Privacy Policy
Effective: October 26, 2026
Aeyo is a grocery and routine-item tracker for iPhone. This policy explains exactly what data the app uses, where it goes, and what it does not collect. Privacy disclosures should be short and honest, so this one is.
Aeyo runs on your device. Your personal data lives on your iPhone and, if you turn on iCloud, in your own private iCloud account. There is no Aeyo account to create and no Aeyo server in the middle of your everyday use.
There are two exceptions. Both are opt-in, both are off until you turn them on, and both have their own section below.
Sharing a cart with other people. Real-time collaboration needs a shared place for everyone's changes to meet, so that feature uses an Aeyo-operated server.
Splitting a line you type into its parts. Usually Aeyo does this on your device. For a line it cannot make sense of there, it can ask an LLM instead, and that is the one time the words you typed leave your iPhone.
If you use neither, no data about your lists ever leaves your device except the anonymous community signals described further down.
What stays on your device
Aeyo keeps your grocery lists, routine items, notes, carts, the stores you shop at, your purchase history, learned aisle order (Smart Sort), and the insight scores generated from your history — in its local database on your iPhone. Unless you share a cart, none of this passes through any Aeyo server.
iCloud sync
If you have iCloud enabled, your data is backed up and synced across your own devices through Apple's private CloudKit database — the same system used by Apple Notes and iCloud Drive. This sync is entirely between you and Apple. Aeyo has no access to your private iCloud data. It cannot read it, modify it, or delete it. Only your Apple ID can.
Sharing a cart
Sharing a cart lets you and other people — your household, family, or friends — see and update the same list in real time. Because everyone's changes have to meet somewhere, sharing uses an Aeyo-operated server (self-hosted by Aeyo, not a third party). Data travels over encrypted connections (HTTPS and WSS).
If you never share a cart, none of this applies to you, and nothing about your lists leaves your device for it.
When you do share a cart, the following is stored on the Aeyo server and is visible to the members of that cart:
| What is stored | What it is for |
|---|---|
| The shared cart and its items — names, quantities, check-off state, notes, any specification you add, urgency, and the timing facts needed to stay in sync (how often a shared item is needed, and whether someone paused it — a pause Aeyo works out on its own stays on that phone) | So every member sees the same up-to-date list |
| The cart's own name and color, as the person who created it set them | So an invitation shows the cart it opens, on the link preview and the join screen |
| A display name and color you choose for the cart, plus an anonymous identifier assigned by Apple (your iCloud record ID — not your Apple ID, name, or email) | So changes can be attributed to "who did what" |
| A random per-device identifier (not your Apple ID, name, or hardware, and not tied to your identity) | To settle which change wins when two devices edit the same item at the same moment |
| A limited, recent history of when shared items were checked off, tied to an item's catalog identity — or, for items not in the catalog, a random per-cart item identifier (never your typed text) — kept per shared cart | To estimate how often a shared item tends to be needed |
| The category and store labels the sharer has set on a shared item (name, icon, and color) | So a joined cart arrives organized — used once to fill in labels a member hasn't set, never overwriting anyone's own organization |
| The shop of a shared item's latest purchase, as the brand name the buyer's phone supplied (for example, "Costco") — no location, no store record, and no check-in | So each member's purchase history can name the shop the buyer's phone recorded |
| Whether your account is on the free or premium plan (only the cart owner's plan is visible to other members) | So a shared cart applies the right member limit |
Passed on, not stored: when you check off a shared item, your phone's time zone at that moment (as an offset from UTC, for example UTC−7) travels with the check-off to the other members, so their purchase history dates it on your calendar day. Aeyo's server passes it along without storing it; each member's phone keeps it with its record of your purchase, in that member's own iCloud. It narrows where you were to a band of time zones, nothing finer.
When you first share a cart, a limited amount of your prior check-off history for those items is included, so the shared cadence starts from reality rather than from zero.
What stays on your device, even for a shared cart: your brand choices, everything about your non-shared items, and every prediction or insight Aeyo makes. Those are recomputed privately on each member's device and are never sent.
Who can see it: the members of that shared cart. On its way to Aeyo's server it also passes, readable, through Cloudflare's network — see Connection logs. Who controls the server: Aeyo. How long it is kept: until the cart's last member leaves it, which removes its data from the server. Deleting a shared cart is leaving it, so its other members keep it.
