This Privacy Policy explains how EffOne Solutions collects, uses, and protects information in the Cart Cactus mobile app.
Unofficial App Notice
Cart Cactus is an independent app and is not owned, operated, endorsed, or sponsored by Fry's Food Stores, Kroger, or their affiliates. Fry's and Kroger names are used only to identify compatible store and cart features.
Information We Collect
The app may collect or process the following information:
- List items, item notes, quantities, checked status, product identifiers, product images, aisle information, and prices.
- Preferred store information, such as store name, address, and Kroger location ID.
- ZIP code or device location, which may include precise GPS coordinates, when you choose to search for nearby stores.
- App session identifiers used to keep your device connected to your list.
- Shared list information, including list names, generated share codes, saved-list connections, and PIN verification data.
- Kroger authorization tokens if you choose to connect your Kroger account.
- Loyalty card details you choose to save in the app, such as loyalty card numbers, membership numbers, or alternate IDs. This information is used only to help you access your saved cards at checkout and is not payment information.
- Alexa linking information if you choose to connect Alexa to a shared list, including a hashed Alexa user identifier and the shared list connection.
- App preferences, such as theme choice, image display preference, and recent search/store entries.
- When advertisements are displayed, advertising-related information that the Google Mobile Ads SDK may automatically collect and share, including an IP address, device or other identifiers, app interactions, and diagnostic information, as described below.
How We Use Information
We use this information to:
- Create, sync, organize, and display your lists.
- Share, save, switch between, and sync lists between devices when you choose to use shared lists, including automatic refreshes while Live Shopping Mode is enabled.
- Support general grocery lists even when you do not connect a Kroger account or choose a Kroger-owned store.
- Search for Fry's/Kroger stores and products when you use optional Kroger features.
- Refresh aisle, price, sale, and product image information for your selected Kroger-owned store.
- Send selected grocery list items to your Kroger cart when you choose to connect your Kroger account.
- Let Alexa add items, show list items, check or uncheck items, remove items, and change item quantities on a linked shared list when you choose to link the Cart Cactus Alexa skill.
- Remember app preferences and improve app usability.
Location Information
When you voluntarily tap "Detect my location" on the Store screen and grant location permission, Cart Cactus may obtain precise GPS coordinates, depending on your device settings and available accuracy. The app securely transmits those coordinates over HTTPS through the Cart Cactus backend to Kroger's store-location API to find nearby Kroger/Fry's stores. This feature is optional: you can search by ZIP code without providing GPS location. The app does not use background location.
Cart Cactus does not intentionally store detected GPS coordinates in grocery lists or saved app preferences. This does not mean that all request information is immediately deleted. Hosting infrastructure and Kroger may process or retain request information under their applicable practices; we have not verified their retention periods for these requests. This optional device-location feature is separate from approximate location that advertising services may infer from an IP address without using the device-location permission.
Advertising and Analytics
Cart Cactus uses Google AdMob to display advertisements. The Google Mobile Ads SDK may automatically collect and share certain information with Google, including:
- IP addresses, which may be used to estimate approximate location.
- Applicable device identifiers, including the iOS advertising identifier when authorized, Android advertising IDs, and app set IDs.
- App interaction information, such as app launches, taps, and advertising interactions.
- Diagnostic information, such as launch time, performance, hang rates, and resource or energy usage.
This information may be used for advertising delivery and measurement, analytics, and fraud prevention, security, and compliance. On Android, you can reset or delete your advertising ID through your device's privacy or ads settings. These controls affect the advertising ID but do not necessarily stop the collection or use of other identifiers, IP-derived approximate location, app interactions, or diagnostic information.
On iOS, Cart Cactus uses Apple's App Tracking Transparency permission to control tracking-capable advertisements. The current iOS app requests advertisements only when tracking is authorized and Google's consent-management system permits ad requests. If tracking permission is denied, restricted, unavailable, or cannot be confirmed, the app does not request advertisements. You can change tracking permission in your iPhone's Settings.
Cart Cactus uses Google's consent-management system to provide applicable US-state privacy choices when required. When available, open Privacy Choices in the app's Settings and select Manage to review or change your advertising privacy preferences, including applicable sale or sharing opt-out choices. A US-state privacy opt-out does not necessarily stop all advertisements; ads permitted under the applicable consent signals may still be displayed, subject to the iOS tracking-permission requirement described above.
For more information, see Google's Google Mobile Ads SDK data disclosure, iOS SDK data disclosure, advertising technologies information, Privacy Policy, and Android advertising ID guidance.
Kroger Account Connection
If you connect your Kroger account, the app uses Kroger's authorization process to access supported cart features. Kroger account tokens are used only to perform actions you request, such as sending items to your Kroger cart. You can disconnect your Kroger account from within the app.
Alexa Skill Connection
If you link the Cart Cactus Alexa skill to a shared list, our server stores a hashed version of the Alexa user identifier and the shared list connection so Alexa can perform requested list actions, such as adding items, showing items on supported display devices, checking or unchecking items, removing items, and changing quantities. The raw Alexa user identifier is not stored. You can disconnect Alexa from the shared list using the Alexa skill, and you can leave or reset shared lists from within the app.
Sharing Information
We do not sell your personal information. Information may be shared with service providers only as needed to operate the app, including our app server, Kroger APIs when you use Kroger features, and Amazon Alexa services when you choose to use the Alexa skill. When you connect your Kroger account or send items to your Kroger cart, relevant product and cart information is sent to Kroger to complete that action. Google AdMob may collect and receive advertising-related information for advertising delivery and measurement, analytics, and fraud prevention, security, and compliance as described above.
Data Storage and Security
Some information is stored on your device, such as app preferences and session data. Grocery list and shared list data may be stored on EffOne Solutions servers so the app can sync your lists and shared lists across devices. We use reasonable technical measures to protect stored data, including PIN hashing for shared list PINs, hashing for Alexa user identifiers, and encrypted storage for sensitive tokens where applicable.
Data Retention and Deletion
Grocery list data is retained while your app session or shared list remains active. You can delete individual list items, clear checked items, clear the entire list, leave a shared list, disconnect your Kroger account, disconnect Alexa from a shared list, or reset the local app session from within the app. To request deletion of server-side data associated with your app session, contact us using the email below. Deleting data stored by Cart Cactus does not automatically delete information that Google independently collected or retained through its advertising services; Google's privacy controls and policies govern that information.
Children's Privacy
This app is intended for general grocery list use and is not directed to children under 13. We do not knowingly collect personal information from children under 13.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above.
Contact Us
If you have questions about this Privacy Policy or want to request data deletion, contact EffOne Solutions:
Email: support@effonesolutions.com