Last updated: October 29, 2026
This Privacy Policy explains how CartPilot ("CartPilot", "we", "us") collects, uses, and shares information when you use the CartPilot mobile application (the "App"). CartPilot is operated by LXVIISOFTWARE PRIVATE LIMITED. By using the App, you agree to this Policy.
With your permission, the App uses your camera to scan barcodes and capture receipts and meal photos, and your photo library to upload a receipt or meal image. These images are processed to extract product, price, and nutrition information. We do not access your camera or photos for any other purpose.
If you add a ZIP code, when you set up your account or in Store Preferences, we store it to show prices near you and send it with your product searches to Serper. We do not collect GPS or precise location. You can change or clear your ZIP code in Store Preferences at any time.
We do not sell your personal information, and we do not use it for third-party advertising or cross-app tracking.
To provide the App's features, certain data is processed by the service providers below. Each receives only what is needed for its function.
| Provider | Purpose | Data shared |
|---|---|---|
| Google (Gemini AI) | Meal planning and AI answers, recipe extraction, receipt and meal photo analysis, cooking ideas from your pantry | Your AI prompts, recipe links and the text of those pages, receipt and meal photos, pantry item names. Processed under Google's Gemini API terms. |
| Groq | Receipt text parsing, search-query interpretation | Text read from your receipts, search queries |
| Serper | Product price comparison & images (Google Shopping), recipe video search | Product search terms and, if you set one, your ZIP code |
| Open Food Facts | Barcode & nutrition lookup | Scanned barcodes |
| DiceBear | Avatar images | Your chosen avatar style (images load directly from your device) |
| Supabase | Database hosting (your account & content) | All stored account and content data |
| Render | Application/server hosting | Data in transit to our backend |
| Resend | Transactional email (e.g. password reset) | Your email address |
| Expo | Push notification delivery | Push notification token, and the alert text (product, price, store) |
| Apple (Sign in with Apple) | Account sign-in, if you choose it | The name and email (or private relay email) Apple shares with us |
We share data only with service providers that use it solely to provide their service to CartPilot and that provide the same or equal protection of your data as described in this Policy.
AI features and your consent. Before an AI feature first sends your content to Google Gemini or Groq, the App asks for your permission. With it, we send only what the feature you use needs: your typed searches and AI prompts, receipt photos and their text, meal photos, recipe links and the text of those pages, and pantry item names. You can turn this off at any time with the "Allow AI features" switch in the App under Profile › Privacy Policy.
We may also disclose information if required by law or to protect our rights, users, or the public.
Your data is stored and processed on servers located in the United States. If you access the App from outside the U.S., you consent to the transfer and processing of your information in the U.S. and other countries where our providers operate.
We keep your information for as long as your account is active. If you request deletion, we delete your personal data within 30 days, except where we must retain it to comply with legal obligations. Some anonymized or aggregated data may be retained.
Depending on where you live (e.g. the EEA/UK under GDPR, California under the CCPA, or India under the Digital Personal Data Protection Act, 2023), you may have additional rights such as data portability, restriction of processing, and the right to lodge a complaint with a data protection authority. Contact us to exercise these rights.
CartPilot is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.
We protect your data with measures including encrypted connections (HTTPS), hashed passwords, and access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, provide notice within the App. Continued use after changes means you accept the updated Policy.
Questions or requests about this Policy or your data:
Email: support@lxvii.io
Governing law: India