Sprout LegalIn short: Sprout stores your account and the lists you create so they can sync between the people you share them with. We don't sell your data and we don't use analytics or crash trackers. The free version shows ads from Google, which uses device information to choose them. Sprout Plus has no ads. You can delete your account and data at any time.
Who we are
Sprout is published by Adrian Lara Guzman, an individual developer in California, USA, doing business as Mikrodev ("we", "us"). We are responsible for your personal data in Sprout. You can reach us at support-sprout@mikrodev.net.
This policy covers the Sprout apps for iPhone and Android and the websites sprout-support.mikrodev.net and sprout-legal.mikrodev.net. The websites don't use cookies, analytics or trackers.
What we collect
Information you give us
- Account: your email address, a password (stored only in scrambled, hashed form by our hosting provider) and the name you choose to show other people.
- Your lists: the items, notes, categories and stores you add, whether items are on the list or ticked, who added each item, and how often an item is added (used to suggest items).
- Sharing: which lists you own or have joined, and your family plan membership if you have one.
- Templates: when you share a template, we store a copy of the list's shopping items, categories and stores, plus your name as the sender.
- Support and feedback: anything you send us by email or through the in-app feedback form (a Google Form), such as your message, screenshots, app version and phone type.
Sprout Plus purchases
If you buy Sprout Plus on the web, payment is handled by Stripe. We give Stripe your name, email address and Sprout account ID, and Stripe collects your card details directly. We never see or store your card number. We receive and store your plan, its status and dates, and your Stripe customer and subscription IDs. If you buy through the App Store or Google Play, Apple or Google handles the payment under their own privacy policies. We use RevenueCat to check those purchases: it receives your Sprout account ID and the store's purchase receipts, and tells us which plan you have and when it renews. We never receive your Apple or Google payment details.
Information collected automatically
- Bot protection: when you sign up, sign in or reset your password, Cloudflare Turnstile checks that you're a person. It processes your IP address and technical signals from your device and browser.
- Ads (free version only): Google AdMob collects your device's advertising ID (on iPhone only if you allow tracking), IP address, approximate location derived from it, device and app information, and how you interact with ads. See Ads and tracking.
- Security logs: when someone enters a wrong invite code, we record the account and time to stop code guessing.
- Server logs: our hosting provider keeps standard technical logs (such as IP address and request time) for a short period to run and protect the service.
What we don't collect
Sprout has no analytics or crash-reporting tools and doesn't access your precise location, contacts or photos. The camera is used only to scan QR codes. The camera image is processed on your phone and never sent to us.
Stored on your phone
Sprout keeps a copy of your lists and settings on your phone so it works offline. This stays on the device and is cleared when you sign out or delete your account.
How we use it
| Purpose | Data used | Legal basis (where the law asks for one) |
|---|---|---|
| Run your account and sync your lists between devices and members | Account, lists, sharing, templates | Needed to provide the service you asked for (contract) |
| Send account emails (confirm your email, reset password, email changes) | Email address, name | Contract |
| Sell and manage Sprout Plus | Name, email, account ID, plan and billing records | Contract, and legal obligations (tax, accounting, auto-renewal records) |
| Keep Sprout safe from bots, abuse and code guessing | Turnstile signals, security logs, server logs | Our legitimate interest in protecting users and the service |
| Show ads in the free version | Advertising data collected by Google | Your consent where required (for example, iPhone tracking permission), otherwise legitimate interest in funding a free app |
| Answer support requests and improve Sprout | What you send us | Legitimate interest in helping you and fixing problems |
| Comply with the law and enforce our terms | Any of the above, as needed | Legal obligation, legitimate interest |
We don't use your data to build profiles for our own marketing, and we don't sell it.
Who sees or handles your data
People you share with
- List members see the list's items, notes, categories and stores, and the names of the other members.
- Family plan members see each other's names.
- Anyone with a template code can see that template's items and your name as the sender. Template codes don't expire, so only share them with people you trust. Delete a template to stop its code working.
