Privacy Policy

Effective Date: September 6, 2026 · Last Updated: September 6, 2026

This Privacy Policy explains how Sentinel Media Inc. ("we," "us," or "our"), the operator of the Shopper Sentinel mobile app and shoppersentinel.com (together, the "Service"), collects, uses, shares, and protects your information. Where we use defined terms, they have the same meaning as in our Terms of Use.

If you do not agree with this Policy, please do not use the Service.

1. Summary — The Short Version

• Shopper Sentinel is free to use. Signing in is optional for most features — scanning, browsing recipes, and checking prices all work without an account.
• If you create an account, we collect your email (via Supabase Auth), and whatever you choose to add: ZIP code, household size, diet preferences, shopping lists, receipt photos, and recipe photos.
• If you link a Kroger loyalty account, we never see or store your Kroger password — only an encrypted OAuth token that lets us clip coupons on your behalf.
• Anonymous usage analytics (what features get used) never include your email, phone, address, or ZIP code — those are structurally blocked from that data stream by the server.
• We do not sell your personal information, and we do not share your identified purchase or price data with advertisers.
• Sponsored placements are always labeled "Sponsored." No exceptions.
• Diet, allergen, and health-mode choices (for example GLP-1 or diabetic-friendly) are covered by our separate Consumer Health Data Privacy Policy.
• You can delete your account and your data at any time, in-app or by email. See Delete Account.

2. Who We Are and How to Contact Us

The Service is operated by Sentinel Media Inc., a corporation organized under the laws of Wyoming, United States.

For any privacy question, request, or complaint, email hello@shoppersentinel.com with the subject line "Privacy Request — [your topic]." We aim to respond within 30 days.

3. Information We Collect

3.1 Information you provide

• Account information: your email address, managed by Supabase Auth (we never see or store your plaintext password — Supabase handles authentication and stores only a salted hash).
• Profile preferences: ZIP code, household size, diet and allergen preferences, weekly budget, and app settings (which home-screen tiles you've turned on) — all optional, used to personalize recipes, prices, and what you see.
• Shopping lists you create in the app.
• Receipt photos you choose to scan — processed by our OCR partner (Veryfi) to extract store, items, and prices, so we can credit Sentinel Points and (if you opt in — see 3.4) contribute anonymized price data.
• Recipe photos you choose to import — sent to Anthropic's Claude (with vision) to extract a recipe from the photo.
• Manual price reports you submit (item, store, ZIP, price) as part of the community pricing database.
• Recipe ratings, reviews, and community chat messages you post — these are visible to other users of the app, not private.
• Retailer loyalty account linking (currently: Kroger). When you link an account, we receive an OAuth token from the retailer — never your retailer password — which we encrypt at rest (AES-256-GCM) and use only to clip coupons and check your clipped-coupon count on your behalf. You can unlink at any time.
• Support communications you send us.

3.2 Information collected automatically

• An anonymous install ID — a random identifier the app generates once and stores on your device. It is not a device fingerprint, IDFA, or IDFV, and it carries no personal information. A fresh install gets a fresh ID.
• Product-analytics events — which features you use (e.g., "scanned a barcode," "opened recipes"), tied to your install ID and, if signed in, your account ID. Event data is server-validated to a small, flat set of fields; certain key names — anything that looks like email, phone, address, name, zip, or geographic coordinates — are structurally dropped by the server before they ever reach storage, regardless of what the app sends. This stream is used only for our own internal product analytics (what to build next); it is never sold or shared with advertisers.
• Basic technical data: platform (iOS/Android/web) and app version, for compatibility and bug-fixing.
• Crash and error reports if crash reporting is enabled, to help us fix bugs.

3.3 Camera and photo use

• Barcode scanning: the camera reads the barcode on-device to look up a product. We do not store a photo or video of what you scanned — only the resulting barcode number and product lookup.
• Receipt scanning: the photo you take is sent to our OCR provider (Veryfi) to extract the store, items, and prices, as described in 3.1.
• Recipe photo import: a photo you choose to upload is sent to Anthropic's Claude to extract a recipe.

3.4 Crowdsourced pricing data

Manual price reports and prices we can parse from a scanned receipt may contribute to a shared, community pricing database that powers "cheapest store near you" for everyone. Public reads of this database go through a view that excludes your contributor identity — other users never see who submitted a given price. If you delete your account, your past contributions remain in the shared database (they're already de-identified for public reads) but are no longer associated with your account internally.

4. Information We Do Not Collect

• We do not request or use precise GPS location. ZIP code (which you provide) is as granular as it gets.
• We do not access your contacts, calendar, or microphone.
• We do not use advertising identifiers (IDFA/IDFV) or third-party ad-tracking SDKs.
• We do not collect government IDs, biometric data, or payment card numbers (Shopper Sentinel is currently a free service — see Section 9 for what happens if that changes).
• We never see or store your retailer (e.g., Kroger) account password.

