Privacy Policy — Store & Forget

What this app is

Store & Forget is an inventory tracker for Android, iPhone and iPad that helps you remember where you put physical items in your home. You take a photo of something, optionally tag and describe it, and the app records which area and spot it went into. Your inventory lives on your device by default. Everything that sends data anywhere — AI features, sign-in, ads, cloud backup, buying scan credits, and sharing an inventory with other people — is optional, and each one is described below.

Data we collect

The app collects only what you actively put into it:

• Photos you take with the camera or pick from your photo library and attach to items.
• Text you type — item names, descriptions, specifications, tags, notes, and the names you give to areas and spots.
• Documents you attach to an item — receipts, warranty cards, manuals, and other files (JPEG, PNG, WebP, HEIC, or PDF), together with the label you choose for each one.
• Optional item details — a price and currency, and an expiry or "use by" date.

If you choose to sign in (see "Signing in" below), we also receive your Google account email, name, and profile photo from Google Sign-In (or, with Sign in with Apple, your name if you share it and your email or a Hide My Email relay address), and the app is assigned a user ID that identifies your account to our scan-credit service. If you unlock something for free, our server keeps your email address with that record (see "What our server keeps" under "Using your own Gemini API key").

We do not collect:

• Your location.
• Your contacts, calendar, SMS, call logs, or any other personal data on your device.
• Audio recordings (the camera permission does not record audio in this app).
• Crash reports of our own. The exceptions are a diagnostics report you choose to send (see "Diagnostics you send us") and, if you turn on usage analytics, a count of errors by type.
• Usage analytics unless you are signed in and turn them on (see "Usage analytics" below). They are off by default and off entirely while you are signed out.

Where your data is stored

Everything you enter — photos, attached documents, text, prices, dates, item records — is stored locally on your device inside the app's private storage area.

There are three ways any of it leaves your device, and you have to turn on each one:

• Cloud backup copies your inventory into your own Google Drive or iCloud, not to us (see "Cloud backup" below).
• Share & Forget puts the areas you share, encrypted, in a folder in the owner's own Google Drive (and an editor's changes, for a while, in a folder in theirs), for the people the owner invites (see "Sharing through your own Google Drive" below).
• Share & Forget Classic uploads the areas you choose to our servers, in encrypted form, so the people you invite can see them (see "Sharing through our servers" below).

Unless you use Share & Forget Classic, we hold no copy of your inventory at all.

Optional features that use the network

The app works fully offline for manual entry, photos, attachments, browsing, and search-by-name. These features reach out over the network, and only when you use them:

Smart Scan, quick snap, and search indexing (Google Gemini)

The app asks before the first time it sends anything to Google's Gemini, and you can say no. The "Use Gemini AI" switch in the Smart Scan settings turns it off or back on later. With it off, nothing goes to Gemini, and you can still add items by hand and search by keyword.

When the app's Smart features are active, the app sends data to Google's Gemini API:

• Auto-describe a scanned item (on tap, or in Fire & Forget): when you tap "Smart Scan," the item's photo plus any text you've already entered for that item is sent to Google's Gemini vision model so it can suggest a name, description, and tags. With Multi-photo scan on, up to 4 photos of the item go in one scan. In Fire & Forget, which you start yourself, each item is scanned in the background once you move on to the next one, with no separate tap.
• Quick snap of a price or a date (on tap): when you use the camera button beside the price or expiry-date field, the app takes a single photo of the price tag, receipt, or label, sends it to Google's Gemini vision model to read that one value, fills the field in, and then deletes the photo from your device. That photo is never added to your inventory and never becomes an attachment — if you want to keep the receipt, you attach it separately and deliberately.
• Search-index an item (automatic, on save): when you save a new item or edit an existing one, the item's text is sent to Google's Gemini embedding model. That text is the item's name, description, specifications, tags, notes, sub-location, and the values in any custom fields you added — including fields you marked private. The model returns a numerical search vector, which the app stores locally on your device and nowhere else; the vector is meaningless without the original text. Prices, dates, and attached documents are not part of this text and are never sent for indexing. Marking a field private keeps it out of shared inventories and out of exports. It does not keep it out of search indexing.
• Smart Find semantic search (on tap): when you run a Smart Find search, your search query text is sent to Google's Gemini embedding model to produce a query vector. That vector is then compared locally, on your device, against the item vectors stored there — your inventory itself is never sent for the search, only the words you typed into the search box.

