Effective date: 11 June 2026 Last updated: 11 June 2026
Stockboy ("Stockboy", "we", "us") is a grocery and replenishment app for iPhone and iPad. This policy explains what data the app handles, why, and the choices you have. We collect as little as possible and never sell your data.
Plain-language summary: The app works fully on your device for free. The only data that ever leaves your phone is: (1) your email address, if you sign in; (2) your list contents, only if you turn on paid sync or join a shared list; and (3) a product barcode you scan, which is sent to Open Food Facts to look up the product. Your household members, dietary tags, and allergies never leave your device. There are no ads, no analytics, and no tracking.
Contact: support@rockingcalifornia.com
Stockboy is operated by ROCKING CALIFORNIA LLC. We are the data controller for the information described below. Our sync server is self-hosted in the United States (Oregon).
Stockboy is free to use entirely on a single device with no account. In that mode your data — lists, items, purchase history, household members, dietary tags, and allergies — stays in local storage on your device and is not transmitted to us.
Two optional features send data off your device:
| Data | When | Purpose | Where it's stored |
|---|---|---|---|
| Email address | When you sign in via magic link, or are invited to a shared list | Authenticate you; deliver sign-in and invitation emails | Our server (US) |
| Account identifier + auth tokens (a random user ID, JWT, refresh token) | On sign-in | Keep you signed in securely | Our server + your device |
| List content (list names, items, barcodes, purchase check-offs, "needed" events, timestamps, and the editing member's ID) | Only if you enable paid sync or use a shared list | Sync your lists across devices and between members you invite | Your device, and our server for synced/shared lists |
| Household members, dietary tags, and allergies | When you add them | Power on-device dietary and allergen filtering | Your device only — never sent to our server |
| Product barcode | When you scan or enter a barcode | Look up product name, brand, Nutri-Score, NOVA, and allergen tags | Sent to Open Food Facts; the result is cached on your device |
| Purchase status (which product you bought, renewal status) | When you buy a subscription or the lifetime unlock | Unlock and maintain your access to sync | Provided by Apple; we never receive your card or payment details |
We do not collect: precise location, contacts, photos (the camera is used only for live barcode scanning — images are not stored or uploaded), advertising identifiers, or any analytics/usage telemetry.
Stockboy contains no third-party advertising, analytics, attribution, or tracking SDKs. We do not track you across other apps or websites, so the app does not ask for App Tracking Transparency permission. The only third-party code in the app is the open-source PowerSync sync client.
We rely on a small number of providers to run the service:
We do not sell or rent your personal information to anyone, and we do not share it for advertising.
If you create or join a shared list, the other members of that list can see its contents (items, purchase history, and the timestamps of changes) and the user ID of who made each change. They do not see your email address unless you tell them. You can stop sharing by removing the list. Your household, dietary, and allergy data is never shared because it never leaves your device.
Data in transit is encrypted with TLS (HTTPS). Our server's administrative access is restricted to a private network. We take regular encrypted backups. No system is perfectly secure, but we limit what we store and who can reach it.
We keep synced list content and your account email for as long as your account is active. When you delete your account (see below), we delete your account email, authentication tokens, and the lists you own from our server within 30 days, except where we must retain limited records to comply with law. Data that lives only on your device is removed when you delete the app.
You can:
Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights to access, correct, delete, or restrict processing of your data, and to lodge a complaint with your local data protection authority. We honor these requests for all users regardless of location. We do not "sell" or "share" personal information as those terms are defined under California law.
Our server is located in the United States. If you use Stockboy from outside the US, the data you choose to sync will be processed in the US.
Stockboy is a general-audience household utility and is not directed to children under 13 (or the equivalent age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.
If we make material changes we will update the "Last updated" date and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.
Questions or requests: support@rockingcalifornia.com