Privacy Policy

Effective October 9, 2026 Last updated October 9, 2026 Version 1.8

The short version

This summary is not part of the policy and does not change the sections below. If the two ever conflict, the sections below control.

There is no password, ever. You sign in by clicking a link we email you. Your email address is your account, and it is the only thing we ask you to tell us about yourself.
You can look around without signing in. Entering a zip code and building a list needs no account. Sending ZipAisle out to check prices does.
You can rate a plan and write to us, signed in or not. A message is forwarded to the mailbox we answer from, and what you wrote is erased from our database after 90 days; Section 3 says what else is kept, and for how long.
Your address does four jobs and no others: it signs you in; — only if you tick the box — it receives one link to one finished plan; when you write to us, by email from it or through ZipAisle while you are signed in, it receives our reply; and while you have a watch list it receives one email each Wednesday with the best prices for the items you watch, which can mention what a paid plan would show you. One click in that email stops it. We send you nothing else.
We do not sell your information, and we do not run advertising. Nothing here is shared with the retailers whose prices we read.
You can delete your account yourself, at any time. It cancels your plan, takes your saved plans with it, and cuts your name off the records of the price checks you ran; those records are kept without any identifier for up to 24 months and then deleted.
Saved plan links are public to whoever holds the link, and they delete themselves: after 7 days on the Free plan, 90 days on Plus, while a Pro plan is paid for, and after 24 hours if nobody was signed in.
If you buy a plan, Stripe takes the payment. Your card number goes to Stripe, our payment processor, and never to us. We keep only Stripe's reference for you and which plan you are on.

1. Who this policy is from

This policy describes how Vykka LLC, a Washington limited liability company (“we”, “us”) — which owns and operates ZipAisle — handles information in connection with the ZipAisle website and service. It is incorporated into the Terms of Use, and Section 8 of those Terms summarises it.

2. Your ZipAisle account

What an account is

An account is an email address and nothing else. There is no password to choose, no password to reset, and no password column in our database — we could not leak one because we never have one. When you want to sign in, you give us an address and we email you a link; clicking that link and pressing the button on the page it opens is the whole of signing in.

We do not ask for your name, and no form on ZipAisle has a place for one; if you write it in a message to us, it is kept as that message is (Ratings and messages). We do not offer sign-in through Google, Apple, or any other identity provider, so no third party learns that you use ZipAisle. The one exception is a paid plan: if you buy one, Stripe's checkout page asks for a name and a billing address, and those go to Stripe, not to us (Paying for a plan).

Why an account is needed to run a price check

Sending ZipAisle out to read a retailer's pages is an errand performed on behalf of a specific person who asked for it (Terms 3). An account is how the service knows there is such a person: it is what lets us apply limits per shopper rather than per browser, act on a request from someone we can identify, honour a deletion request, and keep the plan you built at your kitchen table available on the phone in your hand at the store.

It also means we hold an email address, which the earlier version of this policy did not. That is a real change, and the rest of this document is written to say exactly what it means.

If you never sign in

You can open ZipAisle, enter a zip code and build a list without an account, and we do not collect an email address from you for doing it. What you cannot do without signing in is start a price check.

If you open a saved plan link someone sent you, you need no account for that either; those links work for whoever holds them, which is the point of them and also their risk (Section 5).

If you ask for a sign-in link and never click it. Asking for a link sends us your address and, if you had started one, the shopping list you were building — that is how a link opened on a different device still knows what you wanted. Both are held only for the life of that link, which is ten minutes. If you never click it, no account is created, the list is deleted when the link expires, and what remains is the link's own row: the address it was issued to and a one-way fingerprint of the link, deleted a day later. That row exists so that clicking a stale link can tell you it has expired and offer to send a new one.

3. What we collect, and why

The list below is everything the service collects.

