Privacy Policy
Effective: August 27, 2026
Aeyo is a grocery and routine-item tracker for iPhone. This policy explains exactly what data the app uses, where it goes, and what it does not collect. Privacy disclosures should be short and honest, so this one is.
Aeyo runs on your device. Your personal data lives on your iPhone and, if you turn on iCloud, in your own private iCloud account. There is no Aeyo account to create and no Aeyo server in the middle of your everyday use.
There are two exceptions. Both are opt-in, both are off until you turn them on, and both have their own section below.
Sharing a cart with other people. Real-time collaboration needs a shared place for everyone's changes to meet, so that feature — and only that feature — uses an Aeyo-operated server.
Splitting a line you type into its parts. Usually Aeyo does this on your device. For a line it cannot make sense of there, it can ask an LLM instead, and that is the one time the words you typed leave your iPhone.
If you use neither, no data about your lists ever leaves your device except the anonymous community signals described further down.
What stays on your device
Aeyo keeps your grocery lists, routine items, notes, carts, the stores you shop at, your purchase history, learned aisle order (Smart Sort), and the insight scores generated from your history — in its local database on your iPhone. Unless you share a cart, none of this passes through any Aeyo server.
iCloud sync
If you have iCloud enabled, your data is backed up and synced across your own devices through Apple's private CloudKit database — the same system used by Apple Notes and iCloud Drive. This sync is entirely between you and Apple. Aeyo has no access to your private iCloud data. It cannot read it, modify it, or delete it. Only your Apple ID can.
Sharing a cart (the one feature that uses an Aeyo server)
Sharing a cart lets you and other people — your household, family, or friends — see and update the same list in real time. Because everyone's changes have to meet somewhere, this is the one part of Aeyo that uses an Aeyo-operated server (self-hosted by Aeyo, not a third party). Data travels over encrypted connections (HTTPS and WSS).
If you never share a cart, none of this applies to you, and nothing about your lists leaves your device for it.
When you do share a cart, the following is stored on the Aeyo server and is visible to the members of that cart:
| What is stored | What it is for |
|---|---|
| The shared cart and its items — names, quantities, check-off state, notes, urgency, and the timing facts needed to stay in sync (how often a shared item is needed, and whether someone paused it — a pause Aeyo works out on its own stays on that phone) | So every member sees the same up-to-date list |
| A display name and color you choose for the cart, plus an anonymous identifier assigned by Apple (your iCloud record ID — not your Apple ID, name, or email) | So changes can be attributed to "who did what" |
| A random per-device identifier (not your Apple ID, name, or hardware, and not tied to your identity) | To settle which change wins when two devices edit the same item at the same moment |
| A limited, recent history of when shared items were checked off, tied to an item's catalog identity — or, for items not in the catalog, a random per-cart item identifier (never your typed text) — kept per shared cart | To estimate how often a shared item tends to be needed |
| The category and store labels the sharer has set on a shared item (name, icon, and color) | So a joined cart arrives organized — used once to fill in labels a member hasn't set, never overwriting anyone's own organization |
When you first share a cart, a limited amount of your prior check-off history for those items is included, so the shared cadence starts from reality rather than from zero.
What stays on your device, even for a shared cart: your brand choices, everything about your non-shared items, and every prediction or insight Aeyo makes. Those are recomputed privately on each member's device and are never sent.
Who can see it: only the members of that shared cart. Who controls the server: Aeyo. How long it is kept: until the cart's owner deletes the cart, which removes its data from the server.
You don't have to take our word for it. The code for that server is public, under the Apache 2.0 licence: github.com/Dongli99/aeyo-cart-relay. You can read exactly what it stores, what it doesn't, and how long it keeps things — the page above describes the same server from the outside.
To be precise about what that does and doesn't prove: it is the source the running server is built from, published in good faith. It is not cryptographic proof of what is deployed, and anyone telling you a public repository proves that is overstating it. It also isn't the rest of Aeyo — the predictions and learning run on your phone and aren't published — and it isn't where the anonymous community signals below are handled, which is Apple's iCloud rather than that server.
Community signals (anonymous, pooled across users)
Aeyo improves category suggestions and store aisle layouts using anonymous signals pooled from all users. These are never tied to your identity and no one can see your individual contribution. The main signals are:
Category, item, and store votes — sent when you assign or confirm a category or store for an item, set how often you need it, or add a custom category or brand. These build a statistical picture of what an item is, where it's sold, and how often it's typically needed — never tied to you or your history.
Store pins — when you add a store, its map location (which you pick from a map or a place search) and brand name are contributed so the shared catalog can locate that shop for other shoppers. This is the store's own public location — not a reading of your device's GPS, and it does not reveal where you are.
Purchase ticks — sent once per item per shopping session when you check it off. A tick records which store you're in, the item's category and aisle position, and whether it was out of stock — with a coarse ~5 km tile of your location, a day-only date, and a random per-session id. It carries no identity and no time of day, and ticks are never chained across sessions. In short: no who, no exact when — the where is the store, not you.
| What is sent | What is never sent |
|---|---|
| A normalized item name (e.g. "whole milk") | Your identity or Apple ID |
| The category, brand, and cadence you set | Your device ID |
| Which store you're in, and its aisle position (purchase ticks) | Your exact location or device GPS reading |
| Whether an item was out of stock | The time of day (dates are day-only) |
| A coarse ~5 km tile of your location | Your purchase history across sessions |
| A store's own public coordinates (only when you add a store) |
No user or device identifier is attached to any signal. Your location is reduced to a coarse tile (~5 km × 5 km) before leaving your device — the one exception is a store's own coordinates, a public place you pick when adding a store, which locate the shop, not you. Signals are surfaced only after being pooled with a minimum number of independent contributions from the same area, so no single person's choices are visible. Aggregation runs every 12 hours; raw signals are deleted immediately after, leaving only the pooled statistics. Community signals go to Apple's public CloudKit database and are aggregated on users' own devices — they do not pass through the Aeyo server used for cart sharing.
