Get started
← Back

Privacy Policy

Last updated: November 2026

In short

  • No account: your answers to the wizard, your plan and your list are saved in your browser, not on our servers.
  • We only receive your postal code, to find the flyers in your area, whatever you choose to write to us and, if you click “Accept all”, usage statistics (section 4).
  • Premium payment goes through Stripe: we never see or store your card number.
  • Nothing is sent to Google Analytics until you click “Accept all”: no cookie, no measurement.
  • No sale of information, no advertising.

1. Who is responsible

JustShoppingSmart, Châteauguay, Quebec, Canada.

Person in charge of the protection of personal information: The founder of JustShoppingSmart, justshoppingsmart@gmail.com

This policy applies Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What is saved in your browser

The app works without an account. The following information is saved in your browser's local storage, not on our servers. Most of it never leaves your device; the exceptions are noted below and detailed in sections 3 and 4:

  • Your answers to the wizard: household makeup, budget, chosen grocery store and pharmacy, postal code, number of meals, food preferences and restrictions, favourite cuisines, your children's breakfast and lunch preferences. The first three characters of your postal code are also sent, through our server, to Flipp to find the flyers in your sector, and your full postal code goes with your Thursday-digest request or the “Order” link if you use them (section 3). If you click “Accept all”, a few answers (budget, number of meals, number of people per age group, store) are also sent to Google Analytics (section 4).
  • Your nutrition profile, if you fill it in: sex, age, weight, height, activity level and goal. This health information never leaves your device.
  • Your plan and your list: recipes, checked or added items, chosen store, history of deals spotted, recipes kept or swapped, in-app loyalty points.
  • Premium: a marker showing that this device was activated for Premium, and a trace of your launch-notification request if you made one. The Premium status itself is checked by our server.
  • Your choices: cookie consent, messages already dismissed, a copy of the feedback and suggestions you sent us.
  • Your GPS location, on the Restaurants page only and if you allow it: it is used to compute distances in your browser and is never sent.

You can erase all of it at any time by deleting this site's data in your browser settings.

3. What is sent to us, to whom and why

  • Flyer prices: the first three characters of your postal code (your sector) and the ingredient names of your plan go through our server to Flipp, which provides the flyers in your sector. Flipp's answers stay cached for 24 hours on our server, by sector, with no link to your identity.
  • Province: our host infers your country and region from your IP address. We use them to choose the default province, without keeping them.
  • Forms: your feedback (rating, comment, optional name and email), your restaurant suggestion (restaurant name, city, cuisine, promotion, your email), your request to be told when the Thursday digest starts (email, postal code, store, language) or your request to be told when Premium launches (email, language) are sent by our server, as an email, to our Gmail inbox (Google). Feedback also stays in our server's memory until the next site update. The Thursday digest and Premium launch forms have been suspended since November 2026; requests already received are kept as described in section 6.
  • Premium payment (new subscriptions are paused; the following applies to existing subscriptions): the payment page is Stripe's, which collects your email and card. We never see or store your card number: our server only checks with Stripe that the payment succeeded. Your email and payment history are available to us in Stripe to manage the subscription and refunds.
  • Premium status: a cookie (section 4) links this device to your Stripe subscription. Our server uses it to read the subscription status from Stripe (active, period end, scheduled cancellation) and keeps it cached for 10 minutes. If Stripe does not respond, the last known status is kept so your access is not cut off.
  • Activation on another device: if you ask for a link, your email is sent to Stripe to find your subscription. If it is active, we send you a link valid for 15 minutes from our Gmail inbox. We do not keep your email; the copy of the sent message stays in our sent folder for 30 days at most.
  • Managing the subscription: the “Manage my subscription” button opens Stripe's customer portal (cancellation, card, invoices).
  • Online ordering: if you click “Order on Instacart”, the link to Instacart contains the chosen store, your postal code and a marker showing you came from JustShoppingSmart. Instacart's own policy then applies.
  • Hosting: Vercel hosts the site and keeps technical logs (IP address, requested page, browser) for security and troubleshooting. Our server also keeps your IP address in memory, for one hour at most, to limit abuse.
  • Audience measurement: Google Analytics, described in section 4.
  • Home page video: the French home page offers a YouTube video. Nothing is loaded from YouTube before you click the play button: until then, the image shown comes from our site. After the click, the video plays from youtube-nocookie.com; YouTube (Google) then receives your IP address and your browser's technical data, and YouTube's terms of service and privacy policy apply.
  • Blog articles: we write them with the help of the Anthropic API and publish them on GitHub. No visitor information is sent to them.

