Privacy Policy — Homeshelf (집선반)
Effective: [PUBLISH DATE] · Last updated: [PUBLISH DATE]
Homeshelf ("the app") is a phone-first app. The items, spaces and dates you enter are kept on this phone only by default. The exceptions are listed below and explained in the sections that follow.
- Cloud sync and family sharing, if you turn them on — your records are kept on a server and everyone in the same family list can see them (sections 2 and 3, off by default, requires a trial or a subscription).
- Photos are always stored on this phone, and only if cloud sync is on are they also kept in overseas storage so they can reach your family (section 4). If you don't use sync, photos of items and places never leave your phone (receipt reading is point 3 — separate from sync).
- Adding items from a receipt photo — that receipt photo is sent to an AI service abroad (section 4.1). If you don't use this feature, nothing is sent.
- Anonymous usage statistics — numbers only, no identifiers, once a day. On by default; we start sending only after the app has told you once, and you can turn it off in settings (section 6).
- Advertising (Google AdMob) (section 7) and in-app purchases (Google Play) (section 8).
1. What stays on this phone only (the default)
If you don't turn on cloud sync there is no sign-up and no sign-in, and none of the records below are sent to a server.
| Data | Where it lives | Why |
|---|---|---|
| Items (name, category, quantity, unit, notes, where bought, price, warranty) | Local database on the device | Keeping track of what you have |
| Spaces (rooms, furniture, compartments and their names) | Local database on the device | Recording where things are |
| Dates (use-by, best-before, after-opening, and whether it's "roughly") | Local database on the device | Date reminders |
| Movements (added, used up, moved, deleted) | Local database on the device | Showing history |
| Photos (if you take or choose any) | Device storage (app-private) | Checking items and places |
| App settings (reminder time, "running out" threshold, quiet hours, large text, theme, anonymous statistics on/off) | Local storage on the device | How the app behaves |
- We do not ask for identifying information such as your name, email or phone number.
- Deleting the app deletes these records too. You can export them yourself to a backup file (Settings › Back up & restore).
2. Cloud sync (optional · off by default)
It only runs if you turn it on yourself. It exists so that ① your records survive a new phone or a reinstall, and ② a family can share one list (section 3).
2.1 Account
- A Google sign-in is required. When you sign in we receive your email address and account display name, and use them only to identify and recover your account.
- The sign-in screen is provided by Google; the app never receives or stores your password.
- Before signing in we check that you are 14 or older. People under 14 cannot use cloud sync or family sharing (everything else works without signing in). The check happens right before sign-in; features that stay on the device involve no account and no collection, so age does not matter for them.
2.2 What is kept on the server
| Data | Note |
|---|---|
| The items, spaces, dates and movements from section 1 (photo files excluded — section 4) | Synced. This includes notes and shop names you wrote yourself |
| Photo records (which box or item a photo belongs to · storage key · width and height · size) | The photo file itself lives in R2 (section 4); the server keeps only this record |
| Pin coordinates on a photo (the point in the photo where the item is) | So family and your other devices see the same spot. This is a point inside a photo, not your phone's location |
| Family list identifier · member role (owner/member) · display name within the family | Section 3 |
| Account identifier · device identifier · time of change · which member changed it | To tell which device and which person made a change |
| Email address · account display name | Section 2.1 |
- App settings (reminders, theme and so on) are per-device values and are not kept on the server.
2.3 Where it is kept (processing on our behalf)
- Storage and authentication: Supabase (AWS Seoul region, ap-northeast-2). This is processing on our behalf to run the app, not a sale or a disclosure.
- Traffic is encrypted with HTTPS.
3. Family sharing
- An invite link or code created by the owner or a member (8 characters · one use within 7 days · the sender can cancel it) lets someone join the same family list. One account belongs to exactly one family list. A family can have up to 6 people.
- Everyone in the same family list sees everything in it: items, spaces, dates, notes, photos and the pins on those photos, plus who added or changed what (the display name within the family). Members do not see each other's email addresses.
- Display name within the family: it starts as the first part of your Google account display name and you can change it any time on the Family screen.
- When you join: you choose whether to ① merge the records already on your phone into the family list (everyone then sees them) or ② save your records to a backup file on this phone and take the family list instead.
- When you leave: a copy of the list as it stands stays on your phone (photos: only the ones on this phone — those you took, plus any family photos already downloaded here). The records you put into the family list remain there as the family's shared records, and your name on changes becomes "{display name} (left)" (or "Removed family member" if you delete your account). [OWNER DECISION: whether someone who has left or deleted their account may ask for their records to be removed from the family list]
- The owner must hand the role to someone else before leaving if there are other members; if the owner deletes their account it passes to whoever joined first. The subscription stays with the family list, and billing continues on the subscriber's Google Play account (cancel it on Play — section 8.4).
