Privacy policy
Last updated: September 25, 2026
1. Overview
This policy explains what personal data Squirrel collects, why, and what (if anything) is shared with anyone else. Squirrel is a small household-management app — it isn't ad-supported, doesn't run analytics or tracking scripts of any kind (see "Cookies and local storage" and "Third parties" below for the small details), and doesn't sell or rent your data to anyone.
2. Who this policy covers
"We" means whoever operates the instance of Squirrel your account lives on — typically the person who set it up for you and your household, or the household owner who invited you. Squirrel isn't a large multi-tenant SaaS company with a dedicated privacy team; it's a self-run app, so for anything this policy says to contact "us" about, that means contacting them.
3. What we collect
When you create an account, we store:
- Your email address (used to log in, to send invite emails if you're invited to or invite others to a household, and to send the weekly digest if you turn it on);
- Your password — never in plain text. It's hashed with bcrypt before storage, so we can verify it at login but can't see or recover the original password;
- Your display name;
- Your Swish number, only if you add one in your Profile — it's shown to the members of your households so they can pay you back with Swish, and you can remove it there at any time;
- Which households you belong to and your role in each (owner or contributor).
Beyond your account, Squirrel stores the content you and your household enter to use its features:
- Household-shared data: inventory items (including any product barcodes you link to them, so scanning one again finds the item), shopping lists, recipes, meal plans, and the household's shared budget categories and transactions — visible to every member of that household;
- Your personal budget: categories and transactions you track for yourself, visible only to you.
Cookies and local storage are covered separately in the next section.
5. Household invites
When you invite someone to your household by email, we send that email via Resend, a transactional-email provider — see "Third parties" below. The invite's recipient email address is passed to Resend to deliver that one message and isn't otherwise stored in our database; the invite link itself (a random token with an expiry date) is stored so it can be looked up and redeemed when the recipient opens it.
6. Third parties
Resend receives personal data only to deliver account and household-invite emails (recipient email address, the inviting household's name, and the link) and, only if you've turned it on in your profile, the weekly household digest (your email address and that week's summary: the household's name, completed task titles and who did them, item names close to their date, how many recipes were planned, and this month's household budget figure). The digest is off by default and every one carries an unsubscribe link that works without logging in. Resend processes that data on our behalf as a data processor, under its own privacy policy. If email delivery isn't configured on your instance, invites work purely through the on-screen shareable link and no email — or data — is sent anywhere.
Open Food Facts, a free, open product database, is asked for a product's name and category when you scan a barcode Squirrel doesn't recognize yet. Only the barcode's digits are sent, from our server — the camera image is decoded on your device and never leaves it, and no account or household data goes with the request. A barcode you've already linked to one of your items is looked up in your own inventory instead, and nothing is sent.
Your browser's speech recognition is used when you tap the microphone button on a shopping list to add items by voice. Squirrel doesn't record or receive any audio — it only gets the text your browser hands back, which is then added exactly as if you'd typed it. But some browsers don't recognize speech on your device: Chrome and Edge, for example, send the recording to Google's or Microsoft's servers, and Safari may send it to Apple, under that company's own privacy policy. Nothing is recorded until you tap the button, listening stops after one phrase, and if you'd rather not use it, typing works exactly the same. Browsers without speech recognition don't show the button at all.
Gemini (Google) and Anthropic are used by three optional AI features, and only when whoever operates your instance has configured an API key for one of them — with no key configured, none of this ever runs.
- AI shelf scan and AI receipt scan only run when you start them. Each uploads the photo you take (of a shelf, fridge or cupboard, or of a paper receipt) so a vision model can read it. In shelf scan's "Take stock" mode, the names of your household's current inventory items (up to 300) are sent along with the photo so the model can match what it sees to them. The photo itself is never saved in our database — only the rows you review and confirm afterwards are.
- AI auto-categorization runs automatically, in the background, when you add a new item whose name neither the built-in dictionary nor your household's earlier items recognize. Only those item names are sent — never quantities, prices, or any other household or account data — and the answer is used solely to fill in the item's category. The item is saved right away as "Uncategorized" either way, and a category you've already set yourself is never overwritten.
What Google and Anthropic do with data sent to their APIs is governed by their own API terms and privacy policies.
Sentry (error reporting) is optional and only active if whoever operates your instance has switched it on. When active, if the app crashes or hits an unexpected error, technical details about that error (the error message and stack trace, the page address, your browser and device type, and possibly your IP address) are sent to Sentry so the problem can be fixed. Sentry acts as a data processor on our behalf. It is not configured to record sessions, track your usage or set cookies, and we don't send your inventory, shopping list, meal plan or budget contents to it on purpose. If your instance doesn't use it, nothing is sent.
We don't use any analytics or advertising service. There is no tracking pixel and no ad network. Apart from the barcode digits sent to Open Food Facts, the optional Gemini/Anthropic AI features, and the speech your own browser may send its vendor when you add items by voice, all described above, no third party receives your inventory, shopping list, meal plan, or budget data.
7. Legal basis for processing (EU/EEA users)
If you're in the EU/EEA (including Sweden), our legal basis for processing your account and household data is performance of the contract formed by these terms — we need it to provide the features you've signed up to use. Rate-limiting login and signup attempts (to slow down password-guessing) relies on our legitimate interest in keeping the service secure; that rate-limit data lives only in server memory, is keyed by the email address being attempted, and clears automatically — it's never written to the database or kept after a restart.
8. How long we keep data
Account and household data is kept for as long as the account or household exists. A household owner can permanently delete their household at any time from that household's settings ("Danger zone") — this immediately and irreversibly deletes all of that household's inventory, shopping lists, recipes, meal plans, and shared budget data for every member. Leaving a household removes your membership and access to its data, but doesn't delete your account.
9. Your rights and how to exercise them
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing — for EU/EEA and Swedish users, these come from the GDPR.
You can exercise most of these rights yourself, without contacting anyone: use "Export my data" in your Profile to download a copy of your personal data, or "Delete account" there to permanently delete your account. You can also delete your own content (for example, individual inventory items, shopping lists, or budget entries) yourself at any time through the app. For anything those self-service tools don't cover, contact the household owner who invited you, or whoever operates your instance of Squirrel.
10. Children
Squirrel isn't directed at children and isn't knowingly used to collect personal data from anyone below the age required to consent to data processing under their local law (13 in most contexts, 16 under the GDPR unless their country sets it lower). If you believe a child has created an account, contact your instance's operator to have it removed.
11. Security
Passwords are hashed before storage and are never visible to anyone, including whoever operates your instance. Login and signup attempts are rate-limited to slow down automated guessing. No system is perfectly secure, so we can't guarantee absolute security of information you send us.
12. Changes to this policy
If this policy changes, we'll update the "Last updated" date above. Material changes — for example, if a new third-party service is ever added — will be reflected here before they take effect.
13. Contact
For any question about this policy or your data, contact the household owner who invited you, or the person who operates your instance of Squirrel. See also our Terms of service.