What	Why	How long
Your email address, as your account — typed by you on the sign-in page	It is the account. We use it to send you a sign-in link when you ask for one, and it is what identifies your account to us afterwards. If you write to us, by email from it or through ZipAisle while you are signed in, our reply goes to it. It also receives the Wednesday watch-list email (below) until you stop it. We send you nothing else.	Until you delete your account, which you can do yourself at any time (Section 7). It is stored in our operational database, alongside the date the account was created and the date you last signed in, and your watch list’s own dates and choices (the watch list row below). There is no other automatic expiry.
Your email address, used to send you a plan — only if you tick “email me the results” when you start a check	To send you one message containing a link to that one finished plan. Ticking the box is a separate choice from having an account; leaving it unticked changes nothing else.	The copy attached to that plan is deleted with the plan — see the saved plans row below for how long that is. Separately, our email delivery provider keeps a record of each message it sends for us — including the address it went to and what the message said — for 30 days. See what our mail provider keeps below.
Sign-in links — one record per link you ask for	So a link can be used once and only once, so that asking for a new one retires the old one, and so that clicking a stale link can tell you it has expired instead of failing silently.	A link works for 10 minutes. Its record holds the address it was sent to, when it was made, when it expires, whether it has been used, and a coarse label for the device that asked (for example “iPhone · Safari”). It never holds the link itself — only a one-way fingerprint of it, which cannot be turned back into a working link. The record is deleted a day after the link expires, and immediately if you delete your account.
A sign-in cookie — named `pp_sess`, set on your device when you confirm a sign-in link	To keep you signed in, which is the only thing it does. It is a random value with no meaning of its own; the record it points at holds your account, when you signed in, when the session was last used, and the same coarse device label. It is not analytics, not advertising, and not readable by any other site. See Section 4 for why it needs no consent banner.	30 days from its last use, and never more than 180 days from sign-in, whichever comes first. It also ends the moment you sign out, sign out everywhere, delete your account, or we end your sessions at your request.
Zip codes — the one or more a check covers (Terms 9.1 says how many each plan may), typed by you, or the first derived from the approximate location your browser offers if you press “use my current location”	To find the stores near you. Browser location is requested only when you press that button, and you can decline; declining only means you type the zip code instead.	Kept with the run record in our operational database — see How long we keep run records below. The precise coordinates your browser provides are used to look up a zip code and are not stored. If you asked for a sign-in link while a list was in progress, the zip codes travel with that link and are deleted with it.
Your list — the item names and quantities you enter	To run your request and produce your plan. It is also sent to us when you ask for a sign-in link, so that the link still carries the check you meant. Opened in the browser that asked for it, the check starts by itself. Opened anywhere else — your laptop, or the browser inside your mail app — the list is shown to you and runs only if you choose.	Kept with the run record once a check runs — see How long we keep run records below. The copy that travels with a sign-in link is held for the life of that link and deleted the moment the link is used or expires, whichever comes first — at most ten minutes, whether or not you ever click it. A copy also sits in your own browser under `pp.list` so the wizard can carry it between pages.
Your watch list — up to 15 item names from the checks you ran or the items you chose to watch, each with the zip codes it is checked in, which of them you have chosen to be shown, which you have pinned, when each was added and last shopped, and the last shelf price read for it; and, for the list as a whole, when it was first filled, the date you last opened it, whether and when it was paused, whether and when you stopped the Wednesday email, which week’s plan it last made, which plan (Free, Plus or Pro) it last recorded your account on, and when that plan last went up	So the service can check your staples every Wednesday and show you the results (The watch list). The date you last opened it is what a Free account’s pause is decided on; the shelf price chooses which items are shown until you choose yourself. Your plan, and when it last went up, are there so our weekly report can count the changes to items’ zip codes made in the week after an upgrade: a count by plan, with no item names, and no report about any one account.	Until you delete your account, or remove the items yourself on your watch list page; the list’s own dates, choices and recorded plan go with the account.
