right?” fixes: when you pick the right product for an item, we keep the item's text and the product you picked, linked to your account, so Tilo uses it for you and, once another shopper agrees, for everyone. It's deleted with your account.

Items we couldn't match: when a store has nothing that matches an item on a list, we keep that item's text and the names of the store's products for up to 90 days, so we can improve matching. Nothing about who asked is kept with it.

Anonymous usage counts: we count things like page views, comparisons and shares so we know what's useful. We record only what happened and the date, with no cookies, no IP address and nothing that identifies you or your device. If your browser sends “Do Not Track”, we don't count anything.

Automatically: like most websites, our hosting provider records basic technical details when you visit, such as your IP address, browser type and the pages requested. We use these only to keep the site running and secure.

We use your email and ZIP code only to tell you when Tilo is available at stores near you, and to send occasional product updates. Every email has an unsubscribe link.

We use your grocery list and ZIP code only to find prices at nearby stores and show you the results.

Your grocery list and settings are saved in your own browser so they're there when you come back. Unless you sign in, we don't store them on our servers. If you join, your browser also remembers your first name and invite code so we can greet you and show your level. Clearing your browser data removes them. If you sign in, your saved lists and settings are also stored in your account so they appear on your other devices.

We never sell your data, and we never share it for advertising.

We use a small number of service providers to run Tilo, and they only handle data on our behalf:

• Vercel hosts the website.
• Supabase stores the list of people who have joined (email, ZIP code and date), in the United States.
• Resend sends our emails (your email address, first name and invite link go to it for that).
• Anthropic reads cart screenshots you choose to add, to find the items, and checks which store product matches each item on your list (it sees product names, sizes and prices only, nothing about you). We don't store the screenshots, and under its commercial terms Anthropic doesn't use them to train its models.
• OpenFreeMap supplies the map images if you open the Map view of your results. Your browser asks it for the map of the area shown, so it sees that area and your IP address, nothing else.
• Kroger receives the product names we search for and the nearby store we're checking, so it can return prices. If you use your location, it receives that approximate location to find stores near you. It doesn't receive your email or anything that identifies you.

We may also disclose information if the law requires it.

We never ask for your store passwords or loyalty card numbers, and we never place orders or take payments. You always check out directly with the store.

If you choose Send to my cart (Harris Teeter, Kroger and other Kroger-family stores), you log in on Kroger's own page (Harris Teeter, Ralphs and the other family stores are part of Kroger) and give Tilo permission to add items to your cart. We use that permission once, to add the items in your basket, and don't keep it. We can't see your password, your orders or your payment details.

We keep your email and ZIP code until you unsubscribe or ask us to delete them. Server logs are kept for a short time by our hosting provider.

You can unsubscribe from any email at any time. If you have an account, you can delete it, with your saved lists and history, in one tap under My account. To see, correct or delete the information we hold about you, email hello@getcartiq.app and we'll take care of it within 30 days.

Tilo is for adults doing their grocery shopping. It isn't meant for children under 13, and we don't knowingly collect their information.

If we change how we handle your information, we'll update this page and the date at the top. If the change is significant, we'll email everyone on the list first.