Splitting a line you type (opt-in, one line at a time)
When you finish typing an item, Aeyo can offer to split it into parts — a name, a size, a note, a quantity. The splitting is done by an LLM — a large language model — and this section is about that. What happens on your iPhone is the decision of whether to ask at all: a line Aeyo already recognizes, or one with nothing to pull apart, is never sent.
Nothing is sent until you say yes. The first time it could help, Aeyo asks — in the item form, on that line, with the choice in front of you. Until you allow it, nothing is sent and no server is contacted. If you decline, you are not asked again.
What is sent is the one line you just typed. Not your list, not your cart, not your purchase history, not your name — there is no Aeyo account for it to be attached to. It goes to a server Aeyo operates, which passes it to the LLM and returns the answer.
Why it goes through Aeyo's server rather than straight to the model. If your iPhone contacted the model directly, the model's operator would see your device on every request. Going through Aeyo means every request arrives from one address shared by everyone using the feature, so nothing ties a line to a device, or one line to the next.
Which model, today, is Cloudflare Workers AI. The provider can change. Nothing else in this section changes with it — every protection described here is a property of how Aeyo is built, not of who runs the model. Cloudflare states that it does not use what is sent to train models, and does not state how long it holds it.
Aeyo does not store the line. No part of the app or the server writes it down. What the server keeps is a count — how many lines this device has sent — and nothing else. The count is what stops the feature being abused, and it holds no text.
Your device proves it is a real iPhone — after you allow the feature, not before. So the count means something, your device asks Apple to certify that it is a genuine, unmodified copy of Aeyo, and shows that certificate to Aeyo's server. It carries no account and nothing that identifies you, and it is not the identifier shared carts use. Because this happens only after you allow the feature, an install that never uses it never contacts this server at all.
Photographing a list does not go here. Reading a paper list with the camera is a separate feature that runs on your device. Allowing Aeyo to split a typed line allows that and nothing else, and there is no way today to send a photographed list to a model.
Turning it off: Settings → Mind → Line splitting, at any time, in either direction.
What Aeyo does not collect
Names, email addresses, phone numbers, or any contact information. Photos or camera data. Health data of any kind. Your precise location — your device's GPS is used in memory only for detecting nearby stores, and is never stored or uploaded. (Adding a store contributes that store's own public coordinates, so the catalog can find it — the store's location, not yours.) Behavioral analytics, session recordings, or ad tracking. Crash reports via third-party SDKs. There are no third-party analytics, advertising, or tracking libraries in Aeyo.
A note about item names
Aeyo's community signals include normalized item names. Please avoid putting personal information — real names, health conditions, addresses, or any sensitive details — in the names of items, carts, or stores. Those fields may contribute to community signals, even though they are anonymized.
Your data, your control
Local data: You can erase everything Aeyo has stored on your device — your lists, carts, stores, purchase history, the patterns it has learned, and the device-local identifiers used for cart sharing — from within the app. Deleting the Aeyo app removes this data too.
iCloud data: Because your iCloud data belongs to your Apple ID, you can delete it through your iPhone's iCloud settings or by deleting the app.
Shared carts: Leaving a shared cart stops further changes from syncing to your device. When the cart's owner deletes the cart, its data — the shared items, the membership, and the check-off history above — is removed from the Aeyo server.
Line splitting: Turning it off in Settings → Mind stops anything further being sent. What Aeyo's server holds for your device is a count and nothing else — there is no text in it to retrieve or erase, because the lines themselves were never stored anywhere.
Community signals: Once a signal has been anonymized, pooled, and aggregated, it cannot be individually identified or deleted — there is nothing left to identify. Raw signals are purged every 12 hours as part of aggregation.
Aeyo does not sell your data — to anyone, ever.
Children
Aeyo is not directed at children under 13 and does not knowingly collect data from them.
Changes to this policy
If a material change is made to how data is handled, the effective date above is updated and the change noted. June 22, 2026: added the Sharing a cart section to disclose the opt-in shared-cart feature, which stores shared cart data on an Aeyo-operated server for the members of a shared cart. Personal (non-shared) use remains free of any Aeyo server. June 30, 2026: clarified the Community signals section — a purchase tick includes the store you're in, the item's category, and an out-of-stock flag; adding a store contributes that store's own public coordinates and brand (a map-picked location, not your device's GPS); and the cadence you set is an anonymous frequency vote. The "precise location" statement was scoped to your own location. No change to what Aeyo collects — only to how completely it is described. July 6, 2026: disclosed that the shared-cart server also stores a random per-device identifier, used only to break simultaneous-edit ties — not your Apple ID, name, or hardware, not tied to your identity, and never used for personal (non-shared) carts. July 19, 2026: shared items now carry the sharer's category and store labels (name, icon, and color), so a joined cart arrives organized — used once to fill in labels a member hasn't set, never overwriting anyone's own organization. Check-off history for items not in the catalog is keyed by a random per-cart identifier instead of a catalog identity. The "what stays on your device" list was updated to match. August 27, 2026: added the Splitting a line you type section. Aeyo can now offer to split a typed item line into its parts by asking an LLM, which sends that one line to an Aeyo-operated server and on to the model's operator (today, Cloudflare Workers AI). It is off until you allow it, the permission covers line splitting and nothing else, the line is never stored, and photographing a list is unaffected and still runs entirely on your device.