The stores you have chosen to skip — each store you told us to leave out of every search, by the store alone, and when you did	So every search you run leaves those stores out without asking you again, and so your Skipped stores page can list them and bring any of them back. It says roughly where you do not shop, which is why it is listed here.	Until you delete your account or include the store again on your Skipped stores page. A store you skip for one search only is not kept here; it is part of that search’s saved plan, for as long as the plan is kept. Every skip you make during a search, for that search or for all of them, is also noted in that search’s run record (Technical request details, below), and kept with it.
A random browser identifier — a UUID generated in your browser and kept in its local storage	To tell one browser's runs apart from another's when we look at whether the service is working. It also keeps one plan rating per plan from each browser, and is counted to limit how often one browser can rate plans or send us messages (Ratings and messages).	In your browser, until you clear site data for zipaisle.com — doing that gives you a new one. We also keep a row for that identifier in our operational database. When you sign in on a browser, that row is attached to your account, so the runs made from it before that first sign-in are no longer anonymous to us, and nor is any run you make while signed in: they are your runs, and deleting your account removes the row and cuts the runs loose from you. A run made from it while you are signed out is anonymous. (A browser already attached to someone else's account stays with theirs.) See How long we keep run records below.
Technical request details — IP address, browser user-agent string, timings, which stores answered and which you skipped during the search, whether prices were reused from cache, and any errors	To operate the service, diagnose failures, prevent abuse, and understand why a run was slow or came back incomplete.	Kept with the run record — see How long we keep run records below, which says plainly what changes once these are attached to an account rather than to an anonymous browser. To limit how often one network address, browser, account or email address can ask the service for something — a sign-in link, a rating, a message — we also keep short-lived counters in our cache. Each is named by a keyed one-way fingerprint of that value, never the value itself, holds only a number, and expires on its own within a day.
Saved plans — the plan a check makes, kept at a link you can reopen, share or be emailed, and the plan each Wednesday’s watch-list check makes for you without your asking	So the run survives you closing the tab, and so the link works when you or someone you send it to opens it.	By plan: 7 days on the Free plan, 90 days on Plus, and for as long as a Pro plan is paid for; a plan made without signing in is kept for 24 hours. When a paid plan ends, saved plans are kept for at most 7 days from that date. Then deleted automatically. This is enforced by an expiry on the record itself, not by a cleanup we have to remember to run. A plan made while you were signed in is also linked to your account, so deleting your account stops its links working straight away rather than waiting out its period.
Your plan and billing reference — only if you buy a plan	To know which plan your account is on, when it renews, whether you have cancelled it, and whether a payment is failing — the four facts your account page shows and the weekly allowance is set from. Beside them we keep the time of the latest Stripe event we applied, so one delivered out of order cannot set the wrong plan. The reference is Stripe's customer and subscription number for you; it is how we ask Stripe to open the billing portal for you, and how we tell Stripe to cancel when you delete your account.	Until you delete your account. Deleting it cancels the subscription and deletes your customer record at Stripe before anything of ours is removed (Section 7). What Stripe itself keeps afterwards is in Paying for a plan below.
Plan ratings — only if you tap Happy, Meh or Disappointed under a finished plan	To keep one rating per plan from each browser, which you can change, and to count how plans land: how many were rated each way each week, and what the plans rated Disappointed had in common (Ratings and messages).	The rating, the plan it rates, which page you rated it on, your browser identifier, your account if you were signed in, and when it was made and last changed. Deleted 24 months after it was made. If you delete your account first, your account and browser identifier are removed from it at that moment, and the rest is kept without any identifier until then.
Messages you send us through ZipAisle — a note after rating a plan, or a message from the Contact page	To read it and answer it, and to count what people write to us about. Every message is also forwarded to the mailbox we answer from (Ratings and messages). A reply address you type is used only to answer that message and, for a privacy request, to confirm the request is yours.	What you wrote, the topic you chose, the rating and plan it is about if any, the page it came from, your account if you were signed in, the reply address you gave if you were not, and when it was received and forwarded. What you wrote and the reply address are erased 90 days after we receive them, or at once if you delete your account, which also removes your account from the rest; the rest is deleted 24 months after it was sent. The copy in our mailbox is kept as Ratings and messages says.

