What Baggo does with your groceries.

If you never sign in

Baggo is fully usable with no account. Your lists, items, categories, units, store layouts and photos are stored on the device and are never transmitted. There is no analytics SDK, no advertising, no crash-reporting service and no third-party tracker in the app.

If you do sign in

Signing in with Google lets your lists follow you to another device. From then on your lists, items, categories, units and store layouts are synced to Baggo's server so they can be pulled back down elsewhere. Your name and profile photo come from your Google account, and you can replace or remove both from the account screen.

Some things are deliberately kept off the wire even when you are signed in: archived lists, reminders, your recently-used items and the local copy of item photos are device-only and are never uploaded.

Photos

A photo you attach to an item lives on your device. It is uploaded only when you share that item with somebody, and then only that person is granted permission to read it. Replacing a photo uploads a new file and deletes the old one, so a photo you replaced is not quietly still readable by whoever you shared the previous one with. Recalling a share revokes the access it granted.

Sharing with other people

Sharing is always something you start. Sending an item to someone copies its name, unit, note and photo into an inbox they have to accept before anything appears in their app. Sharing a list invites a person by email; they see the list only once they accept, and only ever that list.

People you have shared with can see the name and photo on your account, because that is what makes "collected by" mean anything. Someone who is merely on the same shared list as you, without being your friend, cannot read your profile; the app falls back to the email address it already has.

You can block anyone. A blocked person's shares and invitations go nowhere, and they are not told that this is why.

Signing out

Logging out erases the local store on that device. This is deliberate: the next account to sign in on the same phone must not be able to read or upload the previous one's groceries. Anything that had not yet synced is gone with it, which is why the app warns you before it happens.

Deleting your data

Deleting a list or an item removes it, and the deletion travels to your other devices. To remove everything held for your account, write to the address below and it will be deleted from the server.

Children

Baggo is a shopping list. It is not directed at children and collects nothing about anyone's age.

Changes

If this note changes in a way that affects what is collected or who can see it, the change will be described here rather than folded silently into a new date.

Getting in touch

Questions, deletion requests, or a correction to anything above: hello@baggo.uk.