Cheepa Privacy Policy

Last updated: 17 July 2026

Cheepa is a South African grocery price-comparison app. This policy explains what data the app collects, why, and how it is handled. Plain language; no dark patterns.

Who runs the app

Cheepa is operated by the developer behind the app.cheepa Android package. For privacy questions, email info@cheepa.co.za.

What we collect

• Email address — used as your account identifier. Sign-in is a one-time magic link sent to your inbox. No password is stored.
• Approximate and precise location (only while the app is in use, and only if you grant the permission) — used to find the stores nearest to you and route your shopping run. Location is never tracked in the background.
• Receipt photos (if you choose to upload one) — used to read the prices on your receipt. Photos are sent to Anthropic's Claude API for text recognition and are not retained by the OCR provider after processing.
• Loyalty card number (if you choose to add one) — you can type it in, or scan your card with the camera. Scanning reads the number on your device; the photo never leaves your phone and is not sent to us or any third party. We store only the number, on your device, so you can show it at the till.
• Basket and price observations — products you add, prices you observe at stores, and store visits. Used to power the price spine and the cost-of-living index. Aggregated and anonymised before any sharing.

What we do NOT collect

• No advertising identifiers, no third-party tracking SDKs.
• No payment information — Cheepa is free to use.
• No contacts, no SMS, no call logs, no microphone.
• No background location.

How data is stored

Your account data and price observations are stored on servers operated by Fly.io in South Africa (Johannesburg). Database access is restricted to the developer. We use industry-standard encryption in transit (HTTPS) and at rest.

Third parties

• Anthropic (Claude API) — receipt photos and shelf photos are sent to Anthropic for text recognition. Anthropic does not retain submitted content after processing. See anthropic.com/legal/privacy.
• Fly.io — hosting provider for the API and database, in the Johannesburg region. See fly.io/legal/privacy-policy.
• Sentry — crash and error diagnostics, if enabled. Personal information is stripped before any crash report is sent; reports carry no identity and no receipt content. See sentry.io/privacy.

We do not sell or rent personal data to anyone, ever.

Your rights

You can:

• Request a copy of your data.
• Request deletion of your account and all linked observations.
• Revoke the location, camera, or photo permissions at any time from your device settings.

Delete your account in-app: open Settings → Account → "Delete my account". This immediately and permanently erases your account, sign-in tokens, draft baskets, and receipt-ledger lines. Price observations you contributed stay in the shared index in anonymised form (they carry no personal identifier once the account is gone).

You can also email info@cheepa.co.za with "DATA REQUEST" in the subject line. Requests are honoured within 30 days, in line with the Protection of Personal Information Act (POPIA) and the GDPR where applicable.

Children

Cheepa is not directed to children under 13 and we do not knowingly collect data from them.

Changes to this policy

If the policy changes, the "Last updated" date above is bumped and the new version is published at this URL. Material changes will be highlighted in the app.

Contact

info@cheepa.co.za