You don't have to take our word for it. The code for that server is public, under the Apache 2.0 licence: github.com/Dongli99/aeyo-cart-relay. You can read exactly what it stores, what it doesn't, and how long it keeps things — the page above describes the same server from the outside.
To be precise about what that does and doesn't prove: it is the source the running server is built from, published in good faith. It is not cryptographic proof of what is deployed, and anyone telling you a public repository proves that is overstating it. It also isn't the rest of Aeyo — the predictions and learning run on your phone and aren't published — and it isn't where the anonymous community signals below are handled, which is Apple's iCloud rather than that server.
Community signals (anonymous, pooled across users)
Aeyo improves category suggestions and store aisle layouts using anonymous signals pooled from all users. These are never tied to your identity and no one can see your individual contribution. The main signals are:
Category, item, and store votes — sent when you assign or confirm a category or store for an item, set how often you need it, or add a custom category or brand. These build a statistical picture of what an item is, where it's sold, and how often it's typically needed — never tied to you or your history.
Store pins — when you add a store by picking the shop itself out of the place search, its map location and brand name are contributed so the shared catalog can locate that shop for other shoppers. A place you set by hand — a pin you drop on the map, or a spot the map does not know as that business — stays on your device and is never contributed. This is the store's own public location — not a reading of your device's GPS, and it does not reveal where you are.
Purchase ticks — sent once per item per shopping session when you check it off. A tick records which store you're in, the item's category and aisle position, and whether it was out of stock — with a coarse ~5 km tile of your location, a day-only date, and a random per-session id. It carries no identity and no time of day, and ticks are never chained across sessions. In short: no who, no exact when — the where is the store, not you.
| What is sent | What is never sent |
|---|---|
| A normalized item name (e.g. "whole milk") | Your identity or Apple ID |
| The category, brand, and cadence you set | Your device ID |
| Which store you're in, and its aisle position (purchase ticks) | Your exact location or device GPS reading |
| Whether an item was out of stock | The time of day (dates are day-only) |
| A coarse ~5 km tile of your location | Your purchase history across sessions |
| A store's own public coordinates (only when you add a store) |
No user or device identifier is attached to any signal. Your location is reduced to a coarse tile (~5 km × 5 km) before leaving your device — the one exception is a store's own coordinates, a public place you pick when adding a store, which locate the shop, not you. Signals are surfaced only after being pooled with a minimum number of independent contributions from the same area, so no single person's choices are visible. Aggregation runs every 12 hours; raw signals are deleted immediately after, leaving only the pooled statistics. Community signals go to Apple's public CloudKit database and are aggregated on users' own devices — they do not pass through the Aeyo server used for cart sharing.
Splitting a line you type (opt-in, one line at a time)
When you finish typing an item, Aeyo can offer to split it into parts — a name, a size, a note, a quantity. The splitting is done by an LLM — a large language model — and this section is about that. What happens on your iPhone is the decision of whether to ask at all: a line Aeyo already recognizes, or one with nothing to pull apart, is never sent.
Nothing is sent until you say yes. The first time it could help, Aeyo asks — on that line, in the item form or when you review what you've typed, with the choice in front of you. Until you allow it, nothing is sent and no server is contacted. If you decline, you are not asked again.
What is sent is the one line you just typed. Not your list, not your cart, not your purchase history, not your name — there is no Aeyo account for it to be attached to. It goes to a server Aeyo operates, which passes it to the LLM and returns the answer.
Why it goes through Aeyo's server rather than straight to the model. If your iPhone contacted the model directly, the model's operator would see your device on every request. Going through Aeyo means the model's operator receives every line from Aeyo's server, from one address shared by everyone using the feature, so nothing the model receives ties a line to a device, or one line to the next.
On the way to Aeyo's server, the line is sealed. Your iPhone encrypts it so that only Aeyo's server can open it, and the sign that your device may use the feature travels inside the same seal. That matters because the website and its servers are reached through Cloudflare's network, which handles the connection before it reaches Aeyo. What that network sees is that a sealed request arrived, its size and its time — not the line in it.
Which model, today, is Cloudflare Workers AI. The provider can change. Nothing else in this section changes with it — every protection described here is a property of how Aeyo is built, not of who runs the model. Cloudflare states that it does not use what is sent to train models, and that it keeps neither the line nor the answer once the answer has been returned. It does keep records of each request with no text in them, such as when it arrived and how large it was, and it may keep content where its legal obligations require it. Because Cloudflare also runs the network described above, it sees both halves while a request is handled: your device's address and when a sealed request arrived, and the line and when it reached the model. Matching the two by time would be possible if Cloudflare chose to. Aeyo cannot prevent that.