5. How We Use Your Information

1. Run the Service — authenticate you, sync your lists and preferences, personalize recipes and prices, clip coupons to a linked loyalty account.
2. Score savings and rewards — verify receipt scans and price reports for Sentinel Points.
3. Detect shrinkflation — track package-size and price changes across products over time (this uses product data, not your personal data).
4. Improve the Service — analyze aggregated, de-identified usage to fix bugs and prioritize features.
5. Communicate with you — respond to support requests, send account-related notices.
6. Secure the Service — detect abuse of the rewards system (e.g., duplicate receipt submission), rate-limit, and prevent fraud.
7. Comply with law where applicable.

We do not sell your personal information. We do not share your identified purchase or price data with advertisers. Any sponsored product placement in the app is clearly labeled "Sponsored" and is not based on handing your personal data to the sponsor.

6. AI Disclosure

• Anthropic Claude powers recipe photo import (extracting a recipe from a photo you upload) and the "Ask Shopper Sentinel" assistant.
• Veryfi performs OCR on receipt photos you scan.
• AI systems can make mistakes — see the accuracy disclaimer in our Terms of Use.
• Your personal account data is not sent to these providers for model training; content you affirmatively submit for processing (a receipt photo, a recipe photo, a support message) is sent only for that purpose, under each provider's API terms.

7. Third-Party Service Providers (Sub-Processors)

Each is bound by its own data-protection terms. We may add or change providers; material changes will be reflected here.

8. How We Share Information

• With the sub-processors above, strictly to operate the Service.
• For legal reasons — to comply with a subpoena, court order, or lawful request, or to investigate fraud or a security incident.
• In a business transfer — if Sentinel Media Inc. is acquired or merges, your information may transfer to the successor, subject to this Policy.
• With your consent — for anything else, we'll ask first.

We do not sell or rent personal information, and we do not share it with advertisers or data brokers.

9. If We Ever Introduce Paid Features

Shopper Sentinel is currently a completely free service — we hold no billing or payment records because none exist yet. If we introduce a paid tier in the future, payment will be processed by Apple, Google, or a payment processor such as RevenueCat/Stripe directly; we will never see or store your card number, and this Policy will be updated before that happens.

10. Data Retention

• Account and profile data is retained while your account is active and deleted upon account deletion (see Delete Account) — target completion within 30 days.
• Shopping lists, receipts, saved recipes, reviews, and community messages are deleted when you delete your account.
• Linked retailer loyalty tokens are deleted when you unlink the account or delete your Shopper Sentinel account.
• Crowdsourced price contributions remain in the shared, de-identified pricing database after account deletion (they carry no personal identifier once your account is removed) — this is the shared resource the whole community benefits from.
• Analytics events tied to your account have the account link removed on deletion; the anonymous, aggregated event itself may be retained for product analytics.

11. Data Security

• TLS encryption for all data in transit.
• Retailer OAuth tokens (e.g., Kroger) encrypted at rest with AES-256-GCM — a database compromise alone is not enough to read them.
• Row-level security scoping so one user's data is not readable by another through the database layer.
• Least-privilege access controls internally.

No system is 100% secure. If we discover an incident affecting your personal information, we will notify you and any authorities as required by law.

12. Your Rights and Choices

• Access / correct — view and edit your profile in-app under Profile → Your preferences.
• Delete — delete your account in-app (Profile → Delete Account) or by emailing us. See Delete Account for full detail.
• Export — email us to request a copy of your account data.
• Unlink a loyalty account — in-app, anytime.

13. California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect and why, request deletion, correct inaccurate information, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as defined under the CPRA, and have not done so in the preceding 12 months. To exercise these rights, email hello@shoppersentinel.com with subject "California Privacy Request."

14. Users in the EEA, UK, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your local data-protection authority. We process your data on the basis of performance of a contract (running the Service you use), legitimate interests (security and improvement), and consent (where applicable). Our servers and sub-processors are located in the United States.

15. Children's Privacy

Shopper Sentinel is a general-audience app not directed at children. We do not knowingly collect personal information from children under 13. Creating an account requires you to be at least 18 (see our Terms of Use). If we learn we've collected information from a child under 13, we will delete it promptly — contact hello@shoppersentinel.com.

16. Changes to This Policy

We may update this Policy from time to time; we'll revise the "Last Updated" date above and, for material changes, notify you in-app or by email.

17. Contact

Sentinel Media Inc.
Email: hello@shoppersentinel.com

End of Privacy Policy.