How long we keep run records. Several things delete themselves: a saved plan and the address attached to it, at the end of the plan's period in the table above; a sign-in link after ten minutes, and its record a day later; the list that travels with a sign-in link, with that link; and a session after 30 days unused, or 180 days regardless.

The rest — the run record holding your zip code and list, the technical details of that request including your IP address and browser user-agent, and the row for your browser identifier — is kept for as long as your account exists. We keep those while they are useful for operating the service and working out why a lookup failed or a store came back empty.

Runs made while not signed in. A run made while nobody was signed in — on a browser that has never been signed in on, or on one after signing out — has no account to end, so the sentence above does not reach it. Those records — including the IP address and user-agent kept with each one — are kept for 24 months from the day the run was made, and then deleted; the row for the identifier of a browser nobody has signed in on is deleted with the last of them. If you are the first to sign in on the browser before then, its runs become your runs from that moment and are kept for as long as your account exists, as described below. There is no account to delete, so if you want a run of yours removed sooner, write to us with roughly when you made it and we will find it and delete it.

What accounts change about that. These records were always kept; what is different is who they belong to. Before accounts, a run record was attached to a browser identifier and we had no way to connect it to a person. Once you sign in, every run you make while signed in, and the runs a browser made before you were the first to sign in on it — including the IP address and user-agent kept with each one — are attached to your account and are information about you. We do not use them to build a profile of you, we do not sell them, and we do not share them for anyone else's advertising. What we do not do is pretend they are anonymous.

What deletion does to them. When you delete your account we cut the link between you and the records of the price checks you ran, rather than deleting the records themselves. Your browser identifier, IP address and user-agent are removed from each run record at that moment, and so is anything that leads back to your account. What remains — the zip code, the item names, the prices we read at each store and when, whether each was found, and which stores were skipped — is kept without any identifier for up to 24 months for service analytics: how many searches a week people actually make, how often a price could be served from an earlier reading, what a real list looks like. Then it is deleted. It is the same information a plan link already shows to whoever holds it, and it can no longer be tied to you (Section 7). You can also write to us at any time and ask us to delete records outright, with or without deleting the account.

Clearing site data for zipaisle.com is a weaker tool and we would rather be exact about it: it signs you out of that browser and replaces the identifier, and nothing else. The runs already recorded remain, still attached to your account if you were signed in when you made them. If you want them cut loose from you rather than unlabelled, delete your account or ask us.

What our mail provider keeps, which we cannot shorten. The messages ZipAisle sends — a sign-in link, the plan notification if you asked for one, and the Wednesday watch-list email — go out through an email delivery provider acting on our instructions. That provider keeps a record of each message for 30 days, including the address it was sent to and the contents of the message, and offers us no way to shorten that window or to delete a message ourselves. For the Wednesday watch-list email, the contents include the stores it compared, by chain and street address — which says roughly where you shop — and the provider holds that for the same 30 days. That window is theirs, not ours: our own copy of a notification address goes when the plan it belongs to goes, which on the Free plan is sooner than 30 days, and it is not something we can fix by changing our own code, so we say it here rather than leave our own number standing alone.

It also carries every message you send us through ZipAisle to the mailbox we answer from, with what you wrote, the address our answer should go to and, if you were signed in, your account number, and keeps that record for the same 30 days (Ratings and messages).

If you want a specific message erased inside that window, write to hello@zipaisle.com and we will ask the provider to remove it.

Paying for a plan. Plus and Pro are paid through Stripe, our payment processor, on a checkout page and in a billing portal that Stripe runs. ZipAisle has no payment form of its own: your card number is typed into Stripe's page, sent to Stripe, and never reaches our servers — not in a request, not in a log, not in our database.

What Stripe receives. When you start a checkout we send Stripe your email address, so it can label the payment and send you a receipt, and an account number of ours so the payment can be matched back to your account. On its page Stripe asks you for a card, a name and a billing address; the address is what the sales tax is worked out from and where you are billed. Stripe keeps those and uses them to charge your card, to compute and report sales tax, to detect fraud, and for whatever payment and tax law requires of it. It handles them under Stripe's own privacy policy, as a business that is itself responsible for the card data it holds; it is not a subcontractor we instruct in the way our hosting or mail providers are.

What we get back. Stripe tells us which plan you bought, the date it renews, whether you have cancelled it, and whether a payment has failed — and we store exactly those, with Stripe's reference number for you (the row in the table above). Stripe's messages to us also carry your name and billing address, because that is how Stripe writes them; we do not store them and we do not write them to our logs.