4. Photos
- Photos are always stored on this phone. Even if they can't be uploaded, viewing photos and showing locations keeps working. When you pick a photo we use the system photo picker, so we never ask for photo access permission.
- Before uploading we shrink the image and strip EXIF data such as where it was taken. Shelf and storage photos are reduced to 1024px on the long edge, item photos to 640px. Thumbnails are not stored separately; the receiving device makes them.
- If cloud sync is on, the reduced photo file is kept in Cloudflare R2 so it can reach your family members' devices.
- Photos uploaded by family are downloaded to this phone one at a time, when you look at them (never in bulk).
- Transfers use any network by default. To save mobile data, turn on Settings › Data › "Sync photos on Wi-Fi only" — it limits both uploads and downloads to Wi-Fi (including Ethernet), and treats connections of unknown type (VPNs and the like) as metered, so they wait. Because data plans differ from phone to phone this is a per-device setting and is not kept on the server (section 2.2).
- Each family list has 10MB of photo space, and more can be added with a subscription (section 8). When it is full, new photos are kept on this phone only and not uploaded — the app keeps working normally.
- You can place a "it's here" pin on a storage photo. With sync on, that pin's coordinates travel to your family along with the photo. The coordinates are a point inside the photo, not your phone's location.
- Backup files do not include photos by default. If you choose "Include photos" when creating a backup, the photo files are packed in too (we show you how much larger it gets before you choose); if you don't, the backup contains only the record of which box and spot each photo belonged to.
- The safety copy the app makes automatically just before erasing everything does not contain photos, because that action clears records only and leaves the photo files on this phone.
- Transfer abroad: photos are transferred to storage operated by Cloudflare, Inc. (United States) (Cloudflare R2).
- Recipient: Cloudflare, Inc. (United States)
- What is transferred: the reduced photo files and their identifiers
- When and how: when you save a photo while cloud sync is on, over an encrypted connection (HTTPS)
- Purpose: to deliver photos to your family members and your other devices
- Where it is stored: we have requested the Asia-Pacific region, but the storage service does not guarantee a region. Photos may therefore be stored outside the Republic of Korea.
- How long: the same as section 8 (destroyed together with the synced records).
- How to refuse: if you don't use photos, or turn cloud sync off, no transfer abroad happens. Photos still stay on this phone and the app still works.
4.1 Adding items from a receipt photo (AI reading)
Photograph a receipt or a note and we read the items and quantities from it to build a list for you. It runs only when you use it.
- What we send: the photo itself, as you took or chose it. Before sending we shrink it (1,600px on the long edge) and strip EXIF data such as where it was taken. If the receipt is long and you take several photos, they all go together.
- Where it goes: the API of the AI service Anthropic, PBC (United States). It passes through a relay server we operate (a Cloudflare Worker).
- Signing in is required (a cloud account). Without signing in the feature does not run, and you can type item names yourself.
- Daily limit: 3 photos a day when signed in, 20 a day for a family list with a cloud subscription. To count this we write only the family list identifier and that day's count (a number) to storage next to the relay server (Cloudflare D1) — never the text or the image of the receipt.
- We do not keep it: receipt photos and the text read from them are not stored on our servers. The relay server's log keeps only the family list identifier, how the request was handled and how long it took — never the contents of the receipt. The app does not keep the photo (it reads it and throws it away) — only the item names and quantities you chose to save stay on this phone. Note that taking a photo makes a temporary file through the phone's camera, and the phone (the operating system) cleans that up once the app stops using it. A photo you chose from your gallery stays in your gallery as before.
- Nothing is saved until you have reviewed and chosen it. The AI can misread, so please check the screen before adding.
- Transfer abroad
- Recipient: Anthropic, PBC (United States)
- What is transferred: the receipt or note photo (reduced, EXIF stripped) and the items and quantities read from it
- When and how: when you use this feature to read a photo, over an encrypted connection (HTTPS)
- Purpose: to read items and quantities from the photo
- Where it is stored: outside Korea (United States)
- How long: the photo you sent and the text read from it are deleted on Anthropic's side within 30 days of receipt. However, if Anthropic's automated checks flag it for a usage policy violation it may be kept for up to 2 years, and the classification scores for up to 7 years. Retention required by law is also an exception.
- Used for AI training?: No. The Anthropic Commercial Terms of Service that apply to us state that Anthropic may not train models on customer content. (Consumer services such as claude.ai have different training rules, but Homeshelf does not use that route.)
- How to refuse: if you don't use this feature, nothing is sent. You can always add items by typing them or by barcode.
5. Date reminders
- Date reminders are raised by this phone itself. They do not go through a push server.
- On the lock screen a reminder shows only a count, never item names.
- The notice that your trial has ended is also raised by this phone.
