Your recipes belong to you.

Developer and privacy contact

CART918 is developed and operated by Joshua Gaynor. Questions, privacy requests, and data-deletion requests may be sent to Cart918Service@gmail.com.

Accounts and saved app information

A CART918 account is required to enter the main app. CART918 stores your email address, hashed password, account and session records, and security timestamps needed to sign you in and protect the service. CART918 does not store plain-text passwords and never asks for grocery-store passwords or payment details.

Your account may synchronize recipes, four-week plans, ingredient selections, grocery and Buy Again lists, checked states, chosen store, preferences, and approved recipe photographs across your signed-in devices. Some information may also be kept in browser or app storage so CART918 can work reliably between synchronizations. Account identity—not the device alone—controls the synchronized library. Do not place passwords, payment-card numbers, medical records, or other sensitive personal information in recipe or grocery fields.

Voice input (microphone)

Voice input is optional. When you use Speak or dictation on recipe title, ingredients, or directions in the Android app, CART918 uses the device microphone through Android’s speech-recognition service to turn your speech into text.

CART918 keeps only the text that you accept into those recipe fields. CART918 does not record, upload, or store audio of your voice. Speech processing is handled by the device or Android speech services under their own terms; CART918 receives text results, not a voice file.

Assisted shopping sessions

When you use Shopping Assistant (assisted shopping) in the Android app, CART918 may:

• open an in-app browser session for a grocery store website you choose,
• use item names or search terms from your CART918 grocery list to help find products, and
• remember which list items you mark as added during that session so your grocery list can update when you return.

CART918 does not collect or store grocery-store passwords, payment-card numbers, bank details, or checkout information. The store’s own website and privacy policy apply while you browse or check out there. Session details used to update your list, such as which items you marked added, stay tied to your CART918 grocery list or account sync like other list state.

Optional anonymous feature analytics

CART918 asks before sending anonymous product analytics. If you choose Allow anonymous analytics, CART918 creates a random browser ID and may record app opens, pages used, feature actions, selected store names, download types, referral website domain, campaign labels in the link, and timestamps. This helps measure which features are useful and where visitors found CART918.

Analytics do not include recipe text, ingredient or grocery-list contents, names, email addresses, passwords, payment details, store credentials, or checkout details. CART918 does not place your IP address in its analytics tables. Hosting, security, and abuse-prevention systems may temporarily process IP addresses, request headers, device or browser information, and request times in ordinary service logs. Anonymous event records may be retained for up to 24 months. Choosing No thanks keeps optional analytics off; you can reset the choice by clearing CART918’s browser site data.

Optional CART918 updates

The updates form is voluntary and separate from anonymous analytics. If you explicitly check the permission box and submit it, CART918 stores the email address you enter plus any optional first name, ZIP code, preferred stores, consent source, consent date, and a link to the random analytics browser ID when analytics are enabled. The private owner dashboard uses this information for audience segments and CSV export. CART918 does not currently send marketing email from the app itself or sell these contact details.

You may unsubscribe from Share & Setup → Manage or stop updates. An unsubscribed address remains on a suppression record so it is not treated as subscribed again without a new explicit signup. Contact the CART918 owner through the published app channel if you need a contact record deleted rather than unsubscribed.

Recipe photos, PDFs, and text recognition

On Android, you may choose up to three recipe images through the Android Photo Picker. CART918 corrects the images for readability and uses Google ML Kit text recognition on the device. When the first reading appears weak, CART918 may compare it with an on-device Tesseract reading. The existing CART918 parser then separates the title, ingredients, and instructions. Questionable amounts, fractions, and units are shown for review, and nothing is saved as a recipe until you accept it. Canceling the import removes the temporary selection.

Browser photo and PDF transcription also runs on the user’s device. Source files selected for transcription are not stored in CART918’s recipe database. Only recipe information that you review and save becomes part of your local library or account-synchronized state.

If you add an optional cover photo to a saved recipe, CART918 reduces it to 450 KB or less and stores it separately on that device. When you are signed in, CART918 also stores that cover photo in private managed image storage so it can appear with the same recipe on your other signed-in devices. A complete or recipes-only backup includes uploaded photos.

Recipe search and URL import

Recipe search terms are used to request results from TheMealDB. When you import a public recipe URL, CART918’s server retrieves that page to locate its recipe information. The source website may receive ordinary technical request information from CART918’s hosting provider.

Shared recipe links

A shared link stores a snapshot of only the single recipe or checked recipe collection chosen by the sender—not the planner, grocery list, Buy Again lists, or unchecked recipes. Cover photos are off by default and are uploaded to public managed image storage only when the sender explicitly chooses to include them. Anyone who receives the link can open and forward its text and any approved photos. Shared links currently do not expire automatically, so remove personal information before sharing.

