Privacy policy
The short version
- BJ's Companion is a private app for one household. It isn't a business and has no ads, analytics or tracking.
- Your information is used only to make the app work and to make the connections you ask for, such as a Kroger price check or adding to your Kroger cart.
- Nothing is sold, rented or shared for marketing. Ever.
- Everything the app keeps is stored encrypted on the household computer, and you can unlink your Kroger account at any time.
Who runs it
BJ's Companion is run by Chris Hall for his own household, on a computer in his home. Accounts are created by the household administrator; there is no public sign-up.
What the app keeps
- Your account: your username, display name and color. Your password is stored only as a salted one-way hash (scrypt), never as the password itself.
- Household records you enter: groceries, where they're stored, purchases and prices, receipts you import, shopping lists, recipes, meal plans, product photos, and anything else you type into the app.
- Sugar Log (only for the people it's shared with): the readings and notes entered in it.
- Sign-in sessions: a cookie that keeps you signed in for up to 30 days. It is marked HttpOnly and SameSite, and sent only over HTTPS when you use the internet address.
- Security log: failed sign-in attempts, with the internet address they came from, to block password guessing.
Kroger connection
If you choose Link my Kroger account, you sign in on Kroger's own page. BJ's Companion never sees or stores your Kroger password. Kroger then gives the app permission (a "token") to do only what you approved:
- Products and Locations: look up prices for an item you scan, and find nearby Kroger-family stores.
- Cart: add an item to your Kroger cart, only when you click Add. The app can't check out, can't see your payment details, and can't read your order history.
- Identity: read your Kroger profile ID, shown so you can see which account is linked.
Your Kroger token and profile ID are stored encrypted (AES-256-GCM). The encryption key is locked by Windows to the household computer's account, so a copy of the files can't be read anywhere else. Unlink deletes your token from the app right away.
Your location
- Price check asks your phone for its location only at the moment you check a price, and only if you allow it.
- Only a rough location, rounded to about half a mile, is sent to Kroger to find nearby stores. Exact distances are worked out on the household computer.
- Your location isn't saved, except the optional "home" spot you choose to set in Settings.
Other services the app talks to
The app contacts these only for the feature you're using, and sends only what's listed:
- Kroger (api.kroger.com): item barcodes, a rough location, and cart additions you request. See Kroger's privacy policy.
- UPCitemdb: a barcode, to look up online prices. No account information is sent.
- Open Food Facts, Open Beauty Facts and Open Products Facts: a barcode or item name, to find a product photo.
- BJ's product image server: an item number, to download a product photo.
- DuckDNS: keeps the app's internet address pointed at the household computer. It sees the household's internet address, not your data.
- Your phone's notification service (Sugar Log reminders only): reminder pings carry no content. The phone fetches the message directly from the app.
How it's protected
- Everything is stored on the household computer, not in a cloud service.
- All of it is encrypted on disk (AES-256-GCM): household records, the Sugar Log, every daily backup, Kroger keys and sign-ins, and the price look-up cache. The encryption key is locked by Windows to the household computer's account, so a copy of the files can't be read anywhere else.
- The internet address uses HTTPS on every page.
- Repeated wrong passwords lock out the address they come from.
- Kroger keys and sign-ins are never included in the app's backups or data exports.
- Not encrypted: product photos (pictures of store packaging) and the server's activity log, which notes failed sign-ins and the internet address they came from.
- Settings > Download a backup makes a readable copy on purpose, for the administrator. It's kept wherever they save it.
Keeping and deleting
- Unlink on Price check removes your Kroger token immediately.
- Cached price look-ups are thrown away after a day or less.
- Ask the household administrator to delete your account or any of your records, and they will be removed.
Children
The app is meant for adults in the household. It doesn't knowingly collect information from children.
Changes
If this policy changes, the new version will be posted on this page with a new effective date. Changes will never expand how your information is used without telling you first.
Questions
Ask Chris Hall, the household administrator.