Cancelling, switching plans and changing your card happen in Stripe's billing portal, opened from your account page. What you do there is between you and Stripe until Stripe tells us the result.

If you delete your account we cancel your subscription and delete your customer record at Stripe before we remove anything of ours. Stripe still keeps its records of the payments you made — invoices, receipts and the tax collected on them — for as long as payment and tax law require it to. Those are Stripe's records, and neither we nor Stripe can shorten that.

The watch list, and the Wednesday email. Your account keeps a watch list: up to 15 item names you have checked or chosen to watch, each with the zip codes it is checked in, which of them you have chosen to be shown, and which you have pinned. It is kept while your account exists and deleted with it, and you can remove any item, or all of them, on your watch list page.

Once a week, on Wednesday morning, the service checks those items at the stores in their zip codes and keeps the result as a saved plan (the saved plans row above says for how long). From your second weekly check, it sends your account one email with the results and a link to that plan, until you stop it. Stopping it is one click: the link at the foot of every such email, which needs no sign-in, or the switch on your watch list page. It stops the email only — the weekly check continues, so your watch list page and the card on the home page stay current.

The week's lowest price for an item at the stores in a zip code, with no account attached — the cheapest store's price that week, and which stores answered — is kept so the next week's email can compare against it. It holds no account, email address, IP address or run: a zip code, an item name, a week and a store. It is kept for 24 months and then deleted; deleting an account does not remove it sooner.

We do not track whether you open the email — no tracking pixel, no open or read receipts. A Free account that has not been signed in to, and whose watch list has not been opened, for 3 weeks is paused: nothing is checked or sent for it until you sign in or open the list again.

Ratings and messages you send us. Under a finished plan — on the results page, and on a saved plan, including one someone shared with you — you can tap Happy, Meh or Disappointed, and add a note if you like. You can also write to us from the Contact page. Both work whether or not you are signed in, and you never have to do either.

A rating is kept with the plan it rates, together with your browser identifier, so that each browser has one rating per plan and can change it, and with your account if you were signed in. A rating made while you were signed out becomes yours, as that browser’s runs do, if you are the first to sign in on it (How long we keep run records). We read ratings as counts: how many plans were rated each way each week, and what the plans rated Disappointed had in common, such as how many stores answered, whether one was skipped, and how long the check took. A rating is deleted 24 months after it was made. If you delete your account before then, your account and browser identifier are removed from every rating made while you were signed in or from a browser attached to your account, and the rest is kept without any identifier until then.

A message — a note after a rating, or a message from the Contact page — is kept with the topic you chose, the rating and plan it is about, if any, the page it came from, and your account if you were signed in. If you were not, you can give us an email address for our answer: it is optional with a note and required on the Contact page. That address is used only to answer that message and, for a privacy request, to confirm the request is yours (Section 7); it does not create an account and is not added to any list. We send no confirmation email; the page shows you a reference instead.

Where a message goes. Every message is forwarded by our email delivery provider to the mailbox we answer from, with the reply address you gave — or your account’s address, if you were signed in — set as the address our answer goes to, and with your account number if you were signed in. We read each message there, with the plan it names, and answer it from there. So what you wrote, and that address, are in the provider’s 30-day record (what our mail provider keeps) and in our mailbox, which other providers receive and host (Section 5).

How long a message is kept. What you wrote and the reply address you gave are erased from our database 90 days after we receive them, or at once if you delete your account. The rest of the record — its kind, topic, rating, page and plan, without what you wrote — is kept so we can count what people write to us about, and deleted 24 months after it was sent; deleting your account removes your account from it. The forwarded copy, and our answer, are deleted from our mailbox 90 days after we receive the message or, if what you asked is not finished by then, once it is; deleted mail stays in the mailbox’s trash for up to 30 days more. A message sent while you were signed out belongs to no account, so deleting an account does not reach it; write to us and we will erase it sooner.

Limits. So that the form cannot be used to flood our mailbox, how often one browser, network or account can rate plans and send messages is limited by the short-lived counters described under Technical request details above.

