Privacy Policy

1. Who We Are

Ghostflation is operated by Emoria Inc., a company registered in Calgary, Alberta, Canada. Our app helps Canadians and Americans track grocery prices and personal inflation rates.

2. Information We Collect

Account and profile data

Account credentials: Email address and password (hashed). Collected to create and secure your account. Linked to your identity.

Profile information: Country, optional display name, and optional postal code, city, and province/state. Collected to personalize deals and inflation statistics to your region. Linked to your identity.

Receipt and price data

Receipt images: Photos of receipts you upload are processed via OCR and AI to extract store names, item names, prices, quantities, and dates. Receipt images are temporarily stored for processing and then deleted (typically within 24 hours). Used to calculate your personal inflation rate. Linked to your identity.

Price and item data: Item names, prices, quantities, unit sizes, and store information extracted from your receipts. Used to track price changes, detect shrinkflation, and generate community-level statistics. Linked to your identity.

Favorites and purchase history

Favorites: Items you mark as favorites are stored so you can quickly monitor prices on products you care about. Linked to your identity.

Purchase history: A record of your scanned purchases is maintained to calculate inflation trends over time. Linked to your identity.

Location data

Approximate location: We collect your postal code, city, and province/state (provided during signup or in your profile). Cloudflare also provides a country-level geo-IP indicator (cf-ipcountry) on each request. We do not collect precise GPS coordinates. This data is used to show relevant local deals and regional inflation comparisons. Linked to your identity.

Community and deal activity

Deal confirmations: When you confirm or report a deal in the community deals section, that activity is recorded and associated with your account. Used to improve deal accuracy for all users. Linked to your identity.

Referral data

Referrals: If you refer another user or are referred, we store the referral relationship (referrer and referred user IDs) to credit referral rewards. Linked to your identity.

Payment data

Subscription payments: Web payments are processed by Stripe; in-app purchases are processed by RevenueCat (which integrates with Apple and Google payment systems). We do not store your credit card or payment method details directly. Stripe and RevenueCat provide us with subscription status, plan type, and transaction identifiers. Linked to your identity.

Analytics and usage data

PostHog analytics: We use PostHog to collect analytics data including page views, page leave events, autocaptured interactions (clicks, form submissions), session duration, referrer URL, browser type, operating system, and device type. For logged-in users, analytics events are associated with your user profile. For anonymous visitors, a random identifier is used. Used to improve the service, fix bugs, and understand feature usage. May be linked to your identity for logged-in users. Used for analytics purposes; not used for third-party tracking.

Advertising data

Google AdSense: For visitors on public pages and free-tier users, we load Google AdSense, which sets advertising cookies and may collect behavioral data such as browsing activity, ad interaction data, device identifiers, and IP address. Google uses this information to serve personalized ads and measure ad performance. Pro and Family subscribers do not see ads and the AdSense script is not loaded for them. May be linked to your identity. Used for third-party advertising.

Push notification data

Push subscriptions: If you opt in to push notifications, we store your push subscription endpoint URL and encryption keys (provided by your browser via the Web Push API). This data is used solely to deliver price alerts and other notifications you have enabled. Linked to your identity. You can unsubscribe at any time from Settings.

3. How We Use Your Data

We use your data to:

• Calculate your personal inflation rate
• Track price changes on items you buy
• Detect shrinkflation (product size decreases)
• Show you the best grocery deals near you based on your location
• Generate your monthly Ghost Report email
• Send price alert notifications via email and push
• Manage your favorites list and purchase history
• Credit referral rewards
• Display ads to free-tier users and public visitors
• Analyze usage patterns to improve features and fix bugs
• Improve deal accuracy through community confirmations

4. Data Sharing and Third-Party Services

We do not sell your personal data. We share data with the following third-party service providers, each for a specific purpose:

• Supabase -- Database hosting and authentication. Stores your account data, price data, and app records.
• Google Cloud Vision -- Receipt OCR processing. Receipt images are sent to Google for text extraction.
• Anthropic (Claude) -- AI receipt parsing. Extracted receipt text is sent to Anthropic to structure item names, prices, and quantities.
• Stripe -- Web payment processing. Handles subscription billing; receives your email and payment method details.
• RevenueCat -- In-app purchase management. Manages subscription status for mobile app purchases via Apple and Google.
• Cloudflare -- DNS, CDN, DDoS protection, and asset storage. Proxies all traffic and provides the country-level geo-IP header (cf-ipcountry).
• Fly.io -- App hosting. Our application server runs on Fly.io infrastructure in Toronto, Canada (yyz region).
• PostHog -- Product analytics. Receives page view events, interaction data, session information, and device/browser details.
• Google AdSense -- Advertising. Loads for public pages and free-tier users. Google may set cookies and collect browsing and device data to serve personalized ads.
• Resend -- Email delivery. Sends transactional emails on our behalf including welcome emails, monthly Ghost Reports, price alerts, and verification emails. Receives your email address and email content.

Aggregated, anonymized price data may be used to generate community-level inflation statistics that are visible to other users. These statistics do not identify individual users.

5. Data Retention

We retain your data for as long as your account is active. Receipt images are deleted after processing (typically within 24 hours). Push notification subscription data is deleted when you unsubscribe. Analytics data in PostHog is retained according to PostHog's default retention policies. If you delete your account, we will delete all your personal data within 30 days, including your price history, favorites, referral records, and profile information.

6. Your Rights

You have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Export your data in a portable format
• Withdraw consent at any time (including push notification and analytics consent)
• Opt out of personalized advertising (via your browser or device ad settings)

To exercise these rights, email us at [email protected].

7. Security

We use industry-standard security measures including HTTPS/TLS encryption, hashed passwords, row-level security policies in our database, and Cloudflare bot protection and DDoS mitigation. However, no system is 100% secure.

8. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential cookies: Required for authentication and session management. Cannot be disabled.
• Analytics cookies: PostHog sets cookies and uses local storage to track page views, interactions, and session data for product analytics.
• Advertising cookies: Google AdSense sets cookies to serve personalized ads and measure ad performance. These cookies are only loaded for public page visitors and free-tier users. Pro and Family subscribers are not served ads and these cookies are not set for them.

You can control cookie preferences through your browser settings. Disabling non-essential cookies may affect analytics accuracy but will not affect core app functionality.

9. Apple App Privacy Details

The following table summarizes the data Ghostflation collects, as required by Apple's App Store guidelines. For each data type, we indicate the purpose, whether it is linked to your identity, and whether it is used for tracking (sharing with third parties for advertising or data-broker purposes).

10. Children

Ghostflation is not intended for children under 13. We do not knowingly collect data from children.

11. Changes

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy questions, data requests, or to exercise any of your rights listed above, contact us at [email protected].

Emoria Inc., Calgary, Alberta, Canada