Privacy Policy
Effective 2026-10-13. Ella's Cart (ellascart.com and the Ella's Cart iOS app) is operated by Straten Schemel, doing business as ElevityX ("we").
In short. We run a shared grocery list. We don't sell your personal information, we don't show ads, and we don't allow ad networks to track you on our site or app. We use cookies and storage needed to run the service or remember your choices, plus page analytics that use no cookies.
What we collect
- Account: name, email address, password (stored hashed by our sign-in provider).
- Your lists: items, quantities, check-offs, brand and store preferences, and how often your household buys things.
- Optional: a US ZIP code to suggest stores near you (web). If you connect an AI assistant, a secure fingerprint of its access token, never the token itself.
- Technical data: our hosting and database providers receive your IP address, browser or device type, and the addresses you request, and keep logs for security and troubleshooting.
- Usage and error data: see "Cookies and tracking".
How we use it
To run and sync your lists, keep your account secure, stop spam and bots, fix errors, and understand overall use so we can improve the service. Not for advertising.
Cookies and tracking
Each cookie and storage item we use is listed below with what it does and how long your browser keeps it. Strictly necessary items keep you signed in, protect sign-up and sign-in, and hold offline changes. Functional items remember choices like dark mode and stay in your browser. Analytics items help us understand overall use and fix errors. We don't use advertising cookies, ad pixels, or session recording. In the iOS app, your sign-in is stored in your device's secure Keychain. The app uses no advertising identifiers. You can clear cookies and site data in your browser at any time (clearing the sign-in cookie signs you out).
Strictly necessary
| Name | What it does | Provider | How long it's kept |
|---|---|---|---|
| Supabase sign-in session | Keeps you signed in. | Ella's Cart (Supabase Auth) | Up to 400 days as set by our auth library; removed when you sign out (Sign-out clears it) |
| Email sign-in verifier | Lets an email sign-in link finish signing you in. | Ella's Cart (Supabase Auth) | Up to 400 days as set; normally removed when email sign-in completes (Removed on completion; an abandoned attempt can leave an unusable cookie until it expires) |
| Supabase API | Loads, saves and live-syncs your lists. | Supabase | n/a |
| Ella's Cart API | Talks to Ella's Cart's own servers. | Ella's Cart | n/a |
| Offline change queue | Holds changes you made offline, including item text, on your device until they sync. | Ella's Cart | Until your offline changes sync (Emptied after sync) |
| Cloudflare Turnstile | Checks that sign-ups, sign-ins and account deletions come from a person. Cloudflare also uses these signals to improve its bot detection. | Cloudflare | No cookies stated by Cloudflare |
| Cloudflare Turnstile host | Checks that sign-ups, sign-ins and account deletions come from a person. Cloudflare also uses these signals to improve its bot detection. | Cloudflare | n/a |
Functional
| Name | What it does | Provider | How long it's kept |
|---|---|---|---|
| Theme preference | Remembers light, dark or system appearance. | Ella's Cart | Until you clear site data |
| Getting started dismissed | Remembers that you closed the getting-started checklist. | Ella's Cart | Until you clear site data |
| Shopping mode | Remembers whether shopping mode is on. | Ella's Cart | Until you clear site data |
| Recipe draft | Keeps a recipe you haven't saved yet on your device. | Ella's Cart | Until you save or discard the recipe |
| Previous quantity notes | Remembers an item's previous quantity after adding it again changed its unit, so the list can show "Was …" in this tab. | Ella's Cart | When you close the tab (Undo removes the note; closing the tab clears them all) |
| Pending invite link | Holds the invite link you opened while you sign in, so this tab can finish joining the shared list. | Ella's Cart | 1 hour, or when you close the tab (Removed once you join or the link turns out not to be valid) |
| Pending list join | Finishes joining a shared list you were invited to. | Ella's Cart | 1 hour (Removed once you join or the link turns out not to be valid) |
Analytics
| Name | What it does | Provider | How long it's kept |
|---|---|---|---|
| Vercel Web Analytics | Records page visits (page address, which Vercel says has query parameters filtered, plus referring site, country/region, device and browser type) for aggregate reports. | Vercel | No cookies or storage (Vercel discards the daily visitor hash after 24 hours) |
| Vercel Speed Insights | Measures page speed for aggregate reports. | Vercel | No cookies or storage |
| Sentry SDK | Sends error reports (error type, code location, browser version, no names, emails, list contents or full web addresses) so we can fix bugs. | Sentry | No cookies or storage |
| Sentry ingest | Sends error reports (error type, code location, browser version, no names, emails, list contents or full web addresses) so we can fix bugs. | Sentry | n/a |
Do Not Track and Global Privacy Control
We don't track you across other companies' websites or apps, and we don't sell or share your information for advertising, so there's no such tracking for these signals to stop. We don't currently change anything else when your browser sends Do Not Track or Global Privacy Control.
Third parties on our site and app
Other companies can't collect information about your activity on Ella's Cart to follow you across other websites or apps. These providers receive data when you use the service: Supabase: Loads, saves and live-syncs your lists. They process it for us. Vercel: Records page visits (page address, which Vercel says has query parameters filtered, plus referring site, country/region, device and browser type) for aggregate reports; Measures page speed for aggregate reports. They process it for us. Sentry: Sends error reports (error type, code location, browser version, no names, emails, list contents or full web addresses) so we can fix bugs. They process it for us. Cloudflare: Checks that sign-ups, sign-ins and account deletions come from a person. Cloudflare also uses these signals to improve its bot detection. They also use it for their own stated purpose described above. Apple distributes the iOS app and provides crash reports from TestFlight.
AI features
When you use recipe features, we send OpenAI the dish name, servings, ingredient lines and any change you type. We don't attach your name, email or account ID, but anything you type is sent, so please don't include personal details. We ask OpenAI not to store these requests for training.
Sharing
With the providers above; with people you share a list with (they see that list and your name); when the law requires it; or in a sale or merger of our business. We don't sell your personal information or share it for targeted advertising.
How long we keep it
Account and list data while your account is open. Provider logs are kept under each provider's policy.
Your choices
Edit your profile in Account settings. Connect or disconnect AI assistants. Clear site data. To delete your account, email privacy@ellascart.com from the address on your account. We'll verify your request, delete your account (including your sign-in), and confirm by email. We do not promise a fixed timeline until automated deletion is available in Account settings.
Nevada residents
We don't sell covered information as Nevada law defines it. You can still send a verified request not to sell to our designated address, privacy@ellascart.com. We'll respond within 60 days.
Children
Ella's Cart accounts are for adults (18+). Teens may use it with a parent's permission. We don't knowingly collect personal information from children under 13. If you believe a child under 13 is using Ella's Cart, email privacy@ellascart.com and we'll delete their information.
Security
Connections are encrypted, and the database limits access to your lists to you and the people you share them with.
Changes
We'll update the effective date. For material changes, we'll tell you in the app or by email before they take effect.
Contact
Questions or requests: privacy@ellascart.com. Ella's Cart is operated by Straten Schemel, doing business as ElevityX.