Which route a scan takes depends on whose key it uses:

• Signed out (free trial scans) — the app uses an API key bundled in the app and calls Google directly. Our server is not involved.
• Signed in (both your free per-account allowance and credit-backed scans) — the photo and text for that scan are routed through our scan-credit server (see "Scan-credit service") on their way to Google, together with your user ID so the scan can be metered. The server forwards them and does not store them.
• Using your own Gemini API key — the scan goes straight from your device to Google. Our server is not in the path at all (see "Using your own Gemini API key" below).

Search indexing and Smart Find follow the same routes. Signed out, or on your own API key, the item text or search query goes straight from your device to Google. Signed in, it is routed through our server on its way to Google, together with your user ID — the same server described under "Scan-credit service" below. It forwards the text and does not store it.

Free scans, search indexing and Smart Find searches run on free Gemini keys: the app's own while you're signed out, our server's while you're signed in. Under Google's Gemini API terms, what's sent on a free key can be used to improve Google's products, and people at Google may review it. Scans that use a scan credit run on a paid key, which Google doesn't use to improve its products. If you use your own key, see "Using your own Gemini API key" below.

We never take a document that is already attached to an item and send it to Gemini. One path runs the other way round: when you use the field-read button to pull a price, date, serial or ID number off a file you pick, the first page of that file is sent to Google's Gemini vision model to read that value, and the file is then attached to the item. You start that yourself, the app tells you what it will cost, and it spends a scan credit. Apart from that, an attached document only leaves your device if you turn on "Share all photos and files" for a shared inventory — encrypted, and described in the sharing sections below. Google's handling of data sent to the Gemini API is governed by Google's privacy policy and the Gemini API terms of service.

Using your own Gemini API key (BYOK — optional)

Instead of using the app's scan allowance, you can supply your own Google Gemini API key, from the app's "BYOK — Bring Your Own Key" screen. This is optional and off unless you set it up. When it is on:

• The key is stored only on your device, in the operating system's encrypted key store (the Android Keystore, or the Keychain on iPhone and iPad). It is never sent to our servers, is not included in your Google Drive or iCloud backup, is not included in analytics, and is never shared with anyone.
• We never receive it. The key is only ever attached to requests the app sends directly to Google at https://generativelanguage.googleapis.com. It appears in no request to any server we operate.
• The content of your scans skips our server. While your own key is active, the photo and text for a scan travel straight from your device to Google. Our scan-credit server is not in the path, so we do not receive, forward, or see the contents of those scans. When you're signed in, the app does tell our server how many you ran (see "What our server keeps" below).
• Google meters and bills those calls against your own Google account, under Google's Gemini API terms. What Google does with what you send it is covered by Google's privacy policy; we are not a party to that exchange.
• On a free Gemini key, Google may use what you scan. Under Google's Gemini API terms, what you send on a free key can be used to improve Google's products, and people at Google may review it. Keys on a paid Google plan are treated differently. The Gemini API terms have the details.
• You can remove the key at any time using "Clear" on that screen, which deletes it from your device. Scans then fall back to the app's own allowance.

Why the app asks you to sign in for this. Turning on your own key is free. The unlock belongs to your account rather than to one phone, so it survives a reinstall or a new phone, and signing in is how the app attaches it to an account. The app never sends your key to our server. The free unlock includes a daily number of own-key scans, shown in the app. The one-time "No cap BYOK" purchase removes that limit.

