Karto Privacy Policy

1. Who we are

Karto is a grocery price comparison app for Québec, published by Entreprise Jay Lauzon (Québec, Canada). The person responsible for the protection of personal information is Jérôme Lauzon (see “Contact us” below). See also our terms of use.

2. What stays on your phone

If you don't have an account, this information is saved only in the app's storage, on your device. It is not sent to our servers and is erased if you delete the app:

• your chosen stores and your settings;
• your first and last name (optional, to greet you on the home screen);
• your allergies and diets;
• your favourites, shopping list, Price match items, recent searches, loyalty cards and “Pantry, fridge and freezer” items;
• the Karto messages you have already seen (so they aren't shown twice) and your acceptance of this policy.

3. What is sent to our server

To show prices, the app queries our server (api.kartoapp.ca). Requests contain only what is needed to answer:

• the numbers of the chosen stores;
• the words searched, the products viewed and the barcodes scanned;
• your approximate location (latitude and longitude), only when you tap “Use my location” or when the Price match tab looks for the store you're in (automatic “I'm at” setting, which can be turned off).

Without an account, these requests are not linked to any identity (no advertising identifier). Our server does not keep your location. Nor does it keep the history of your requests, unless you have accepted usage statistics (section 3c). Short-lived technical logs may exist to ensure proper operation and security. The server also measures how long its responses take (hourly totals, with no information about you) to keep the app fast.

Protection against automated copying: to stop bots from copying prices, the server counts, in memory only, the number of requests from each IP address during the current minute and day. Nothing is written unless the limits are exceeded. If they are, only the number of blocked requests is kept, with an anonymized identifier (irreversible, changing every day) instead of the IP address, and it is deleted after 30 days.

Popular searches: when you search, our server counts the searched word with the date and time, and nothing else (no account, no device, no IP address). These words are only used to show popular searches in the app, and are deleted after 90 days.

Shared lists: when you tap “Share my list”, a copy of the items to buy (name, size, photo and quantity) and your first name (if you entered it) are sent to our server to create a link. Anyone with the link can see the list. No account, device or IP address is linked to it, and the list is deleted after 30 days.

Anonymous counters: in the same way, our server adds up, per hour, the number of times the app is opened (with its version and the type of phone, Android or iPhone), a tab is opened, a product is opened, scanned or added to your list, favourites or Price match, a search or a barcode gives no result, an Amazon link, a video or the Pro window is opened, a Karto message is seen and a load fails. Once a day, it also counts the banners followed (e.g. Maxi, IGA), without the store addresses. Only the total is kept: no account, no device, no IP address, and nothing can link two actions to the same person. These totals are used to know which features are useful and are deleted after 12 months.

3b. Karto account (optional)

If you create an account, we keep on our server, located in Québec:

• your email address, to send you a 6-digit sign-in code (there is no password);
• the backup of your data: stores, settings, allergies and diets, first and last name (if you entered them), favourites, shopping list, Price match items, recent searches and loyalty cards (program name and card number), “Pantry, fridge and freezer” items (name, place and dates);
• the dates the account was created, last signed in and last backed up;
• for referrals: your invitation code, and, if you entered someone's code, who invited you and when. The person who invited you only sees how many people they have invited (not who). You see the first name of the person who invited you, if they entered it in Karto.

This data is used only to sign you in and to restore your data on another device. It is never sold or used for advertising. Sign-in codes are sent by Resend, our email delivery service (Resend's policy).

Delete your account: in the app, Settings → My account → “Delete my account”. Your account and all its data are then immediately erased from our server. You can also write to us (see “Contact us”).

3c. Detailed statistics (optional)

To better understand how Karto is used, you can agree to share detailed usage statistics. This is off by default: none of this is sent until you check the “Help Karto get better” box (on the welcome screen or in Settings).

If you accept, the app sends our server:

• a device number chosen at random by the app (it is not linked to your name, your email, your account or an advertising identifier);
• the same actions as the anonymous counters above, with the date and time, as well as the words searched.

Your location, allergies and diets, first name, the full content of your list and your IP address are not part of these statistics. They are only used by Karto, are never sold or used for advertising, and are deleted after 12 months. If you turn statistics off, the app stops sending them and asks our server to erase all those linked to this phone.

4. Third-party services

• The prices shown come from our partner eezly technologies. Karto receives product and price data; no information about you is sent to eezly.
• Cloudflare carries the traffic between the app and our server, encrypted (HTTPS), and protects the server against attacks. Cloudflare processes your IP address for this purpose (Cloudflare's policy).
• If you search for stores by postal code, it is converted into a location by your phone's location service (Google on Android, Apple on iPhone).
• When you open a product page on a grocery store's website (for example in Price match), that site is shown as is and its own privacy policy applies.
• Some links to Amazon.ca are affiliate links: as an Amazon Associate, Karto may earn a commission on qualifying purchases, at no extra cost to you.

5. Permissions requested

• Location: find nearby stores and recognize the store you're in. Optional.
• Camera: scan barcodes. The image is analyzed on the phone and is never sent or saved.
• Vibration: confirm a successful scan.
• Internet: get the prices.

You can remove these permissions at any time in your phone's settings.

6. Allergies and diets

Allergy and diet logos are provided for information only, based on data published by retailers. They may be incomplete or inaccurate: always check the product label.

7. Pro version (subscription)

If a Karto Pro subscription is offered, payment is handled entirely by Google Play or the App Store. Karto never receives your payment information; we only keep whether your account is Pro and until when.

8. Children

Karto is not intended for children under 13 and does not knowingly collect information about them.

9. Your rights

Under applicable laws, including Québec's Law 25, you can ask us for access to your information, its correction or its deletion, by writing to us. Without an account, deleting the app erases all your data. With an account, you can delete it yourself in the app at any time.

10. Changes

We may change this policy. The date at the top of the page shows the last update. Important changes will be announced in the app.

Contact us

Jérôme Lauzon, Entreprise Jay Lauzon
Email: [email protected]