4. Cookies and audience measurement

  • jss-app (12 months): remembers that you started a plan, to open your list directly.
  • NEXT_LOCALE (session): remembers the language.
  • jss-premium (12 months, extended at each check): proves your Premium subscription on this device. It holds the Stripe customer and subscription IDs and the last known status, signed by our server, with no email.
  • jss-checkout (24 hours): links a Stripe payment to the device that started it.
  • _ga and _ga_* (up to 2 years): Google Analytics cookies, set only if you click “Accept all”.

Google Analytics only loads if you click “Accept all”. If you choose “Essential only” or make no choice, nothing is sent to Google Analytics: no cookie and no measurement, not even without an identifier.

With your consent, we also measure events: wizard started and completed, plan generated (budget, number of meals, number of people per age group, store), store or recipe changed, “Order” clicked (store, number of items, cart value), Premium viewed and Thursday-digest request (store). No name, email or postal code is sent to Google Analytics. This data is kept for 14 months at most.

To change your mind at any time, use the “Manage cookies” link at the bottom of every page: it reopens the banner. If you switch to “Essential only”, the Google Analytics cookies (_ga, _ga_*) are deleted and the page reloads to stop measurement. Stripe and our partners set their own cookies on their sites. Details in the cookie policy.

5. Why we use this information

  • To build your plan, your list and your weekly prices.
  • To answer you and improve the site with your feedback.
  • To tell you when the Thursday digest starts, if you asked: a single email. No digest is sent today.
  • To manage your Premium subscription and refunds.
  • To tell you when Premium launches, if you asked: a single email.
  • To measure the audience, with your consent for cookies, and to protect the site.

We do not sell, rent or trade your information. The site shows no advertising and uses no advertising cookies. No decision about you is made solely by automated processing: the proposed plan is only a suggestion.

6. Retention and destruction

  • Browser: until you delete this site's data.
  • Feedback and restaurant suggestions: 24 months after receipt, then the emails are permanently deleted. The in-memory copy on the server disappears at every site update.
  • Thursday digest request: in our Gmail inbox until the announcement email, then deleted within 30 days; sooner if you write to us.
  • Premium launch-notification request: in our Gmail inbox until the launch email, then deleted within 30 days.
  • Payments: 6 years, as required by tax laws. Payment data is kept by Stripe.
  • Google Analytics: 14 months at most.
  • Flipp price cache: 24 hours.
  • Premium cookie: 12 months, extended when the status is checked again.
  • Cached subscription status: 10 minutes, longer only if Stripe does not respond.
  • Activation emails sent: 30 days at most in our sent folder.
  • IP address kept to limit abuse: one hour at most, in memory.
  • Host logs: a short period set by Vercel.

7. Where your information is processed

Our providers may process your information outside Quebec: Vercel, Google and Stripe, notably in the United States, and Flipp, in Canada. Flipp receives from our server only the first three characters of your postal code and the ingredient names of your plan (section 3).

8. Security and incidents

The site is served over HTTPS only. Access keys to our services stay on the server and are never sent to the browser. Access to the email inbox, to Stripe and to hosting is limited to the person in charge.

We keep a register of confidentiality incidents. If an incident presents a risk of serious harm, we notify the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada and the people concerned, and we take steps to reduce its consequences.

9. Your rights

Under Law 25 and PIPEDA, you can:

  • know what information we hold about you and get a copy;
  • have it corrected if it is inaccurate, incomplete or equivocal;
  • withdraw your consent, for example by asking us to remove your email;
  • ask for its deletion when it is no longer needed, or for it to stop being disseminated;
  • receive the information you provided in a structured, commonly used technological format.

Write to justshoppingsmart@gmail.com. We may ask you to confirm your identity, for example by writing from the address you used. We answer in writing within 30 days, free of charge. Information kept in your browser is not accessible to us: you can view and erase it yourself.

10. Governance and complaints

The person in charge of the protection of personal information approves this policy, answers requests and complaints, keeps the incident register and makes sure information is destroyed within the periods above. This policy is reviewed at least once a year and whenever the way the site works changes.

To file a complaint, write to justshoppingsmart@gmail.com with the subject “Privacy complaint”. We acknowledge receipt within 7 days and answer in writing within 30 days. If you are not satisfied with the answer, you can contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

11. Minors

The service is meant for adults who do the grocery shopping. We do not knowingly collect information about children under 14: the wizard only asks for the number of children per age group and their meal preferences, which stay in your browser.

12. Partner links

Some links to Instacart may be affiliate links: JustShoppingSmart may receive a commission, at no extra cost to you. This influences neither the choice of recipes nor the prices shown. Our links to Instacart, and to the retailer, loyalty-program and platform sites mentioned on this site (PC Optimum, PC Express, IGA, Metro, Voilà, Flipp, pharmacies, Uber Eats, Skip), lead to sites that apply their own privacy policies. See the affiliate disclosure.

13. Changes

The date at the top of the page shows the last update. We announce important changes on the site.