Got Dill? — Privacy Policy

Last updated 28 September 2026

Got Dill? is a shared grocery list for a household. This policy says what it stores, who else can see it, and what leaves your phone. There is no advertising in this app, no third-party analytics or tracking software of any kind, no advertising identifier is read, nothing follows you to other apps or websites, and nothing here is sold or shared for marketing.

What is stored

• Your account — email address and the display name you choose. Sign-in is handled by Amazon Cognito; your password is held by Cognito and is never visible to us.
• Your household — its name, its members, and the invite codes used to join it.
• Your lists — item names, notes, which shop they belong to, who added or crossed off each item, and when.
• Your shops — the store names, aisles and departments you set up, what each aisle holds (the words from a photographed sign, or whatever you type), and which items are in which aisle.
• Photos you attach to an item.
• Trip history — a record of shopping trips and what was bought, used to suggest items next time, and the order you walked a shop's aisles, used to offer a better aisle order.
• Your agreement to the Terms of Use — which version, and when.
• Suggestions and bug reports you send from Settings, with your account and the app version, so we can answer them.

This is held in Amazon Web Services in the United States (region us-east-1).

Who can see it

Everyone in your household can see, edit and delete everything in it. That is the purpose of the app — a shared list only works if it is shared. Items you add carry your name so other members can see who added what.

People outside your household cannot see any of it. Access is enforced at the server, not just hidden in the app.

We run the service and are able to read what is stored. Nobody on our side looks at a household's lists unless you ask us to help with a problem, or we suspect the Terms of Use are being broken. Both are described there.

What leaves your phone, and to whom

• Dictating a list sends that audio recording to OpenAI to be turned into text. See the OpenAI privacy policy.
• Parsing a list, working out which aisle something is in, and reading a photographed aisle sign send the text, or the photo, to Anthropic. See the Anthropic privacy policy.
• Saying which aisle you are standing in, and dictating a note on an item, are recognised entirely on your phone. That audio is never sent anywhere and works with no connection at all.
• Reading a Reminders list, if you turn it on in Settings, happens on your phone. The app reads only the list you choose, moves each item into your inbox for review, and marks it done in Reminders. Nothing is sent until you review the inbox, which parses it like any other list.

Nothing is sent to either company unless you use the feature that needs it.

Logs

Server logs record that a request happened, which household and account made it, how large it was, how long it took, and whether it failed. Since 4 September 2026 they do not record the contents of your list, your notes, your photos or your recordings. Logs written before that date could include list text; every log is deleted automatically after 90 days, so the last of those are gone by early December 2026.

How the app is used

This is off unless you turn it on. The app asks once, the first time you are in a household, and does not ask again. If you say no, nothing is recorded and nothing is queued for later — saying yes afterwards does not hand over a backlog, because there is none. You can change your mind at any time under Settings → Share usage data.

If you say yes, the app records what you do with it and sends that to our own servers, so we can tell which parts are worth keeping. This is our own recording — there is no third-party analytics product involved, and it is not used for advertising or shared with anyone.

What is recorded is the shape of what happened, never the thing itself:

• that an item was added, crossed off, restored or deleted — and whether it came from the built-in product list or you typed it
• that a shopping trip started and finished, how many items were picked up and how many were left, how long it took, and how many items were on the list and in your suggestions at the time
• which of your own shops a trip was at — as the app's internal identifier for it, not the name you gave it, so trips can be told apart without recording where you shop
• that the app asked our AI features to sort items into aisles, to read a photographed list, or to turn speech into text — and whether each succeeded, failed or found nothing
• which screens you open, and when the app loses or regains its connection

What is not in it: the names of your items, your notes, your aisle names, your household name, or anything else you typed or said. An event says "an item was added"; it does not say which one. The server discards anything that does not fit that shape, so a field cannot carry your list by accident.

To be clear about what that does and does not mean: your list, your notes and your photos are stored on our servers regardless — that is described under What is stored above, and it is how a shared list works. The limit described here is on this usage recording only, and is not a claim that we cannot see your list.

Each event carries your household and account identifiers, so this is not anonymous — we could tell it was your household. It is kept for 30 days and then deleted automatically.

The app also keeps a diagnostic log on your phone of what it did, under the same rule — no item names, no notes, no addresses. It is kept whether or not you turned the above on, because it is what makes a bug report answerable. It never leaves your phone unless you send it, from Settings → Share diagnostic log, which hands it to you to send however you like. We cannot read it otherwise.

Subscriptions

We never see your payment details. Subscriptions are bought and charged through Apple. Your card, your billing address and your Apple Account are handled entirely by Apple and are never sent to us, never shown to us, and never stored on our servers.

What Apple does tell us, and what we keep, is the minimum needed to know that your household is paid up: the identifier Apple gives the subscription, which of our two products it is, when it expires, whether it came from the real App Store or a test sandbox, and whether it has been cancelled or refunded. We keep one record per change — bought, renewed, cancelled, lapsed — so that a question about your subscription months later can be answered. That record is not readable through the app by anyone.

Apple also notifies our servers directly when a subscription renews, lapses or is refunded, so that access follows what you have actually paid for even if you never open the app. To cancel, use Settings → Apple Account → Subscriptions on your device; refunds are handled by Apple, not by us.

Deleting your data

You can delete your account from inside the app, in Settings. The account closes at once: you are signed out and it can no longer be signed in to. Thirty days later it is deleted for good, which removes your sign-in and your membership of the household. If you closed it by mistake, email us within those 30 days and we will reopen it. Items you added stay with the household, because other members may still need them — unless you were the last member, in which case the household and everything in it is deleted with you.

Children

Got Dill? is not directed at children under 13, and accounts are not knowingly created for them.

Changes

If this policy changes, the date at the top changes with it. The app is in active development and some of what is described here — particularly the AI features and how usage is recorded — may change as it settles.

Contact

Questions about any of this: support@got-dill.com.