Privacy
On Shelf is a personal copy first. Remix the catalog if you want your own town. There is no account, no ad pixel, and no sale of your list.
Safe mode
Opens this way every time. Camera, pin, and live lookup stay off until you leave Safe mode. Photos never leave the phone either way.
Save on this device
List, stores, and the activity log write to local storage. Off means they die when the tab closes.
Location
Used only to pick a metro preset. Coordinates are not stored and are not sent to a server.
Live product lookup
Off by default. When on, an unknown search may call Open Food Facts once.
What we handle
On device: your list, checked items, chosen banners, ZIP, and these switches. Optional: a one-shot browser location that is discarded after matching a preset.
Safe mode is the default when the app opens. Camera, pin, and live lookup stay off. A snap is stored on this phone. “Read the label” is optional and only then may a compressed still leave the device to name the box. Type the name instead if you do not want that.
Not collected: email, payment, loyalty cards, precise history of which aisle you stood in.