Service providers
These companies process data for us to run Sprout. We require them to protect your data with the same or equal protection as described in this policy.
| Provider | What they do | Data |
|---|---|---|
| Supabase | Database, sign-in and hosting (United States) | Account, lists, sharing, templates, billing records, logs |
| Stripe | Web payments for Sprout Plus | Name, email, account ID, payment details |
| RevenueCat | Checks App Store and Google Play subscriptions | Account ID, purchase receipts, plan and renewal dates |
| Resend | Sends account emails | Email address, name, email content |
| Cloudflare | Bot protection (Turnstile), domain and email forwarding | IP address, device and browser signals, support emails |
| Ads in the free version (AdMob); feedback form (Google Forms) | Advertising data; what you type in the form | |
| Apple, Google Play | App distribution and, where offered, in-app purchases | As described in their own policies |
Other cases
We may disclose data if the law requires it, to protect the rights and safety of users or others, or as part of a sale or transfer of Sprout, in which case this policy continues to apply to your data.
Ads and tracking
The free version of Sprout shows a small banner ad from Google AdMob. Google, as a third party, may collect information about your activity over time and across different apps and websites when you use the free version, and may use it to show ads based on your interests. Learn how Google uses this data at How Google uses information from sites or apps that use its services.
- iPhone: Sprout can only use your device's advertising identifier if you allow tracking when iOS asks. You can change this anytime in Settings, Privacy & Security, Tracking.
- Android: you can reset or delete your advertising ID in your phone's Settings, under Google, Ads (or Privacy, Ads).
- No ads at all: Sprout Plus removes ads. Sprout doesn't request ads for Plus members.
Do Not Track: Sprout does not respond to "Do Not Track" browser signals. You can limit ad personalization with the device settings above.
How long we keep data
| Data | Kept for |
|---|---|
| Account, lists and templates | Until you delete them or your account. Notes on items clear after each shopping trip. |
| Invite and family codes | 24 hours, then they stop working |
| Wrong invite code attempts | 1 day |
| Billing records (account ID, email, plan, dates, payment references) | 7 years after the purchase or subscription ends, for tax, accounting, disputes and California auto-renewal records |
| Support emails and feedback forms | Until the issue is resolved, and no longer than 2 years |
| Backups | Deleted within 90 days |
Data held by Stripe, Apple, Google and our other providers is also subject to their own retention rules.
Your choices and rights
- See and edit: your lists are always visible in the app. Change your name, email or password under Account in the app.
- Delete: delete items, lists and templates anytime, or delete your whole account in the app (Account, Delete account). You can also ask us by email. Deleting your account cancels a Sprout Plus subscription bought on the web. App Store and Google Play subscriptions must be cancelled in your Apple or Google account.
- Get a copy: email us and we'll send you a copy of your personal data.
- Object or withdraw consent: use the ad settings above, or email us.
We answer requests within 30 days (45 days where a state law allows it). We may need to confirm the request came from your account's email address. We won't treat you differently for using your rights.
Children
Sprout is a general-audience app and is not directed to children under 13. We do not knowingly collect personal information from children under 13 (or under the minimum age in your country). If we learn that we have, we will delete it. Parents or guardians who believe their child has an account can contact support-sprout@mikrodev.net.
Some app stores may give us an age range for your account. If they do, we use it only to give an age-appropriate experience and to comply with the law.
Where data is stored
Sprout's data is stored and processed in the United States. If you use Sprout from another country, your data is transferred to the US. Where the law requires it, we rely on safeguards such as our providers' standard contractual clauses and the EU-US Data Privacy Framework.
Security
Data is encrypted in transit (HTTPS). Database rules make sure only members of a list can read or change it. Passwords are stored hashed, and card details never reach our systems. No system is perfectly secure, so please use a password you don't use elsewhere.
State and country notes
California and other US states
We don't sell personal information and don't share it for money. Google's use of advertising data in the free version may count as "sharing" for targeted advertising under some state laws. You can opt out using the ad settings described above, or by using Sprout Plus. California residents may ask what personal information we collected in the past 12 months, and ask us to correct or delete it, by emailing us. You may use an authorized agent.
Mexico
You can exercise your rights of access, rectification, cancellation and opposition (ARCO rights) and revoke consent by emailing support-sprout@mikrodev.net with your name, the email on your account, and what you are asking for. We will reply within 20 business days.
European Economic Area, United Kingdom and Switzerland
If these laws apply to you, you have the right to access, correct, delete, restrict or move your data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can also complain to your local data protection authority.
Changes to this policy
If we change this policy, we'll update the effective date at the top. For important changes, we'll tell you in the app or by email before they take effect.
Contact
Adrian Lara Guzman (Mikrodev), California, USA
Email: support-sprout@mikrodev.net
Last updated: September 22, 2026