1. Who we are
HomStock ("the App") is developed and operated by Jorge Mendoza, a sole proprietor based in Illinois, USA, acting as the data controller for the personal data described in this policy.
For privacy-related questions, requests, or complaints, contact: jomen12@icloud.com.
2. The short version
HomStock stores your household data in Google Firebase. It is shared only with members of your household and the limited service providers listed below. We do not sell or rent your data, we don't run ads, and we don't track you across other apps or websites.
3. What data we collect
| Category | What it includes |
|---|---|
| Account | Display name and email address from Sign in with Apple; a Firebase user identifier (UID) |
| Household | Household name, invite code, member list, your role (owner / member) |
| Receipts | Photos you scan, extracted item names + prices, store name and address, totals, and the date |
| Shopping list | Items you add, quantities, categories, notes, who added each item, who checked it off, and any "for [name]" attribution |
| Product catalog | Product display names and image URLs created when receipts are scanned |
| Meal plans | Weekly meal plans you create, the meals on each day, ingredients, notes, and cooked/not-cooked status. Shared with members of your household. |
| Dietary preferences (if you choose to set them) | Self-declared dietary toggles (vegetarian, vegan, pescatarian, gluten-free, dairy-free, nut-free, halal, kosher). Used only to personalize meal suggestions. See §4 below for the special-category basis. |
| Notification preferences | A per-user toggle controlling whether the optional "Weekly meal review" notification is sent on Saturday evenings. |
| Device registration | A push-notification token per signed-in device, used to deliver shopping-list and meal-review notifications |
| Subscription | Whether you have HomStock Pro, the product identifier, transaction ID, purchase date, and expiration date |
| App preferences | Appearance mode, theme choice, and which sections of the UI are collapsed — stored locally on your device |
4. Why we collect it, and our legal basis (GDPR Articles 6 and 9)
| Purpose | Legal basis |
|---|---|
| Provide the core features — accounts, households, receipts, shopping lists, meal plans, push notifications, subscription entitlement | Article 6(1)(b) — performance of the contract between you and HomStock |
| Personalize meal suggestions based on your dietary preferences (only if you choose to set them) | Article 9(2)(a) — explicit consent, captured at the moment you save preferences on the Dietary screen. Religious indicators (halal, kosher) and health-related indicators (gluten-free, dairy-free, nut-free) are treated as "special category" data under Article 9 and processed only on this explicit-consent basis. |
| Send the optional Saturday-evening "Weekly meal review" reminder | Article 6(1)(b) — it is a reminder of your own scheduled data. It is only sent if you explicitly enable it on the in-app disclosure sheet or in Settings → Notifications, and only for weeks where you have at least one planned meal. |
| Maintain the integrity of the service — clean up stale push tokens, enforce abuse-prevention rate limits on receipt scanning and meal-suggestion / auto-plan AI calls | Article 6(1)(f) — our legitimate interests in keeping the service working |
| Comply with App Store, tax, and other legal obligations | Article 6(1)(c) — legal obligation |
You can withdraw consent for dietary-preference processing at any time by clearing the toggles on the Dietary screen, or by emailing us. Withdrawing consent has no effect on processing carried out before the withdrawal and does not affect any other features.
We do not currently process any other data on the basis of consent — no analytics, no marketing, no ad tracking. If that ever changes, we will request your explicit, opt-in consent.
5. Service providers ("sub-processors")
The following third parties process limited personal data on our behalf under a written data-processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase (Auth, Firestore, Storage, Cloud Functions, Cloud Messaging, Remote Config, App Check) | Backend hosting, authentication, push delivery, scheduled background jobs | USA (us-central1 region) |
| Google Gemini (via Firebase Cloud Functions) | Parsing the text extracted from receipt photos into structured items and prices; generating meal suggestions and weekly meal plans from your pantry and dietary preferences | USA |
| Pexels | Anonymous stock-image lookup by meal name to illustrate suggestions — no user identifiers sent | USA |
| Apple Inc. | Sign in with Apple, App Store payment processing, APNs push delivery | USA / EU data centers |
| RevenueCat, Inc. | Subscription entitlement verification and ledger (receives a pseudonymous Firebase UID and Apple transaction metadata only) | USA |
| Open Food Facts | Anonymous product-image lookup by product name — no user identifiers sent | EU (France) |
We do not share your data with advertisers or data brokers.
