Privacy Policy
Effective August 10, 2026
Ingredient Checker (“Iggy”) is operated by Grove Hill Research. This policy explains what we collect, why, who we share it with, and how to get it deleted. It covers the website at ingredientchecker.app, the SMS assistant, and the Ingredient Checker app in ChatGPT.
What we collect
Ingredient reports are public. You can read every report on this site without an account, and we do not require you to identify yourself to do so.
The rest depends on how you use the service:
- Your phone number. The assistant answers by text, so your number is the identifier your account is keyed on. We store it in full.
- Your messages. We store the questions you send and the answers we send back, so the assistant has conversational context and so you can review your history.
- What you looked up. The ingredients and products resolved by your questions, so your history page can list them.
- Account information. If you sign in, our authentication provider handles your email address and credentials. We never see or store your password.
- Payment information. Subscriptions are processed by Stripe. We store a customer identifier and your subscription status. We never receive or store your card number.
- Delivery and cost metadata. Our SMS carriers report whether a message was delivered and what it cost, and we keep that against the message.
- Technical data. IP address and user agent, used to rate limit abuse, plus privacy-preserving product analytics that are not linked to your identity.
Text messages, consent and charges
Texting our number is how you opt in. We send only replies to your questions and service messages such as verification codes — no marketing, and nothing you did not ask for.
Reply STOP at any time to stop messages, or HELP for help. Message and data rates may apply, and message frequency depends on how often you write to us. Carriers are not liable for delayed or undelivered messages.
Verification codes are stored only as a hash, expire within ten minutes, and are single use.
How we use it
To answer your questions, keep conversational context, show your history, run and take payment for subscriptions, prevent abuse, and understand which parts of the product get used. We do not sell your personal information, and we do not share it with advertisers.
Who we share it with
Only the providers needed to run the service, each handling data on our behalf:
- OpenAI — your question is sent to a language model to generate an answer.
- Telnyx and Twilio — sending and receiving text messages.
- Supabase — database hosting.
- Vercel and Railway — application hosting.
- Clerk — sign-in and account management.
- Stripe — payment processing.
- PostHog — product analytics.
We may also disclose information if the law requires it, or to protect our rights or someone's safety.
Retention and deletion
We keep your messages and lookups while your account exists, so your history stays available to you. Verification codes are pruned within 24 hours. Records we need for tax and accounting are kept as long as the law requires.
Email [email protected] from the address on your account, or text us from your number, to get a copy of your data or have it deleted. We will action deletion requests within 30 days.
Your rights
Depending on where you live — including California, Colorado, Connecticut, Virginia and the UK/EEA — you may have the right to access, correct, delete or port your personal information, to opt out of its sale or sharing (we do neither), and to be free from discrimination for exercising those rights.
Use the contact address above to exercise any of them. We will not charge you or degrade the service for asking.
Security
Data is encrypted in transit. Your history is stored in a database that rejects all access except from our backend, which requires a verified session before returning anything. Linking a phone number to an account requires proving control of that number by SMS code, so someone cannot claim your number and read your history.
No service can promise perfect security, and we do not. If we discover a breach affecting your information, we will notify you as required by law.
Children
Ingredient Checker is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
Not medical advice
Ingredient Checker reports what regulators and published research say about an ingredient. It cannot tell you whether something is safe for you specifically. Allergies, medication and pregnancy are conversations for a clinician. See the Terms of Use.
Changes and contact
If we change this policy materially, we will update the effective date above and, where the change is significant, tell you directly.
Questions: [email protected].