Privacy notice

Information we collect and why

• Account details: username, email, password hash and salt, account dates and sign-in sessions. We use these to create and secure your account, identify your saved data, provide recovery when available and prevent abuse. Passwords are stored as salted hashes, not readable passwords.
• Planning information you enter: meals, recipes, shopping lists, household size, favorites, cooking notes, pantry and leftover records, price entries, budgets, preferences and shopping area. We use it to save your work, personalize planning and provide requested features.
• Optional dietary information: allergies, foods to avoid, nutrition goals and any dietary or clinician notes you choose to save. These can reveal health information. They are optional; avoid entering medical records or information about other people without permission. Filters do not diagnose conditions or verify safety.
• Location: an address, city or ZIP you enter, or device coordinates after you select “Use my location” and grant browser permission. We use this for store discovery. Your entered shopping area is saved with your preferences. The app does not request continuous background location tracking.
• Shared household information: household name, membership and the shopping-list content you choose to share. Invited members can see shared list content. Personal recipes, dietary notes and private kitchen records are not automatically included in the shared household list.
• Billing information: account identifiers, email, Stripe customer and subscription identifiers, plan, payment/subscription status and renewal dates. This connects your purchase to your app account. Payment details are entered with Stripe/Link; Crazy Cart does not store full card numbers or card security codes.
• Technical and support information: hosting and security logs may include IP address, browser/device information, request times, paths and errors. We use this for operation, security and troubleshooting. When you send support email, we receive the message and contact information you provide.

If you use ChatGPT account access, the hosting platform supplies a Site-specific user identifier and email and may supply a display name. We use verified identity for the account access you request.

Providers and sharing

We use providers to host the app, store data, secure accounts and deliver requested features. Information may be processed in the United States or other countries where these providers operate.

• OpenAI Sites and Cloudflare: app hosting, database infrastructure, platform identity and technical/security processing.
• OpenStreetMap services: an entered address is sent to Nominatim for location lookup; a rounded search area and expanded radius are sent to the Overpass service operated by Private.coffee to find mapped stores. Your exact search point is used by Crazy Cart to filter the returned stores. Choosing a city or ZIP lets you avoid sending your full street address. When a Geoapify connection is enabled, it handles the same location and store requests instead. The store search identifies its source. These providers apply their own policies.
• Stripe and Link: checkout, recurring payments, fraud prevention, transaction support and subscription management. We send your account email and identifiers needed to connect a purchase. They collect payment and transaction information directly under their policies.
• Email services: support correspondence is handled by our email provider. If recovery-email delivery is enabled, our recovery provider processes the address and recovery message needed to send it.
• Household members: shared list information is disclosed to members you invite or join. They may retain copies of information they have already seen.

We may disclose information when required by law, to protect users and the service, or as part of a business transfer with applicable privacy protections and notices. We do not sell personal information or share it for cross-context behavioral advertising in the current app. The current app does not include an advertising or marketing-tracking SDK. We will update this notice and obtain any required consent before introducing materially different uses.

Opening a map, retailer, recipe-source or other external link gives that provider its own interaction with you. Review its policy: OpenStreetMap Foundation, Private.coffee Overpass, Stripe, Link, OpenAI and Cloudflare.

Cookies, local copies and retention

Crazy Cart uses essential session cookies to keep you signed in. Sessions are configured to expire after 30 days unless revoked sooner. An additional partitioned cookie supports sign-in when the app is embedded. These are not advertising cookies.

Public map lookup results may be cached for 15 minutes and geocoded locations for 24 hours using hashed search keys without account identifiers; expired cache entries are removed in bounded cleanup batches during later searches. The app saves an account-specific offline backup in browser local storage and caches app resources for loading and offline use. Signing out does not automatically erase those local backups. On a shared device, sign out and clear this site’s browser data when you no longer need it; clearing data may remove unsynced changes. Downloaded or printed copies remain under your control.

Account and planning records are retained while needed to provide your account and requested features, until removed or a verified deletion request is processed. Security, support and transaction records may be retained longer where reasonably necessary for fraud prevention, disputes, legal obligations or recordkeeping. Retention depends on the record and provider; copies in backups and provider systems may not disappear immediately.

We use access controls, HTTPS and hashed passwords. No service can guarantee absolute security or uninterrupted availability. Do not put passwords, payment credentials or unnecessary sensitive information in meal notes or support messages.

Your choices and privacy requests

You can edit or remove planning content in the app, change your password, leave a shared household, decline or revoke browser location permission, and use a city or ZIP instead. Browser settings control cookies and local storage; blocking them can prevent sign-in or syncing.

To delete your account, open Account → Delete account or follow the account deletion instructions. This removes your personal records and owned household lists, revokes sessions and clears this device’s account backup. Other devices and downloaded copies may retain data until cleared. Stripe transaction records may be retained under its policies. For access, correction, export, help with account deletion or a privacy question, email operations@lukaitech.com from your account email and identify Crazy Cart and the request. Do not send your password or payment-card details. We may ask for reasonable verification before disclosing or deleting account data. We respond within applicable legal time limits; exceptions and eligibility depend on your location and the law that applies.

Where applicable, you may have rights to know, access, correct or delete information; opt out of sale or advertising sharing; limit certain sensitive-information uses; or appeal a decision. We do not discriminate for exercising applicable privacy rights. We do not currently conduct sale or advertising sharing, including when a Global Privacy Control signal is present. The app does not otherwise change its essential processing in response to “Do Not Track” signals.

Removing the app or clearing browser data does not cancel a paid subscription. Manage cancellation through Link. In-app account deletion explicitly cancels Crazy Cart Stripe subscriptions before removal. Include any subscription concerns with a deletion request sent to support so we can coordinate them. Stripe/Link handles its own transaction and account privacy requests.

Children

Crazy Cart accounts are intended for adults planning household meals. The app is not directed to children under 13, and we do not knowingly collect personal information directly from them. Adults should not enter children’s full names, contact details or medical records. If you believe a child has provided personal information, contact us so we can investigate and address it.

Changes to this notice

We will update the effective date when this notice changes and provide additional notice or request consent when required for material changes. A revised notice does not retroactively authorize a new use that requires your consent.