Grocery Companion permissions

The optional Companion always requires access to CART918 so it can receive an approved grocery queue. Grocery-store access is optional and selected by the user. You may click stores individually, use Add all stores to request every supported store, or use Clear all to remove every store permission. Amazon and Whole Foods share one permission because Whole Foods shopping uses Amazon pages.

The Companion uses store access to display the queue and help fill or open a product search. It does not collect or store store passwords, payment-card information, order history, pickup times, or checkout details. The approved queue is stored locally in the browser extension and expires after 24 hours unless cleared sooner.

When you choose I added it — next item, the Companion keeps that item’s CART918 key, name, week, and completion time locally until CART918 confirms that it was unchecked. This lets the remaining list move to another store. Skipped items are not recorded as purchased. Unconfirmed completion records expire after 7 days.

Companion limited use

The CART918 Grocery Companion uses the approved grocery-list information and supported store-page information it receives only to provide the shopping-assistance features described here. CART918 does not sell Companion data, use it for advertising or credit decisions, or transfer it for unrelated purposes. Information is transferred only when needed to provide a user-requested feature, maintain security, comply with law, or with the user’s affirmative consent. CART918’s use and transfer of Companion user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Problem reports

If you voluntarily send a problem report, CART918 stores the category, description, current page, browser or app details, report time, and relevant Companion connection status needed to investigate it. Problem reports are not intended to include recipes, ingredients, grocery-list contents, passwords, payment information, or other sensitive information. Reports may be retained while the issue is investigated and afterward when reasonably needed for support, security, and service improvement.

Local partner-store attribution

If you open a participating local store from CART918, the app creates a random browser identifier and records the store, referral click, time, and a unique click ID. A participating retailer may later include that click ID, its own order number, order date, eligible total, refunds, and order status in a report to CART918. This allows the private owner dashboard to calculate net referred sales and any agreed commission without requiring your name.

CART918 does not need or request your store password, payment-card details, bank information, delivery address, or item-level purchase history for this reporting. The private dashboard is limited to the CART918 owner. Avoid clearing browser data between referral and checkout if you want a later store report to remain associated with the same anonymous CART918 browser ID.

Service providers and data sharing

CART918 uses OpenAI Sites and its Cloudflare infrastructure for website hosting, encrypted account synchronization, databases, and managed image storage. Google ML Kit and Tesseract provide on-device text recognition in the Android app. Android’s speech-recognition services process optional voice input on or for the device and return text to CART918. TheMealDB receives recipe-search terms. A public recipe website receives an ordinary server request when you ask CART918 to import its URL. Grocery retailers receive ordinary browser information when you choose to visit, search, or use assisted shopping on their websites. CART918 does not sell personal or sensitive user data.

CART918 uses encrypted HTTPS connections, password hashing, private owner authorization, request validation, size limits, and abuse controls. No internet service can promise absolute security.

Retention and deletion

Local copies of recipes, plans, grocery information, preferences, and recipe photographs remain on a device until they are deleted, CART918’s site or app data is cleared, or the app is uninstalled. Account-synchronized recipes, photographs, and related records remain until you delete the individual content or your account. Temporary approved Companion queues expire after 24 hours, and unconfirmed completion records expire after 7 days. Anonymous analytics may be retained for up to 24 months. Shared recipe snapshots and approved public photos do not automatically expire and remain available until removed. Contact subscription and suppression records remain until a deletion request is completed, except for limited records that must be kept for security, fraud prevention, legal compliance, or accounting.

Use Share & Setup → Delete my saved CART918 data to remove local app information from that device. Clearing browser site data also removes the local random analytics ID and consent choice. Use the updates-management form separately to unsubscribe an email address. To permanently delete your account, active sessions, synchronized library, private account photos, and saved synchronization history, use Delete your CART918 account. Account deletion deletes account-associated information rather than merely disabling access, subject only to limited security, fraud-prevention, legal, or accounting retention obligations. You may also contact Cart918Service@gmail.com for assistance. Public recipe snapshots or photos deliberately shared by link, voluntary contact records, and anonymous analytics that cannot reasonably be linked to the account are separate; request their removal in the deletion form or by email.

Children’s privacy

CART918 is a general-audience service and is not directed to children under 13. CART918 does not knowingly collect personal information from a child under 13. If you believe a child provided personal information, contact Cart918Service@gmail.com so it can be investigated and deleted where required.

Independent service

CART918 is not operated by or affiliated with Reasor’s, Sprouts, Walmart, Target, Costco, Sam’s Club, Whole Foods, ALDI, Kroger, H-E-B, Instacart, Amazon, or TheMealDB. Their own privacy policies apply when you visit or use their services.