← Back

Legal

Privacy Policy

Last updated: 2026-05-30

Part 1

Ostosapu (web app)

What Ostosapu does

Ostosapu turns a free-form meal or shopping idea into a structured K-Ruoka shopping list. When you are ready, Ostosapu hands that list to the K-Ruoka Cart Filler Chrome extension, which fills your K-Ruoka cart in your own browser session. You review the cart and complete checkout yourself on k-ruoka.fi — Ostosapu never handles payment or your K-Ruoka credentials.

Data we collect

  • Account. Your email address and authentication information. If you sign in with Google, we also receive your Google account email and basic profile fields exposed by Google sign-in.
  • Household profile. Household size and any free-text notes or dietary preferences you choose to enter.
  • Shopping lists. The lists you generate or edit in the app, including item names, quantities, and any notes.
  • Fill-run results. The summary returned by the Chrome extension after a fill run — which items were added, substituted, not found, or flagged for review.

We do not collect payment information and we do not have access to your K-Ruoka account or session.

How we use your data

  • To generate shopping lists tailored to your household profile.
  • To let you review, edit, lock, and re-run lists over time.
  • To show your past runs in the History view.
  • To authenticate you and keep your data scoped to your account.

We do not sell your data, we do not share it with advertisers, and we do not use it to train AI models.

AI processing

When you ask Ostosapu to generate a shopping list, the text you provide together with your household profile is sent to an AI model via the Lovable AI Gateway to produce a structured list. We do not send your email or other identifying account information to the model. The model's output is returned to the app and stored against your account so you can edit it.

Where your data is stored

Account, profile, list, and fill-run data are stored in our managed backend (Lovable Cloud, which runs on Supabase). Access is enforced server-side with row-level security so that each authenticated user can only read and write their own rows.

Administrative access

A small number of designated administrator accounts can view a list of all users and the shopping lists associated with each user, for support and abuse-prevention purposes. Administrators cannot see your password and do not place orders on your behalf.

Retention and deletion

Your lists and fill-run history are kept until you delete them or request account deletion. To delete your account and associated data, contact us using the details below.

Cookies and local storage

Ostosapu stores an authentication session in your browser's local storage so you stay signed in between visits. It also stores a local preference flag for the in-app developer mode toggle. Ostosapu does not use third-party advertising or analytics cookies.

Children

Ostosapu is intended for adults managing their own grocery shopping and is not directed at children under 13.

Contact

Questions about this policy, or requests to access or delete your data, can be sent to the maintainer of this deployment, or opened as an issue in the project repository.

Part 2

K-Ruoka Cart Filler (Chrome extension)

Last updated: 2026-05-30

What this extension does

K-Ruoka Cart Filler is a Chrome extension that automates filling a K-Ruoka online grocery cart from a structured shopping list. The extension performs searches on k-ruoka.fi, reads product titles from search results, and uses an AI model to select the best match for each item. The user reviews the filled cart and completes checkout themselves — the extension never handles payment.

Data we collect

We do not collect any data.

The extension has no cloud server, no analytics, no telemetry, and no backend of its own. All processing happens locally in your browser.

Data stored on your device

The extension stores the following in chrome.storage.local, which is scoped exclusively to this extension and never synced to other devices:

  • Anthropic API key (entered by you) — authenticates requests to the Anthropic API.
  • Preferred Claude model — remembers your model selection across sessions.
  • Action delay settings — remembers your timing preferences across sessions.

You can clear this data at any time by removing the extension or clearing extension storage from chrome://extensions.

Data sent to third parties

Anthropic API (https://api.anthropic.com)

When a fill run is in progress, the extension sends the following to Anthropic's API using your own API key:

  • Shopping list item names and selection criteria (from the list you or your web app provided).
  • Product titles scraped from K-Ruoka search results.

This data is sent solely to determine the best matching product for each item. It is not sent by the extension developer — you are calling Anthropic's API directly with your own key under your own Anthropic account.

Anthropic's handling of this data is governed by Anthropic's Privacy Policy and their API terms of service.

No other external network connections are made. The extension's Content Security Policy explicitly allows only https://api.anthropic.com as a network destination.

Data the extension does not collect

  • Browsing history or activity outside k-ruoka.fi.
  • K-Ruoka account credentials or session data.
  • Payment information.
  • Personal information of any kind.
  • Usage analytics or crash reports.

Permissions used

  • storage — stores your API key and settings locally.
  • sidePanel — displays live progress and lets you start or abort a run.
  • tabs — finds the active K-Ruoka tab and detects page navigation.
  • activeTab — reads from and interacts with the K-Ruoka tab you are viewing.
  • scripting — injects the content script that performs searches and adds items to cart.
  • Host https://www.k-ruoka.fi/* — the extension operates exclusively on the K-Ruoka website.

Changes to this policy

If we change how the extension handles data we will update this document and increment the "Last updated" date. Material changes will also be noted in the extension's changelog.

Contact

If you have questions about this privacy policy, please open an issue in the project repository.