Aeyo does not store the line. No part of the app or the server writes it down. What the server keeps for your device is a small record with no text in it: how many lines this device has sent, the key that proves it is a real copy of Aeyo (described next), and a few dates, none more precise than the hour. The count is what stops the feature being abused. A record that goes unused for 14 days is deleted.
Your device proves it is a real iPhone — after you allow the feature, not before. So the count means something, your device asks Apple to certify that it is a genuine, unmodified copy of Aeyo, and shows that certificate to Aeyo's server. It carries no account and nothing that identifies you, and it is not the identifier shared carts use. Because this happens only after you allow the feature, an install that never uses it never contacts this server at all.
Photographing a list does not go here. Reading a paper list with the camera is a separate feature that runs on your device. Allowing Aeyo to split a typed line allows that and nothing else, and there is no way today to send a photographed list to a model.
Turning it off: Settings → Mind → Line splitting, at any time, in either direction.
Connection logs
aeyo.app, and the servers behind it for sharing a cart and splitting a line, are reached through Cloudflare's network. Cloudflare handles each connection before it reaches Aeyo, so it sees the address your device connects from and when. A line you split is sealed before it leaves your iPhone, so Cloudflare sees a sealed request's size and time, not the line in it. A shared cart is not sealed: its contents are readable on Cloudflare's network as they pass through. How long Cloudflare keeps what it sees is set by Cloudflare, not by Aeyo.
Aeyo's own server keeps a log of requests to the website and to shared carts: the connecting IP address, the time, what was requested, the page that linked to it, and the browser or app version. That log is kept for about two weeks, and the server's daily disk backups hold a copy for three days more. Requests to split a line are not in it: the server does not log them, and the IP address is removed before the request reaches the service.
What Aeyo does not collect
Names, email addresses, phone numbers, or any contact information. Photos or camera data. Health data of any kind. Your precise location — your device's GPS is used in memory only for detecting nearby stores, and is never stored or uploaded. (Adding a store contributes that store's own public coordinates, so the catalog can find it — the store's location, not yours.) Behavioral analytics, session recordings, or ad tracking. Crash reports via third-party SDKs. There are no third-party analytics, advertising, or tracking libraries in Aeyo.
A note about item names
Aeyo's community signals include normalized item names. Please avoid putting personal information — real names, health conditions, addresses, or any sensitive details — in the names of items, carts, or stores. Those fields may contribute to community signals, even though they are anonymized.
Your data, your control
Local data: You can erase everything Aeyo has stored on your device — your lists, carts, stores, purchase history, the patterns it has learned, and the device-local identifiers used for cart sharing — from within the app. Deleting the Aeyo app removes this data too.
iCloud data: Because your iCloud data belongs to your Apple ID, you can delete it through your iPhone's iCloud settings or by deleting the app.
Shared carts: Leaving a shared cart, or deleting it, stops further changes from syncing to your device, and its other members keep it. When the cart's last member leaves, its data — the shared items, the membership, and the check-off history above — is removed from the Aeyo server.
Line splitting: Turning it off in Settings → Mind stops anything further being sent. Aeyo's server keeps a small record for your device with no text in it — a count, the key that proves it is a real copy of Aeyo, and dates to the hour — and deletes it once it has gone unused for 14 days. There is no text to retrieve or erase, because the lines themselves were never stored anywhere.
Community signals: Once a signal has been anonymized, pooled, and aggregated, it cannot be individually identified or deleted — there is nothing left to identify. Raw signals are purged every 12 hours as part of aggregation.
Aeyo does not sell your data — to anyone, ever.
Children
Aeyo is not directed at children under 13 and does not knowingly collect data from them.
