Last updated: 15 October 2026
1. Who we are
Grofer is run by Efosa Omorogbe, a sole trader trading as EsO Designs, Hoxton, London, N1 ("we", "us"). We are the controller of your personal data under UK data protection law. Contact us at hi@efosaso.com.
Grofer is an independent app. It is not affiliated with or endorsed by any supermarket.
2. What we collect
- Your account and device. When you open Grofer we create an anonymous account for you, with no sign-up needed. We also store a random identifier for your device in your device's secure storage. We do not ask for your name or email address, and Grofer has no sign-in with Apple or Google.
- Your preferences. Dietary needs and allergies, foods you like or avoid, cuisines, kitchen appliances, how many people you cook for, your weekly budget, your goals, and your chosen supermarket. Dietary needs and allergies can relate to your health or beliefs, so we treat them as sensitive and only use them with your consent.
- Your plans and baskets. The meals you pick, their ingredients, the products matched at your supermarket, the prices at the time, and the baskets you send.
- Your subscription. Whether you have an active subscription. Payments are handled by Apple or Google. We never see your card details. We identify you to our subscription provider with a random purchaser ID, not your name or email.
- Usage information. Which screens you view and which actions you take (for example, adding a meal or opening the paywall), plus app version, device type and operating system. We use a fixed list of event types and never send free text, what you eat, your allergies, or your basket contents. We do not collect your location, and we do not store your IP address in our analytics. With your consent, we also record screen sessions to find and fix problems. Supermarket pages, text fields and images are hidden from these recordings.
- Diagnostics. Crash reports and error logs, which can include technical details such as device model and app version.
- Reminders. If you turn them on, reminders are scheduled on your device. We do not collect a push-notification token.
- Your supermarket account. When you connect a supermarket, you sign in on that supermarket's own website shown inside Grofer. We do not receive or store your supermarket password. Grofer only adds items to your basket and checks that they were added. It does not read your account details.
3. Why we use your data, and our legal basis
- Build your meal plans, price them and fill your basket. Data used: account, preferences, plans, baskets. Legal basis: contract (providing the app you asked for).
- Apply your dietary needs and allergies. Data used: the dietary and allergy answers you give. Legal basis: your explicit consent, which you can withdraw in preferences flow.
- Provide and check your subscription. Data used: subscription status, purchaser ID. Legal basis: contract.
- Measure and improve the app. Data used: usage information. Legal basis: your consent, asked on first launch and changeable in preferences flow.
- Find and fix errors, keep the service secure. Data used: diagnostics, device identifier. Legal basis: legitimate interests.
- Meet legal duties and handle claims. Data used: any of the above. Legal basis: legal obligation, legitimate interests.
We do not sell your personal data, we do not show ads, and we do not track you across other companies' apps or websites.
4. Who we share data with
We use these service providers to run Grofer. They process data only on our instructions.
- Convex: database, backend and hosting (EU).
- PostHog: product analytics (EU).
- RevenueCat: subscription management (EU).
- Sentry: crash and error reporting (EU).
- Axiom: server logs (EU).
- Apple and Google: payments and app distribution.
We gather supermarket product prices using a third-party tool; no personal data about you is sent to it. We may disclose data if the law requires it, or to a buyer if we sell the business.
5. Where your data goes
We ask our providers to store your data in the EU, which the UK treats as adequate. Some of our providers are US companies whose staff can access data from the US. Where that applies, we rely on a UK adequacy decision or the UK International Data Transfer Agreement or Addendum, so your data keeps equivalent protection.
6. How long we keep it
- Account, preferences, plans and baskets: until you delete your account, or 24 months after your account was last used.
- Subscription records: as long as needed for accounting and legal rules, up to 6 years.
- Analytics: 12 months. Error logs: 90 days.
When you delete your account we delete your preferences, plans, baskets, device records and subscription record, and ask our providers to delete the rest. Some deletions can take up to 30 days to reach backups.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or stop how we use it, or move it to another service. Where we rely on your consent, you can withdraw it at any time. To delete your account, use the delete card at the bottom of the Home screen in the app, or request deletion on the web at efosa.so/privacy/grofer or by emailing hi@efosaso.com. We aim to reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
8. Children
Grofer is not aimed at children under 13, and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.
9. Security
We protect your data with encryption in transit, access controls and a minimal-data design: our analytics use a fixed list of events with no free text. No system is perfectly secure, so we cannot guarantee it.
10. Changes to this policy
If we change this policy in a way that matters, we will update the date above and tell you in the app before the change takes effect.
11. Contact
Efosa Omorogbe, trading as EsO Designs, Hoxton, London, N1, hi@efosaso.com.