6. International data transfers
Your data is stored on servers in the United States (Google Cloud, us-central1). Where these transfers fall under the GDPR or UK GDPR, they are covered by the Standard Contractual Clauses (SCCs) incorporated into the Firebase Data Processing and Security Terms and Google's broader Cloud Data Processing Addendum, and supplemented by Google's technical and organizational safeguards described in those documents.
7. How long we keep your data
- Account, household, receipts, shopping items, products: retained for as long as your account exists.
- Meal plans: retained for as long as your account / household exists. Shared with members of your household.
- Dietary preferences: retained until you clear them on the Dietary screen, or until you delete your account.
- Notification preferences: retained until you toggle the setting off, or until you delete your account.
- Push notification tokens: automatically removed when a device no longer accepts deliveries.
- App preferences: stored on your device and removed when you delete the App.
- Subscription transaction records: retained for as long as required to provide service and meet legal/accounting obligations.
- Backups: deleted data may persist in Google Cloud's encrypted backups for up to 180 days before being purged, as described in Google's Data Processing and Security Terms.
8. What happens when you delete your account
You can delete your account at any time from Account → Delete Account in the App. When you do:
- Your user profile, Firebase Auth record, dietary preferences, notification preferences, and subscription ledger entries are permanently deleted.
- If you are the sole member of a household, the entire household is deleted: its receipts, shopping list, product catalog, meal plans, recurring schedules, and invite code are removed.
- If you are a member of a household that still has other members, you are removed from the member list. Receipts you scanned, shopping items you added, meal plans you contributed to, and products you created remain visible to the remaining household members, because that content is also their household record. The App tells you this before you confirm deletion.
- If you are the household owner and other members remain, ownership transfers to the longest-tenured remaining member.
To revoke Sign in with Apple after deletion, go to iOS Settings → your Apple ID → Sign-In & Security → Sign in with Apple → HomStock → Stop Using Apple ID.
9. Your rights under GDPR and UK GDPR
If you are in the European Economic Area, the UK, or Switzerland, you have the following rights regarding your personal data:
- Access (Article 15) — get a copy of the personal data we hold about you.
- Rectification (Article 16) — correct inaccurate or incomplete data. Most data can be edited directly in the App.
- Erasure (Article 17) — delete your account using Account → Delete Account, or email us.
- Portability (Article 20) — download a machine-readable copy of your data using Account → Privacy & data → Export My Data in the App. The export includes meal plans (last 90 days), dietary preferences, and notification preferences, in addition to the categories described in §3.
- Restriction (Article 18) — ask us to pause processing of certain data while a dispute is resolved.
- Objection (Article 21) — object to processing we carry out under "legitimate interests".
- Withdraw consent — for dietary preferences, clear the toggles on the Dietary screen at any time. For notifications, toggle off in Settings → Notifications → Weekly meal review.
- Lodge a complaint with your local supervisory authority. A list of EU/EEA authorities is available at edpb.europa.eu/about-edpb/about-edpb/members. For the UK, the ICO is at ico.org.uk.
To exercise any of these rights, email jomen12@icloud.com. We will respond within 30 days as required by Article 12.
10. Security
Data is encrypted in transit (TLS) and at rest by Google Cloud. Access is gated by Firebase Authentication and Firestore security rules so only authenticated members of your household can read your data. Dietary preferences and notification preferences are stored under a separate per-user private path that is readable and writable only by you (not by other household members). App Check is enabled to protect Cloud Functions against abuse. We do not have direct access to your receipt photos, shopping lists, meal plans, or dietary preferences; we only see them in aggregate when troubleshooting at your request.
If we ever discover a personal-data breach that is likely to result in risk to you, we will notify the relevant supervisory authority within 72 hours and contact you directly when required.
11. Children
HomStock is not directed to, and we do not knowingly collect personal data from, anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date above. Material changes will also be announced in the App.
13. Contact
Jorge Mendoza (sole proprietor) — jomen12@icloud.com
For requests under the EU Digital Services Act or to identify our published trader contact information, see the HomStock listing on the EU App Store.