Privacy Policy

This Privacy Policy explains how Lumon LLC (“Lumon LLC,” “we,” “us,” or “our”), the operator of ChompIt, collects, uses, and shares personal data when you use the ChompIt app, the chompit.app website, and related services (the “Service”).

ChompIt is a shopping list with a memory. You keep a list, can share one with your household, and can choose to connect a store account or scan receipts so ChompIt remembers what you buy. We do not sell your personal data, we do not show ads, and we do not track you across other companies’ apps or websites.

• Account information. Your email address, and your name if you provide it or if you sign in with Apple or Google. With Sign in with Apple, you can choose to hide your email address.
• Phone number. Used to verify your phone with an SMS code, for account security.
• Your personal list. Items on your personal shopping list are stored on your device.
• Household list and members. If you create or join a household, the shared household list, member names or usernames, and household invitations are stored on our servers and are visible to the members of that household.
• Household shopping trips. When you tap Start shopping in a household, we notify the other members so they can add anything they need. If you allow location access (“While Using the App”), your phone turns its position into a place name on the device, such as “Kroger · Nolensville Pike.” Only that label is sent to your household, only while the trip is active, and it is cleared when the trip ends. We do not use background location and we do not store your coordinates.
• Store purchase history (only if you connect a store). When you connect a retailer account such as Target, Walmart, Kroger, or Amazon, you sign in on the retailer’s own website inside the app. ChompIt never sees or stores your retailer password. After you sign in, ChompIt reads the order or purchase history page that you can see, including item names, product codes such as UPCs, quantities, prices, purchase dates, order totals and order references, and product image links, and saves it to your ChompIt account.
• Retailer sign-in cookies (stored on your device). So that you stay connected, the retailer’s sign-in (session) cookies are saved on your device, for your ChompIt account only. They are kept for up to 30 days and are removed when you sign out of ChompIt or disconnect that store. While you use the app, ChompIt checks each connected store for new purchases about once a day.
• Receipt photos (only if you scan a receipt). When you photograph a receipt, the photo is uploaded to ChompIt’s private storage and sent to our text-reading providers, Google (Gemini) and Amazon Web Services (Textract), to read the store, date, items, and prices. The extracted details are added to your purchase history. The receipt photo is stored privately with your account until you delete your account or ask us to delete it.
• List photos. When you import a list from a photo, the text is read on your device.
• Bank transactions (optional). Only if you choose to connect a bank account: the connection is made through Stripe Financial Connections, and we receive the merchant names, dates, and amounts of your transactions. We never receive your bank login credentials. Connecting a bank is never required.
• Usage and diagnostics. Which screens and features you use, linked to your account ID (not your email address), and crash and error reports, which may include a masked replay of the screen around an error. We also collect basic technical data such as device type, operating system, app version, IP address, and a push-notification token.

• to provide the Service: keep your lists, sync your household list, show your usuals and purchase history, and power home-screen widgets;
• to run household shopping trips, including notifying members and showing the store label you choose to share;
• to read purchases from stores you connect and receipts you scan, at your direction;
• to send notifications you have allowed, such as household list updates and “need anything?” trip alerts;
• to secure accounts, prevent abuse, and comply with legal obligations;
• to respond to support requests; and
• to understand how the app is used, fix crashes, and improve the Service.

We do not use your data for advertising.

We do not sell your personal data or share it for cross-context behavioral advertising. We share it only as follows:

• Your household. Members of a household you create or join can see the shared household list and, during a trip you start, the store label described above.
• Service providers that process data on our behalf under confidentiality obligations:
  • Supabase — hosting, database, authentication, and file storage;
  • Google — Gemini text reading for receipt photos, and Google Sign-In if you use it;
  • Amazon Web Services — Textract text reading for receipt photos;
  • Apple — Sign in with Apple if you use it, and push notifications on iOS;
  • Twilio — SMS verification codes;
  • Expo — push notification delivery and app updates;
  • PostHog — product usage analytics, keyed by account ID;
  • Sentry — crash and error diagnostics, including masked error replays;
  • Stripe — Financial Connections, only if you choose to connect a bank account.
• Retailers you connect. When you connect a store, you sign in directly with that retailer, which handles your sign-in under its own privacy policy. We do not send your ChompIt data to retailers.
• Legal and safety. Where required by law, to enforce our terms, or to protect the rights, safety, and security of users and the Service.
• Business transfers. If Lumon LLC is involved in a merger, acquisition, or sale of assets, personal data may be transferred subject to this Policy.

We keep your account data, household data, purchase history, and receipt photos while your account is active, until you delete them or delete your account. Retailer sign-in cookies stay on your device for up to 30 days and are removed when you disconnect the store or sign out. A household trip’s store label is cleared when the trip ends. We may keep limited records longer where the law requires it or to prevent abuse.

We use administrative, technical, and physical safeguards designed to protect personal data, and data is encrypted in transit. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please keep your account and device secure.

• Connections are optional. You can disconnect any store at any time in Connections, and delete the purchases imported from it.
• Location is optional. It is used only during a household trip you start. You can turn it off in your device settings; trips still work without a store label.
• Notifications are optional and can be turned off in your device settings.
• See, export, or delete your data in the app under Profile → Privacy & data. You can delete your account there, or follow the steps at chompit.app/delete-account.

Depending on where you live, you may also have the right to access, correct, delete, or obtain a copy of your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at support@chompit.app. We will respond consistent with applicable law.

If you are a California resident, you have the right to know what personal information we collect, to request deletion or correction, and to not be discriminated against for exercising your rights. We do not sell or “share” personal information for cross-context behavioral advertising. To make a request, contact us at support@chompit.app.

The Service is not directed to children. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a minor has provided us personal data, contact us and we will take appropriate steps to delete it.

The Service is operated from the United States and is intended for US users. If you access it from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your jurisdiction.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Service or by other reasonable means and update the “Last updated” date above.

Questions about this Policy or your personal data? Contact us at support@chompit.app.

Lumon LLC, United States