Privacy policy

Information the service handles

• Account information. Your sign-in provider supplies an account identifier, email address, and sign-in details. Google may also supply a display name and profile image to our authentication provider. ChatGPT may supply your name, which can be used to name your household. We use identity information to recognize your account and manage access; we do not receive your Google or ChatGPT password.
• Information you enter. Your nickname, the sender name you choose for each invitation, household and list names, item names, quantities, notes, and whether items are checked or deleted.
• Sharing and synchronization records. Household and list memberships, invitation records, account connections, record identifiers, and timestamps needed to apply changes and control access.
• Technical information and hosting statistics. Our hosting, security, and sign-in providers may process IP addresses, browser or device information, request times, and diagnostic or security logs to deliver and protect the service. ChatGPT Sites also automatically records traffic statistics, including page views and unique-visitor counts over time, which are available to the site owner. These statistics help show site usage; CheckedOff does not use them for advertising or marketing profiles. The app also records errors needed to investigate service problems.
• Support requests. If you contact the operator, the information you choose to provide is used to respond and address your request.

CheckedOff does not request access to your email inbox, contacts, calendar, photos, or precise location. The CheckedOff app does not collect card numbers. Please avoid putting passwords, financial details, medical information, or other sensitive information in shopping lists.

Optional tips on Ko-fi

The support link opens our Ko-fi page. Your lists and sign-in details are not included in the link. If you choose to tip, Ko-fi and its payment providers, such as Stripe, process your payment under their own privacy policies.

The operator may receive your name, email address, tip message, transaction details, and limited billing information through those services to manage tips, respond to payment questions, and keep necessary financial records. Read Ko-fi’s privacy policy and Stripe’s privacy policy before paying.

To provide Supporter benefits, CheckedOff receives payment notifications from Ko-fi and checks their authenticity. The notification can contain a donor email, payment reference, amount, currency, payment type, and other Ko-fi payment details. We retain only a keyed hash of the normalized email, hashed payment and notification references, the recording source and timestamps, and the CheckedOff account that claims the donation. We do not store the full notification, donation message, amount, or payment-card details in the app’s donation table.

We match donations only to the server-verified sign-in email. A payment can be associated with one CheckedOff account. The operator can record a verified earlier donation using its payment reference and the donor’s verified sign-in email. Household members can see that their household has unlimited lists; we do not show them the donor’s payment details.

How we use information

We use this information to authenticate you, connect your sign-in methods when you ask, save and synchronize lists, recognize Supporter donations and apply tier limits, apply your sharing choices, prevent unauthorized access, troubleshoot problems, and respond to support or privacy requests. We do not use your Google account information or shopping lists for advertising, data resale, or training our own AI models.

Google sign-in requests basic identity, email, and profile information for authentication. Our use of information received from Google is limited to the purposes described here and must comply with the Google API Services User Data Policy, including any applicable Limited Use requirements.

Who can receive information

• People with access to your lists. Household members can see and edit that household’s lists. A list-only invitation grants either read-only or read and write access to that list, as chosen by the sender, without access to other household lists. The recipient sees the sender name chosen for that invitation. When you accept a list-only invitation, your nickname and sign-in email are visible to the household so its members can manage access.
• Service providers. CheckedOff uses ChatGPT Sites/OpenAI and Cloudflare for hosting and storage, Supabase for Google authentication, and Google or ChatGPT for the sign-in method you choose. They process information needed to provide their services and may keep operational or security logs under their own policies. Infrastructure may process information outside your country.
• Operational access. The operator and authorized service providers can access stored information when needed to operate the app, investigate security or service problems, handle a request you make, or comply with applicable law. Lists are protected by access controls, but are not end-to-end encrypted.

If you choose to connect an AI assistant to CheckedOff, its authorized tools can read accessible list names and contents and add ingredients after your confirmation. A browser assistant can also use your signed-in app session. Information the assistant receives is subject to its own policies. CheckedOff does not automatically send your lists to an AI service for analysis. Disconnecting an assistant stops that connection; it does not erase information already kept in the assistant conversation.

A recipe import link contains recipe text in its fragment (the part after #). Anyone with that link can read the ingredients; the link can remain in AI conversations, messages, or browser history. It contains no account credentials or list access. CheckedOff removes the fragment from the address bar when opening the review, and sends the ingredients to the app server only after you confirm. A connected assistant can send an ingredient batch directly through its authorized tools. Import receipts and request identifiers are retained to prevent repeated requests from adding duplicate ingredients.

Sharing an invitation is your choice. CheckedOff opens your device’s sharing tools or lets you copy a link; it does not upload your address book. Other people may keep copies of information already shared with them.

Cookies and storage on your device

Sign-in and security cookies keep your session working. Local browser storage remembers appearance preferences and holds cached lists, account-specific offline copies, and edits waiting to sync. A service worker saves the app’s files so it can open offline. These features support the app; they are not advertising cookies.

Recipe review uses tab storage to carry a recipe through sign-in, and account-specific device storage for the current draft, submitted request, and receipt. An interrupted import stays available for an explicit retry. These records remain until replaced, cleared in the import screen, or removed with the browser’s site data; signing out does not erase them.

Signing out does not necessarily erase offline copies kept for account recovery on that device. To remove them, clear the app’s site data (the address where your lists open) in your browser. Sync any changes you want to keep first: clearing site data can permanently lose edits that have not reached the server. Protect access to your device, especially if other people use it.

Retention, deletion, and your choices

We retain account, membership, and list records to keep the service working across devices. Checked items stop appearing in the list after approximately 24 hours. That is a display cleanup, not a promise that their stored contents have been permanently erased.

Donation matching and claim records are kept to maintain Supporter access and prevent the same payment being claimed repeatedly. They can be included in a verified account-data deletion request; deleting these records may end the associated benefits. Ko-fi and payment providers retain their own payment records under their policies and legal obligations.

Deleting an item or list marks it as deleted so other devices can synchronize the change. Stored contents and synchronization records can remain. This version does not automatically permanently purge shopping records on a fixed timetable.

You can edit your lists and delete items or lists where you have permission. The household owner can remove a household member from Household members. This also removes their list-only grants in that household and cancels unused sharing links. Household members can cancel unused list invitations and remove list-only guests. Removing access prevents further authorized server access; it cannot erase copies already saved on an offline device. Edits rejected after removal remain on that device for review.

To request a copy of your account information or permanent account-data deletion, use the contact instructions below. We may need to verify that you control the account. Shared content may need to remain available to other authorized members; we will explain any information retained for their use, security, or applicable legal obligations. Provider backups and logs may remain until their retention periods expire. There is currently no self-service account-deletion button.

You can revoke CheckedOff’s Google authorization in your Google Account’s connections settings. Revoking access, signing out, or removing the home-screen icon does not by itself delete information already stored by CheckedOff.

Security and younger users

We use encrypted connections and server-side access checks to protect shared lists. No online service or device storage can be guaranteed completely secure.

CheckedOff is a general-purpose service and is not directed to children under 13. We do not knowingly permit accounts for children under 13. If you believe such an account is in use, contact the operator so it can be reviewed and its personal information removed as appropriate.

Changes to this policy

We will update this page and its effective date if our practices change. We will give notice of material changes and obtain consent where required before using information for a new purpose.

Contact and privacy requests

For help, privacy questions, or requests to access or delete your account information, email dmcleod@checkedoff.space. Include the email you use to sign in and what you need help with. Never send your password, sign-in codes, or invitation links.