6. Usage statistics (anonymous · on by default · can be turned off)
To make the app better we send the numbers below to our server once a day. The app tells you once after you start using it, and sends nothing before that notice.
- What we send: app version, operating system, the date (day granularity), a band for how many items you are keeping (e.g. 20–49), how many items were used up before their date that day and how many went past it ("roughly" dated items counted separately), how many declutter suggestions were seen and acted on, the week you installed (e.g. week 42 of 2026) and whether the app was used on days 1, 7 and 28 after installing, and whether the first-day item target was met
- What we never send: names, emails, account/device/advertising identifiers, item names, photos, notes, where things are stored, or exact times
- Purpose: only to see whether features actually help, and to improve them. It is never combined with advertising, personalised advertising or advertising identifiers.
- Not identifiable: what we receive contains nothing that distinguishes a person or a device, so a particular user's records cannot be found or joined up. When viewing statistics, anything with fewer than 5 records is not shown.
- Connection information (IP): statistics reach us through a Cloudflare Worker we operate, and we do not store IP addresses. No IP is passed to the storage (Supabase, Seoul region). [TO CONFIRM: whether and for how long Cloudflare keeps access logs — check during implementation]
- How long: the raw records are deleted 90 days after we receive them; after that only monthly totals are kept.
- How to turn it off: Settings › Data › Send anonymous usage statistics. Turning it off stops sending immediately and deletes anything not yet sent from the device. Every feature of the app still works.
- Statistics are not linked to a user, so they are not subject to individual access or deletion requests.
7. Advertising (Google AdMob)
- We show Google AdMob advertising to keep the app free. Placement and frequency: [TO CONFIRM: decided in M5].
- To serve and measure ads and to prevent click fraud, AdMob may process advertising identifiers and information about the device and app interactions; this is processed by Google (Google advertising policy).
- In regions where it applies (such as the European Economic Area) the app asks for consent to personalised advertising when it starts.
- When no ads appear: you bought the ad removal, or you are a member of a family list with a cloud subscription (everyone in the family).
8. In-app purchases (ad removal · cloud subscription) and the trial
Payments, refunds and card details are handled by Google Play; the app neither receives nor stores payment information.
8.1 Ad removal (one-off purchase)
- The purchase is recorded only on this device and in your Google Play account, and is not sent to our server. On a new device you can bring it back with Restore purchases using the same Google account.
8.2 Cloud subscription (recurring)
- A monthly or yearly subscription for a whole family list. To check that the subscription is valid, our server keeps the following.
| Item | Purpose |
|---|---|
| Purchase token (the Google Play receipt identifier) | Verifying the subscription · preventing one receipt being used by several accounts |
| Product and plan (monthly/yearly) | Showing which subscription it is |
| Expiry date and status | Deciding whether syncing is allowed |
| The fields needed to handle a payment dispute (subscription state, start, expiry, order number, cancellation/grace reason, plan) | Handling payment disputes. After 60 days past expiry Google can no longer be asked about that transaction, so we keep this on our side. We do not keep your email, name or billing country |
- How we check: our server queries Google Play directly (refreshed daily, and re-checked on cancellation). All that reaches Google is the purchase token and the app identifier.
- How long: payment verification records are kept for 5 years even after you delete your account, to handle payment disputes (Korean Act on Consumer Protection in Electronic Commerce — payment records). When you delete your account we erase the account identifier from this record — what remains is the receipt number and the shape of the transaction (state, period, order number), and it cannot be traced to a person. Your email, name and billing country are never kept in the first place.
- Why we don't delete the receipt number itself: it is the key that stops the same receipt being reused by another account, and after 60 days past expiry Google can no longer be asked about that transaction, so the dispute record exists only on our side.
8.3 Cloud trial (14 days)
- The first time you turn on cloud sync we give you a 14-day trial, once per account. We take no payment details, and nothing is charged when it ends.
- To tell whether an account has already used its trial we keep a trial record (start and expiry times). It survives deleting the family list. The account is written as a one-way value (a hash), so it cannot tell anyone who you are — only whether it is the same account. It contains no email or name, and to make sure the trial is given only once it is kept for 1 year even after you delete your account. If you sign up again after that period has passed and the record has been cleared, you can get a trial again.
- Whether a family list has already had its trial (once per family list) is kept for as long as that family list exists, and disappears with it.
8.4 After a subscription or trial ends
- Only uploading stops. You can keep receiving for 6 months from the expiry date.
- Six months after expiry, the synced records on the server (photos included) are destroyed.
- We never delete the records on your device, under any circumstances.