Please do not type personal information into item names. The item field is a grocery list, not a notes field. Anything you put there is stored with the run and travels with any plan link you share.

Please leave out personal details in a message to us, too: health or financial details, card or account numbers, passwords, and anything about anyone else. We need none of them to read a rating or answer you, and a privacy request needs only what Section 7 asks for. What you write is read by us, forwarded to the mailbox we answer from, and kept as Ratings and messages says.

What we do not collect

No password, ever — there is nothing to store, nothing to reset, and nothing to breach.
No name, postal address, phone number, or date of birth — we never ask for one, and no form on ZipAisle has a place for one. What you choose to write in a message to us is kept as Ratings and messages says. Stripe's checkout page asks for a name and a billing address when you buy a plan; those are held by Stripe, and we store neither (Paying for a plan).
No card numbers, ever. A plan is paid for on Stripe's page, and the number never reaches us.
No credentials for any retailer, ever. ZipAisle does not sign in anywhere on your behalf (Terms 3.3). Your ZipAisle account is the only account involved in any of this.
No advertising or cross-site tracking cookies, and no third-party analytics or advertising trackers.
No precise location history. A single approximate position, if you offer one, is turned into a zip code and discarded.

4. Cookies and local storage

ZipAisle sets one cookie, and it does not use advertising or tracking cookies of any kind.

pp_sess — the sign-in cookie described in Section 3. It is set only when you confirm a sign-in link, never before, and it exists only to keep you signed in. It is marked HttpOnly (script on the page cannot read it), Secure (it travels only over an encrypted connection), and SameSite=Lax (another site cannot cause it to be sent). It carries no information about you in itself — it is a random value that means something only to our own server.

Why there is no cookie banner. A consent banner exists to ask about cookies that are not necessary for the thing you asked for — analytics, advertising, and cross-site tracking. ZipAisle sets none of those. The one cookie it sets is strictly necessary for a feature you have explicitly requested by signing in, it is set at the moment you sign in and not before, and it is exactly the kind of cookie that consent rules exempt. Asking you to consent to it would be theatre: refusing would mean not being signed in, which is the same as not signing in. If we ever add a cookie that is not strictly necessary, we will ask first, and this paragraph will change.

ZipAisle also uses your browser's own local storage, which stays on your device and is never sent anywhere except as part of a request you make:

pp.zips, pp.zip and pp.list — the zip codes your next check covers (pp.zip is the first of them) and your list, so the pages of the wizard can hand them to each other.
pp.client_id — the random browser identifier described above.
pp.notify — whether you ticked “email me the results” for the check you are starting, so the results page knows to arrange it. It is replaced each time you start a check.
pp.auth_pending — the time you last asked this browser for a sign-in link that carried your list, and a random code made for that request, so that the page the link opens can tell whether you opened it in the same browser and, if so, start your check by itself. The code is sent to us with the request and again when you open the link here. We keep only a one-way fingerprint of it, with the list, and delete it with the list. It holds no email address. It is removed when you use the link in this browser; otherwise it stays until you ask for another link that carries a list, or clear site data. Earlier versions of the site also kept the address you asked at under this key, in your own browser; the next ZipAisle page you open removes it.
pp.signin_join — set when a sign-in link that carried your list takes you straight to your results, so the results page can say once that it picked up where you left off. It holds the number of items and the zip code, and the results page removes it after saying so.
pp.linked_runs — set when signing in attaches this browser's earlier price checks to your account (Section 3): how many there were, and your address in shortened form, so the results page can tell you once. It is removed once the results page has told you, or when you sign out.

Signing out clears the cookie. Deleting your account clears the cookie and the local storage above from the browser you did it in. Clearing site data for zipaisle.com removes all of it at any time.

