Privacy Policy
Effective: July 6, 2026
Aeyo is a grocery and routine-item tracker for iPhone. This policy explains exactly what data the app uses, where it goes, and what it does not collect. Privacy disclosures should be short and honest, so this one is.
Aeyo runs on your device. Your personal data lives on your iPhone and, if you turn on iCloud, in your own private iCloud account. There is no Aeyo account to create and no Aeyo server in the middle of your everyday use.
There is one exception, and it is opt-in: sharing a cart with other people. Real-time collaboration needs a shared place for everyone's changes to meet, so that one feature — and only that feature — uses an Aeyo-operated server. It is described in its own section below. If you never share a cart, no data about your lists ever leaves your device except the anonymous community signals described further down.
What stays on your device
Aeyo keeps your grocery lists, routine items, notes, carts, the stores you shop at, your purchase history, learned aisle order (Smart Sort), and the insight scores generated from your history — in its local database on your iPhone. Unless you share a cart, none of this passes through any Aeyo server.
iCloud sync
If you have iCloud enabled, your data is backed up and synced across your own devices through Apple's private CloudKit database — the same system used by Apple Notes and iCloud Drive. This sync is entirely between you and Apple. Aeyo has no access to your private iCloud data. It cannot read it, modify it, or delete it. Only your Apple ID can.
Sharing a cart (the one feature that uses an Aeyo server)
Sharing a cart lets you and other people — your household, family, or friends — see and update the same list in real time. Because everyone's changes have to meet somewhere, this is the one part of Aeyo that uses an Aeyo-operated server (self-hosted by Aeyo, not a third party). Data travels over encrypted connections (HTTPS and WSS).
If you never share a cart, none of this applies to you, and nothing about your lists leaves your device for it.
When you do share a cart, the following is stored on the Aeyo server and is visible to the members of that cart:
| What is stored | What it is for |
|---|---|
| The shared cart and its items — names, quantities, check-off state, notes, urgency, and the timing facts needed to stay in sync (how often a shared item is needed, whether it's paused) | So every member sees the same up-to-date list |
| A display name and color you choose for the cart, plus an anonymous identifier assigned by Apple (your iCloud record ID — not your Apple ID, name, or email) | So changes can be attributed to "who did what" |
| A random per-device identifier (not your Apple ID, name, or hardware, and not tied to your identity) | To settle which change wins when two devices edit the same item at the same moment |
| A limited, recent history of when shared items were checked off, tied to an item's catalog identity (not your typed text), kept per shared cart | To estimate how often a shared item tends to be needed |
When you first share a cart, a limited amount of your prior check-off history for those items is included, so the shared cadence starts from reality rather than from zero.
What stays on your device, even for a shared cart: your store preferences, brand choices, item categories, and every prediction or insight Aeyo makes. Those are recomputed privately on each member's device and are never sent.
Who can see it: only the members of that shared cart. Who controls the server: Aeyo. How long it is kept: until the cart's owner deletes the cart, which removes its data from the server.
Community signals (anonymous, pooled across users)
Aeyo improves category suggestions and store aisle layouts using anonymous signals pooled from all users. These are never tied to your identity and no one can see your individual contribution. The main signals are:
Category, item, and store votes — sent when you assign or confirm a category or store for an item, set how often you need it, or add a custom category or brand. These build a statistical picture of what an item is, where it's sold, and how often it's typically needed — never tied to you or your history.
Store pins — when you add a store, its map location (which you pick from a map or a place search) and brand name are contributed so the shared catalog can locate that shop for other shoppers. This is the store's own public location — not a reading of your device's GPS, and it does not reveal where you are.
Purchase ticks — sent once per item per shopping session when you check it off. A tick records which store you're in, the item's category and aisle position, and whether it was out of stock — with a coarse ~5 km tile of your location, a day-only date, and a random per-session id. It carries no identity and no time of day, and ticks are never chained across sessions. In short: no who, no exact when — the where is the store, not you.
| What is sent | What is never sent |
|---|---|
| A normalized item name (e.g. "whole milk") | Your identity or Apple ID |
| The category, brand, and cadence you set | Your device ID |
| Which store you're in, and its aisle position (purchase ticks) | Your exact location or device GPS reading |
| Whether an item was out of stock | The time of day (dates are day-only) |
| A coarse ~5 km tile of your location | Your purchase history across sessions |
| A store's own public coordinates (only when you add a store) |
No user or device identifier is attached to any signal. Your location is reduced to a coarse tile (~5 km × 5 km) before leaving your device — the one exception is a store's own coordinates, a public place you pick when adding a store, which locate the shop, not you. Signals are surfaced only after being pooled with a minimum number of independent contributions from the same area, so no single person's choices are visible. Aggregation runs every 12 hours; raw signals are deleted immediately after, leaving only the pooled statistics. Community signals go to Apple's public CloudKit database and are aggregated on users' own devices — they do not pass through the Aeyo server used for cart sharing.
What Aeyo does not collect
Names, email addresses, phone numbers, or any contact information. Photos or camera data. Health data of any kind. Your precise location — your device's GPS is used in memory only for detecting nearby stores, and is never stored or uploaded. (Adding a store contributes that store's own public coordinates, so the catalog can find it — the store's location, not yours.) Behavioral analytics, session recordings, or ad tracking. Crash reports via third-party SDKs. There are no third-party analytics, advertising, or tracking libraries in Aeyo.
A note about item names
Aeyo's community signals include normalized item names. Please avoid putting personal information — real names, health conditions, addresses, or any sensitive details — in the names of items, carts, or stores. Those fields may contribute to community signals, even though they are anonymized.
Your data, your control
Local data: You can erase everything Aeyo has stored on your device — your lists, carts, stores, purchase history, the patterns it has learned, and the device-local identifiers used for cart sharing — from within the app. Deleting the Aeyo app removes this data too.
iCloud data: Because your iCloud data belongs to your Apple ID, you can delete it through your iPhone's iCloud settings or by deleting the app.
Shared carts: Leaving a shared cart stops further changes from syncing to your device. When the cart's owner deletes the cart, its data — the shared items, the membership, and the check-off history above — is removed from the Aeyo server.
Community signals: Once a signal has been anonymized, pooled, and aggregated, it cannot be individually identified or deleted — there is nothing left to identify. Raw signals are purged every 12 hours as part of aggregation.
Aeyo does not sell your data — to anyone, ever.
Children
Aeyo is not directed at children under 13 and does not knowingly collect data from them.
Changes to this policy
If a material change is made to how data is handled, the effective date above is updated and the change noted. June 22, 2026: added the Sharing a cart section to disclose the opt-in shared-cart feature, which stores shared cart data on an Aeyo-operated server for the members of a shared cart. Personal (non-shared) use remains free of any Aeyo server. June 30, 2026: clarified the Community signals section — a purchase tick includes the store you're in, the item's category, and an out-of-stock flag; adding a store contributes that store's own public coordinates and brand (a map-picked location, not your device's GPS); and the cadence you set is an anonymous frequency vote. The "precise location" statement was scoped to your own location. No change to what Aeyo collects — only to how completely it is described. July 6, 2026: disclosed that the shared-cart server also stores a random per-device identifier, used only to break simultaneous-edit ties — not your Apple ID, name, or hardware, not tied to your identity, and never used for personal (non-shared) carts.