Your information

Privacy, in plain language.

Cartwoven is developed by Salas Software LLC. This policy describes the Android and iOS apps, the signed-in Cartwoven website and related services. Effective October 25, 2026.

Your account and groceries

Firebase Authentication handles your email address, account identifier, sign-in credentials, verification, and password recovery. Cartwoven uses your account identifier to keep saved data separated by account.

The current normal build stores personal grocery collections, recipes, pantry entries, meal plans, product details, preferences, and recent scans on your device. Signing out keeps those files for your next sign-in. Uninstalling normally removes app-local data; exports and device backups may remain.

Starting with Android build 40, you can choose Enable sync to upload personal grocery collections, recipes, meal plans and saved product details to Firebase Firestore for your account. The signed-in website reads and edits those synchronized records. Sync is optional on mobile; using the web workspace stores its collections in Firebase. Personal photos, receipt images, recent scans and device preferences are not uploaded by personal sync. Household sharing and cloud photo sharing are not part of this web release. An iOS sync update is being prepared.

Photos, barcodes, and voice

Barcode scanning and photo text recognition process images on the device. Receipt, recipe, and shopping-photo drafts stay in the review flow until you choose what to save. Personal saved product photos stay on your device and are not uploaded by personal cloud sync. Saving a household product photo automatically shares it with current household members when household cloud access is enabled. That production service is still gated.

On Android, Google ML Kit sends device and app information, installation identifiers, performance, and usage metrics to Google. Its recognition processing does not send your images, recognized text, or results to Google. See Google’s ML Kit disclosure.

Voice entry uses your device’s speech service, which may process audio online under that service’s settings. On iOS, voice entry uses Apple Speech and may send audio to Apple servers; photo text recognition uses Apple Vision on the device. Cartwoven receives recognized text for your review.

Optional external services

If you request an external barcode lookup, the barcode is sent to Open Food Facts. Importing a recipe link contacts that website. Opening links and sharing exports uses the destination you select. Those services have their own privacy practices.

Guided store shopping

You can open supported grocery stores inside Cartwoven to search for each item. The selected search terms are sent to that store. Sign in to your store account separately; Cartwoven sign-in does not sign you into a retailer. Store pages handle cookies, account details, carts, payment and checkout under that store’s policies. Store sessions may persist in the embedded browser. “I added it · Next” records your confirmation in Cartwoven; it does not verify or add a retailer cart item automatically.

Optional retailer handoff

The Instacart handoff is in development and disabled in the normal build. When enabled, confirming a reviewed list sends its title and selected product names, quantities, units, and any selected barcodes through our server to Instacart. Cartwoven keeps an account-specific link record so repeated requests can reuse the same page. Account deletion removes those Cartwoven link records. Instacart handles product matching, availability, checkout, and information retained by its service under its own policies. This feature does not place an order or change your Cartwoven pantry.

Sharing and backups

People with access to a shared household or list can see its shared content. Removing access cannot recall screenshots, exports, or other copies they saved. Exported backups remain at the destination you choose. Imported copies get new identities. Full backups can include selected personal recipe, grocery-item and product photos, your opening-screen preference and saved store layouts. Per-list display choices remain on the device and are not included in backups. Settings and photos have separate restore actions; existing store layouts and corrected photo matches are protected. Grocery backups do not include receipt images or recent-scan history.

Controls and retention

Account → Privacy and data provides backup, recently deleted collections, scan-history controls, and device permission settings. Pausing recent scans stops new history entries; it does not erase existing entries or disable SDK diagnostics. History keeps up to 50 distinct barcodes and is separate from grocery backups and cloud sync.

Account → Privacy and data → Delete account starts the in-app deletion flow in versions with this option. After verified server acceptance, the app removes account-owned local files on that device and the service processes associated cloud data and the sign-in account. Completion is shown separately from acceptance. If you cannot use the app, follow the email request instructions on our account deletion page.

How long information is kept

• Account information: retained while your account exists. Accepted deletion requests are processed in stages; failures are retried, and a pending request is not reported as complete. The temporary processing job, including the email address needed for cleanup, is removed on completion.
• Local groceries and photos: retained until you remove them, clear the app’s data, or complete local account cleanup. Signing out does not delete them. Recently deleted collections remain available until you restore or permanently remove them. Exported and device-backup copies follow the storage provider’s settings.
• Deletion protection and recovery: we retain a minimal account-identifier marker, request identifier, hashed recovery-receipt identifier, status, timestamps and policy version. These contain no email, password, groceries or photos. They prevent stale clients from restoring deleted data and allow a device returning later to recover deletion status. They currently have no automatic expiry and are retained indefinitely for those purposes. This does not preserve an active sign-in account.
• Support correspondence: your email address, message and voluntarily supplied attachments stay in our support mailbox to handle and follow up on your request. There is currently no automatic expiry. You may request deletion of correspondence; we will explain any specific records we must retain for an unresolved dispute or legal obligation. Account deletion does not automatically clear the separate support mailbox.
• Service operations: hosting, authentication and speech providers may process network/device information and service logs under their own retention policies. Cartwoven’s deletion service does not intentionally log passwords, grocery content or recovery secrets.

To ask about these retained records, contact the privacy address below. Retention of recovery records is a technical policy, not a claim that law requires indefinite retention.

Cartwoven does not add its own advertising, analytics, or automatic crash-reporting integration. Firebase and Google ML Kit still perform their documented service and diagnostic processing.

Membership purchase verification

Cartwoven offers monthly and yearly subscriptions with an eligible introductory trial. Apple or Google handles payment. Cartwoven stores your account identifier, a random account-to-purchase binding, store transaction identifiers or purchase tokens, plan, expiry, verification timestamps and access status to verify and restore membership. We do not receive your payment-card details. These server-only records remain until account deletion, when our deletion service removes them. Store providers retain their own transaction records under their policies. Deleting your Cartwoven account does not cancel a store subscription; cancel through your store settings to stop renewal. See membership information.

Website access and cloud retention

The web app uses your existing Cartwoven login and mobile membership; it does not sell subscriptions or collect card details. Firebase verifies membership and the server enforces access to cloud collections. Website sign-in is stored for the browser session; sign out on shared computers. Cloud collections remain until removed through the app’s deletion workflow or account deletion. Signing out or uninstalling alone does not erase cloud data. Account deletion removes your personal cloud records and membership records. Owner access is an administrator-managed account grant.

Your choices

You can revoke camera, microphone and speech permissions in device settings, edit or remove saved content, export your groceries, and request account deletion. Requests about access, correction or deletion of information can be sent to the contact below. We may need to verify account ownership without asking for your password.

Service providers and policy changes

We use Google Firebase to provide authentication, optional collection synchronization, membership verification and account deletion. See Firebase privacy information. Retailers, external websites, speech services and backup destinations handle information under their own policies. These pages do not use advertising or analytics scripts; the hosting service receives normal web request information. We update this page when our practices change and show the effective date above.

Questions or deletion requests

Review account deletion or contact Salas Software at david@salassoftware.com. Do not send passwords or verification codes.