Privacy Policy

Last Updated: April 6, 2026

1. Overview

Cart Decode is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding your data. By using Cart Decode, you agree to the practices described here.

Cart Decode is operated by Packet & Frame, LLC.

2. Information We Collect

2a. Account Information

When you create an account, we collect:

  • Display name
  • Email address
  • Authentication credentials (passwords are hashed — plaintext passwords are never stored)
  • Authentication method (email/password, SSO, magic link, or FIDO2 passkey)

2b. Security & Authentication Data

To protect your account and prevent fraud, Cart Decode collects security metadata including authentication events, device information, and fraud prevention signals. This data is encrypted and used solely for account security.

2c. Ethical Profile

Cart Decode offers an optional ethical profile to personalize your experience. This profile may include political and ethical values and preferences you choose to provide.

This is entirely voluntary. You may use Cart Decode without completing an ethical profile. Your ethical profile is never sold, shared with third parties, or used for advertising purposes outside of on-platform personalization.

2d. Usage Data

  • Product barcodes scanned
  • Search queries and product interactions
  • Products favorited and saved
  • Company blacklist entries and reasons
  • Alternative product selections
  • App version and device type
  • IP address, browser user-agent, and session metadata for security and fraud prevention

2e. Location Data

Cart Decode collects city, state, and postal code that you manually provide to power location-relevant features such as local economy scoring. On mobile devices, Cart Decode may in the future request permission to collect approximate device location; if implemented, you may deny or revoke location permission at any time in your device settings. Precise GPS coordinates are not stored.

2f. Category-Specific Profiles

Cart Decode may offer optional category-specific profiles to further personalize your experience. When available, these profiles are entirely voluntary and subject to the same protections as your ethical profile.

2g. Payment Information

Subscriptions purchased via web are processed by Stripe. Subscriptions purchased through the iOS app are processed by Apple via In-App Purchase. Cart Decode does not store payment credentials. All payment data is handled by our processors under their respective privacy policies and PCI-DSS compliance programs.

3. How We Use Your Information

We use collected information to:

  • Provide and improve the Cart Decode platform
  • Personalize your experience based on your optional ethical profile
  • Process subscription payments
  • Send transactional communications (confirmations, password resets, receipts)
  • Generate aggregate, anonymized insights about product scanning behavior
  • Serve on-platform advertising personalized to your ethical profile and scan context

On-platform advertising: Free tier users may see curated, mission-aligned sponsored products or brand recommendations matched to their ethical profile and usage context. This matching happens internally — your profile data is never shared with or disclosed to advertisers. Advertisers receive only aggregate, anonymized performance data (such as impression and click counts). Premium subscribers may turn off all advertising. Free tier users may opt out of personalized advertising at any time in account settings, in which case generic non-personalized ads may appear instead.

We do not:

  • Sell or rent personal data to any third party
  • Share your ethical profile with advertisers or any external party
  • Use your data for advertising outside of the Cart Decode platform

4. Ethical Profile Data

Your ethical profile may reveal political opinions or personal values. Cart Decode applies the following protections:

  • Protected with appropriate security measures including encryption and access controls
  • Used solely to power your personalization features and on-platform advertising matching
  • Never included in aggregate or anonymized datasets
  • Never disclosed to third parties
  • Deletable at any time from account settings, independently of your full account

5. Aggregate & Anonymized Data

Cart Decode may publish aggregate, anonymized data derived from user scanning behavior. This data cannot identify any individual user, does not include ethical profile information, and is released under the Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) license.

6. Third-Party Services

Cart Decode shares user data only with third parties necessary to operate the platform, including:

  • Authentication providers (Google, Apple) for single sign-on
  • Payment processors (Stripe, Apple) for subscription billing
  • Cloud infrastructure providers for hosting and data storage
  • Email delivery services for verification codes, password resets, and transactional emails
  • Bot detection services for registration fraud prevention

Analytics tools, when implemented, will be added to this list. All third-party services are required to protect user data to at least the same standard described in this policy and may not use shared data for their own commercial purposes.

7. Data Retention

We retain your personal data only as long as necessary to provide the service or as required by law. You may request deletion of your account and associated data at any time. Payment records are retained as required by applicable law. Aggregate anonymized data contains no personal information and is retained indefinitely.

8. Your Rights

All users may:

  • Access, correct, or delete their personal data
  • Request a portable copy of their data
  • Delete their ethical profile independently of their account
  • Revoke location permissions at any time via device settings

California residents (CCPA) additionally have:

  • The right to know what personal information is collected, used, or shared
  • The right to opt out of sale of personal information — Cart Decode does not sell personal information
  • The right to non-discrimination for exercising privacy rights
  • The right to limit use of sensitive personal information, including data revealing political opinions and precise geolocation

To exercise any right, contact hello@cartdecode.com or use your in-app account settings.

9. Data Security

Cart Decode implements industry-standard security measures including encryption of data in transit and at rest, secure password hashing, logical isolation of sensitive profile data, and access controls limiting data access.

Cart Decode logs security-relevant events (login attempts, credential changes, session activity) including timestamps and IP addresses for incident detection and response. These logs are retained as needed for security purposes and in accordance with applicable law.

No system is completely secure. In the event of a breach affecting your personal data, we will notify you as required by applicable law.

10. Children's Privacy

Cart Decode is not directed at children under 13 and does not knowingly collect data from children under 13. Contact hello@cartdecode.com if you believe we have inadvertently done so.

11. Changes to This Policy

Material changes will be communicated via in-app notice or email with reasonable advance notice. Continued use after the effective date constitutes acceptance.

12. Contact

hello@cartdecode.com