5. Who else sees any of this

We do not sell your information, we do not rent it, and we do not share it for anyone else's advertising. It is disclosed only to:

Service providers we use to run ZipAisle — hosting, the database and cache, email delivery for sign-in links, for the plan notification you ask for, for the Wednesday watch-list email and for carrying each message you send us through ZipAisle to our own mailbox, the machine-learning inference providers that read prices off store pages, and a network provider that carries ZipAisle's visits, including those made on your errands, to the retailer sites named on the How ZipAisle works page. Each acts on our instructions and for this purpose only. Item names are sent to an inference provider as part of matching products to your list; zip codes, email addresses and identifiers are not. The network provider carries an encrypted connection to the retailer's site and is sent nothing about you: it can see which site was visited, when and how much data, but not the page, your list or what was searched for, and the addresses we rent from it are its own, not yours. What our email provider retains, and for how long, is set out in what our mail provider keeps above.
The providers that receive and host the mailbox we answer from — for everything you write to us, by email or through ZipAisle, and our answers. They are sent nothing else from ZipAisle. How long a message sent through ZipAisle stays in that mailbox is in Ratings and messages.
Stripe, our payment processor, if you buy a plan — it receives your email address and an account number from us, and your card, name and billing address from you, on its own page. It is the one recipient on this list that decides for itself how to handle what it holds, because it is the one holding card data and collecting tax; Paying for a plan above says exactly what goes each way.
Anyone you give a plan link to. A saved plan link is unlisted but not secret: whoever holds it can open the plan, including the zip code and the list it was built from, without signing in. It does not show your email address and it does not give anyone access to your account. Share it only with people you mean to.
Authorities, where we are legally required to, and only to the extent required.
A successor, if the service is ever transferred as part of a merger, acquisition, or sale of assets — under terms no less protective than this policy.

The retailers get nothing. ZipAisle reads public pages; it does not submit your name, email, list, or any other detail of yours to any store (Terms 3.3(d)). A store cannot tell from our visit who asked for the price, and the existence of your account changes nothing about what a retailer sees.

6. Prices are shared between shoppers — your list is not

When ZipAisle reads a shelf price, it keeps that price for a limited period and may show it to another shopper asking about the same item at the same store, instead of visiting the retailer again (Terms 4.4). What is reused is the store's public price, which is not information about you. Your zip code, your list, your account and your email are not shared with other shoppers, and nothing about who asked is stored alongside a cached price.

This is also why deleting your account does not touch the price cache: there is nothing of yours in it to delete, and clearing it would cost every other shopper a week of readings for no one's benefit.

We also keep a history of the prices we read at each store, by item and week. It records what a store's page showed for an item the first time the service read it that week, and it contains no information about who searched — no account, no browser identifier, no zip code, no list. It is a record of a store's shelf, not of a person, so it is kept indefinitely and deletion of an account does not touch it. The week's lowest prices behind the watch list's email are not kept this way: they are deleted after 24 months (The watch list).

7. Your choices and rights

Deleting your account

You can delete your account yourself, whenever you like, from your account page. You do not have to write to us, give a reason, or wait. It is immediate and it cannot be undone.

If you have a paid plan, it is cancelled first. Before anything of ours is removed we tell Stripe to cancel your subscription and delete your customer record there, so a deleted account can never be charged again. If Stripe cannot be reached, nothing is deleted, the page says so, and you stay signed in to try again.

What deletion removes:

your account, including your email address, the dates it records, and your plan and billing reference;
from every price check you ran while signed in, and every one run from a browser attached to your account: your browser identifier, IP address and user-agent, and every link from the record back to you;
the rows for those browsers themselves;
every sign-in link ever issued to your address, used or outstanding, and any list travelling with one;
every session, on every device, so you are signed out everywhere at once;
every plan you saved, including any address attached to one for a notification — which means the links to those plans stop working straight away rather than lasting out their period;
your watch list: its items, their zip codes, your choices about them, its dates, and the plan it recorded;
from every plan rating made while you were signed in, or from a browser attached to your account: your account and that browser identifier; and from every message you sent us through ZipAisle while signed in: what you wrote, and your account;
the stores you have chosen to skip; and
your account from the list of people who asked to hear when a plan goes on sale, if you had joined it.

What deletion keeps without your name on it: the records of the price checks you ran — the zip code, the items, the prices we read at each store and when, whether each was found, and which stores were skipped — with every identifier removed, for up to 24 months, and then deleted (How long we keep run records). If you would rather they were deleted outright, write to us and we will do it.