9. Permissions
| Permission | Required/optional | Purpose |
|---|---|---|
| Internet · network state | Needed to function (granted at install) | Cloud sync, family sharing, payments, ads, anonymous statistics. Nothing is attempted while offline |
| Notifications | Optional | Date reminders and the trial-ended notice. The app works if you refuse. We do not request the exact-alarm permission — "around 6 in the evening" is precise enough for a daily summary |
| Camera (taking photos) | Never requested | Item and shelf photos and receipt photos are taken by the system camera app, which hands the result back. The app declares no camera permission, so no permission dialog appears |
| Camera (reading barcodes) | Optional | Barcodes are read with a camera preview inside the app, which needs the camera permission — requested only when you tap that button |
| Advertising ID | Granted at install | Serving and measuring ads (section 7) |
| Run at device start-up | Granted at install | Used only to restore scheduled reminders after a restart. Turning the phone off clears the schedule, so the app sets it again on start-up. Nothing is read or sent with this permission |
| Vibration | Granted at install | Vibrating when a reminder arrives. You can turn it off in your phone's settings |
| Biometrics (fingerprint, face) | Granted at install | Homeshelf does not use biometrics. The Google library used for signing in (Credential Manager) declares this permission. The app never reads, stores or sends biometric data |
- No permission is mandatory. Refusing an optional permission does not affect anything beyond that one feature (Korean Network Act, art. 22-2).
- Picking a photo uses the system photo picker, so no photo or media permission is requested.
10. Disclosure, processing on our behalf, and transfers abroad
You can scroll this table sideways
| Recipient | Kind | What | Purpose | Where |
|---|---|---|---|---|
| Supabase | Processing on our behalf | The server-kept items from sections 2, 3, 6 and 8 | Storage, authentication, aggregation | Seoul (ap-northeast-2) |
| Cloudflare (Workers · D1) | Processing on our behalf | Relay for anonymous statistics (no IP stored) · relay and checks for photo upload and download · forwarding receipt photos (4.1) · keeping the family list identifier and usage numbers (photo space used · receipts read today) in D1 | Forwarding · enforcing limits | Outside Korea (Cloudflare network · no region guarantee) |
| Anthropic, PBC | Processing on our behalf · transfer abroad | Receipt and note photos and the items and quantities read from them (4.1) | Reading items and quantities from a photo | Outside Korea (United States) |
| Cloudflare (R2) | Processing on our behalf · transfer abroad | Reduced photo files and their identifiers | Delivering photos between family and devices | Outside Korea (Asia-Pacific requested · no region guarantee · section 4) |
| Google (sign-in) | Sign-in provider | Handled by Google | Account authentication | Outside Korea (United States) |
| Google Play | Payment party | Purchase token and app identifier (when queried) | Confirming payment | Outside Korea (United States) |
| Google AdMob | Advertising | Advertising identifier and similar | Advertising | Outside Korea (United States) |
| Open Food Facts | Third-party communication (not data about you) | Barcode number · connection IP (in transit) | Looking up a product name | Outside Korea (France) |
- We never sell your records or hand them over for anything beyond the purposes above.
- Members of the same family list seeing your records is the result of your own choice to share with family (section 3).
11. Keeping and deleting
| Situation | What happens |
|---|---|
| Deleting the app | Device records are deleted. Server records remain (if you had sync on) |
| Settings › Cloud account › Manage account › Delete account (leaving this app) | Removes the link between this app and your account (family list membership, synced records, display name within the family). A list you used alone is deleted from the server. Records you put into a family list remain there as described in section 3. The records on this phone remain |
| What remains even after that | ① The sign-in account (email, Google display name) — it is shared with other apps, so it remains. We delete it on request (below). ② Payment verification records and the trial record — kept without email or name (payments 5 years, trial 1 year; sections 8.2 and 8.3) |
| Leaving a family list | You come out of the family list on the server, and a copy of the records stays on this phone (photos: sections 3 and 4) |
| 6 months after a subscription or trial expires | Synced records on the server are destroyed automatically (section 8.4) |
- The sign-in account is part of a sign-in system shared by several apps, so "Delete account" in the app means leaving this app. If you want the sign-in account and the email deleted as well, please ask us by email — the steps are: verify it's you → leave this app (if you haven't) → delete the sign-in account.
- How to ask without the app: see the account and data deletion page (
https://homeshelf.allegru.dev/delete/). - Deleting your account does not cancel your Google Play subscription — please cancel it in the Play Store.
12. Children
We do not collect personal information from children under 14 (section 2.1). Features used without signing in send nothing to a server (anonymous statistics are section 6 — no identifying information).
13. Your rights
You may ask to see, correct or delete your information, or to stop its processing. Most of it you can do in the app yourself (editing and deleting items and spaces, changing your display name, deleting your account, turning off anonymous statistics); for anything else please contact us below. [OWNER DECISION: name and contact details of the privacy officer]
14. Contact
- Email: allegru.dev@gmail.com
15. Changes
If this policy changes we will post what changed and when it takes effect on this page, and important changes will also be announced in the app.