Changes to this policy
If a material change is made to how data is handled, the effective date above is updated and the change noted. June 22, 2026: added the Sharing a cart section to disclose the opt-in shared-cart feature, which stores shared cart data on an Aeyo-operated server for the members of a shared cart. Personal (non-shared) use remains free of any Aeyo server. June 30, 2026: clarified the Community signals section — a purchase tick includes the store you're in, the item's category, and an out-of-stock flag; adding a store contributes that store's own public coordinates and brand (a map-picked location, not your device's GPS); and the cadence you set is an anonymous frequency vote. The "precise location" statement was scoped to your own location. No change to what Aeyo collects — only to how completely it is described. July 6, 2026: disclosed that the shared-cart server also stores a random per-device identifier, used only to break simultaneous-edit ties — not your Apple ID, name, or hardware, not tied to your identity, and never used for personal (non-shared) carts. July 19, 2026: shared items now carry the sharer's category and store labels (name, icon, and color), so a joined cart arrives organized — used once to fill in labels a member hasn't set, never overwriting anyone's own organization. Check-off history for items not in the catalog is keyed by a random per-cart identifier instead of a catalog identity. The "what stays on your device" list was updated to match. August 27, 2026: added the Splitting a line you type section. Aeyo can now offer to split a typed item line into its parts by asking an LLM, which sends that one line to an Aeyo-operated server and on to the model's operator (today, Cloudflare Workers AI). It is off until you allow it, the permission covers line splitting and nothing else, the line is never stored, and photographing a list is unaffected and still runs entirely on your device. September 11, 2026: the Sharing a cart table now lists the shop of a shared item's latest purchase, as the brand name the buyer's phone supplied — no location, no store record, and no check-in. Aeyo has carried it since early September 2026; this update describes it. September 11, 2026: Disclosure-accuracy update to the Sharing a cart section, from a full audit of every column the shared-cart server stores: a shared item also carries any specification you add; the cart's own name and color are stored so an invitation can show what it opens; and each member's free-or-premium plan is stored so the cart can apply the right member limit. All three have been stored since the shared-cart feature shipped; the table now says so. No change to what Aeyo collects — only to how completely it is described. September 11, 2026: Aeyo now sends less: a member's free-or-premium plan is shared with the other members of a cart only for the cart's owner, whose plan is what decides whether the cart can take more members. Every other member's plan is still stored, and is no longer sent to anyone. Nothing about what is kept has changed. September 30, 2026: Splitting a line you type: the line is now sealed on your iPhone so that only Aeyo's server can open it, and the network that carries the website and its servers (Cloudflare) sees only a sealed request's size and time. Aeyo now also offers splitting when you review what you've typed, not only in the item form. Corrected the opening and the Sharing a cart heading, which still called sharing the only feature that uses an Aeyo-operated server — untrue since line splitting was added on August 27, 2026. October 4, 2026: Added Connection logs. The website and Aeyo's servers are reached through Cloudflare, which sees connecting IP addresses, and Aeyo's own server logs, IP addresses included, are kept about two weeks, plus three days in backups. Until now these logs were kept for about two months and this policy did not mention them. The Sharing a cart section said only members could see a cart; a cart also passes readable through Cloudflare, and now says so. October 4, 2026: Splitting a line you type: corrected what Aeyo's server keeps for your device. It was described as only a count; it also holds the key that proves your copy of Aeyo is genuine, and dates to the hour. That record is now deleted after 14 days unused. Added that Cloudflare runs both the model and the network in front of Aeyo's server, so it could match a line to a device by time. Before September 30, the server also wrote an entry to its system log for each line you sent, carrying a code for your device and the exact time — more than this policy said it kept. Those entries were deleted on October 1, and the last backup holding them expired on October 4. Until September 30, a line you split crossed Cloudflare's network unsealed: it was readable there, beside your device's address and a code for your device. October 11, 2026: Sharing a cart update: a check-off on a shared item now carries your phone's time zone at that moment (an offset from UTC) to the other members, so their purchase history dates the purchase on your calendar day. Aeyo's server passes it along without storing it; each member's phone keeps it with its record of your purchase, in that member's own iCloud. It narrows where you were to a band of time zones, nothing finer. October 21, 2026: Splitting a line you type: Cloudflare now states, in its Workers AI data-usage terms of October 16, 2026, that it keeps neither the line nor the answer once the answer has been returned. This section said Cloudflare did not state how long it held them. It now also says what Cloudflare does keep: records of each request with no text in them, and content where its legal obligations require it. October 26, 2026: Disclosure-accuracy update to the Sharing a cart section: a shared cart's data is removed from Aeyo's server when its last member leaves, not when its owner deletes it. Deleting a shared cart is leaving it, and its other members keep it. This section said the owner's delete removed the data, which was true only when the owner was the last member. No change to what Aeyo collects or keeps — only to how accurately it is described.