Ratings and messages are kept the same way: each rating, the plan it rated and when; and each message’s kind, topic, rating, page and plan, without what you wrote — without any identifier, until 24 months after each was made, and then deleted (Ratings and messages).

What deletion does not remove, and we would rather say so than let you assume otherwise:

Shelf prices we read, and the price history. They are keyed by store and item and hold nothing about who asked (Section 6).
Stripe's records of your payments. Invoices, receipts and the tax collected on them stay with Stripe for as long as payment and tax law require (Paying for a plan).
Messages already sent. Mail already delivered is in your inbox, and our email provider's 30-day record of it is described in what our mail provider keeps above. Ask us and we will request its erasure.
Messages you sent us, in our mailbox. The forwarded copy of a message you sent through ZipAisle, and our answer, stay in the mailbox we answer from for the period in Ratings and messages, and in our email provider’s 30-day record. Ask us and we will delete them sooner. A message sent while you were signed out belongs to no account, so deleting yours does not reach it.
A record that an operator acted on an account. If we ever end an account's sessions at its owner's request, we keep a note of having done it. That note holds an account number and what was done, never an email address, and it deliberately outlives the account — being able to say what we did is the point of it.
Backups and legal holds. Where a copy survives in a backup, or we are required to retain something, it is deleted on the ordinary cycle or when the requirement ends.

Stopping the Wednesday email

One click on the link at the foot of any Wednesday watch-list email, or the switch on your watch list page. It needs no sign-in and takes effect at once. It stops the email only; to stop the weekly check as well, remove the items from your watch list, or delete your account.

Signing out

Your account page offers two things: sign out of this device, and sign out of every device at once. The second ends every session everywhere, including the one you are using. If you ever believe someone else has access to your account, that is the button, and you can also write to us and we will end every session for you.

Everything else

Look around without signing in. Entering a zip code and building a list needs no account (Section 2).
Don't share location. Type a zip code instead; the service works identically.
Don't ask for the results email. The “email me the results” box is unticked by default and skipping it costs you nothing but the email.
Clear what's on your device at any time by clearing site data for zipaisle.com.
Ask us for a copy, a correction, or deletion. Choose “A privacy request” on the Contact page, or write to hello@zipaisle.com. A request sent from the Contact page while you are signed in is tied to your account, and we act on it as yours. If you send one while you are signed out, we first email the address you gave us to confirm the request is yours, and act on it once you answer. If you write from the address your account uses, we can find your records from that address alone. If you never made an account, tell us enough to find the records — typically the approximate time of a run and the zip code used, or a plan link.
State privacy rights. Depending on where you live you may have rights to access, correct, delete, or limit the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising any right.

8. Security

Traffic to and from ZipAisle is encrypted in transit. Access to the operational database is limited to the people who run the service. Sign-in links are single-use and last ten minutes, and we store only a one-way fingerprint of each one, so our own records cannot be used to sign in as you. The sign-in cookie is a random value of no meaning outside our server, and it can be revoked — by you, from any device — because the record it points at lives with us rather than in the cookie itself. We do not put email addresses, sign-in links, session values or billing details into our logs, and card numbers never reach us at all.

No system is perfectly secure, and we do not claim otherwise; keeping the amount we hold small is still the main protection here, and it is still deliberate.

9. Children

ZipAisle is intended for adults planning household shopping, and accounts are for people 18 or over. It is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided information to us, write to hello@zipaisle.com and we will delete it.

10. Where information is handled

ZipAisle is operated from the United States, and information is processed there by us and by the service providers listed in Section 5. If you use the service from elsewhere, you are sending information to the United States.

11. Changes to this policy

We may update this policy. If a change is material we will post the updated policy with a new effective date. Continued use after that date means you accept the updated policy.

12. Contact

Vykka LLC, a Washington limited liability company. Privacy questions and requests: the Contact page, or hello@zipaisle.com. Retailer enquiries, including asking us to stop visiting your site, are covered on the How ZipAisle works page.