What our server keeps. Two records:

• Free unlocks. When you turn on your own key for free, or unlock a feature with a hidden gesture or a code, our server records your user ID, your account's email address, what was unlocked, and when. Paid unlocks aren't part of this record.
• How many own-key scans you run. While you're signed in, the app sends our server the number of scans you ran on your own key and the day they ran. On the free unlock, the app checks with our server before each own-key scan, so the daily limit counts across all your phones. These are numbers and dates only, never the photos, the text, the results, or your key. We keep a running total with the time of the last one, daily counts for the last few days, and weekly totals for 8 weeks.

We use these records to spot abuse and to apply the daily limit. They're never used for marketing. They're deleted with the rest of your account's data when you ask (see "How to delete your data").

Sharing through our servers (Share & Forget Classic)

Share & Forget Classic keeps shared inventories on our servers. Share & Forget, which keeps them in the owner's Google Drive instead, is described in the next section. The app doesn't offer Classic for new shares on iPhone and iPad.

Sharing is optional and off until you use it. It requires signing in. When you create a shared inventory, you choose which areas of your inventory it carries, and you invite people with a code or a QR code. Members you invite as viewers can see the shared inventory; members you invite as editors can also change it.

What leaves your device. For the areas you put in the shared inventory, the app uploads to our servers, and makes available to every member of that group:

• the area and spot names and their structure,
• item names, descriptions, specifications, tags, and notes,
• expiry / "use by" dates on those items,
• one photo per item — the item's first photo, the one you see in your lists.

"Share all photos and files" — off unless you turn it on. There is a setting that widens what a shared inventory carries. With it on, the app also uploads every other photo on those items (extra shots, brand and specification close-ups) and the documents you attached to them — receipts, warranty cards, manuals. With it off, which is how it starts, none of those leave your device. These extra files are encrypted on your device in exactly the same way as everything else described below, and they cost credits to upload, so the app tells you what a sync will cost before it sends anything. Turning the setting back off stops future uploads; it does not remove files already sent to a group, and members who already received them keep their copies. If you were already sharing before this setting existed, your shared inventories used to carry every photo on an item; from now on they carry one per item unless you turn this setting on, and nothing that was already sent is taken back.

What deliberately stays on your device, even for an item inside a shared inventory:

• prices and currencies — these are removed before anything is uploaded,
• attached documents, unless you turn on "Share all photos and files" above,
• everything in areas you did not put in the shared inventory,
• the search vectors described above.

Encryption. The uploaded inventory snapshot and the photos are encrypted on your device before they are sent, with a key held only by the members of that group. Our servers store ciphertext and cannot read your items or view your photos. The display name you set for yourself is encrypted the same way. The encryption key is stored on your device and, so that you can get your shared inventories back on a new phone, a copy is saved in the same private Google Drive app-data folder your backup uses — in your Google account. We never receive the key.

What is not encrypted, and what we can see. In plain terms, we can see:

• the name you give a shared inventory — this is stored in plain text on our servers, because the server has to be able to list the inventory for you before you hold its key. Do not put anything private in the name.
• which accounts are members of which group, and their roles,
• how many photos and how many bytes have been uploaded, and when — we use this to bill shared uploads against your credit balance and to detect abuse.

Where it is stored. On Cloudflare (a Cloudflare Worker and Cloudflare R2 object storage), which processes it as our service provider.

Charging. Uploading photos to a shared inventory spends the same credits as Smart Scans. The app tells you the price before an upload runs and never bills you silently.

Leaving, and deletion. If you leave a shared inventory you were invited to, the app asks whether to keep the copy on your device or delete it, and either way your membership and the copy of the snapshot you had uploaded are removed from our server. If you own a shared inventory, you can stop sharing it, which removes it for everyone else. Encrypted photo blobs already uploaded to a group are not automatically erased from our storage — they stay so that a member joining later can still load the pictures. To have a group's stored data deleted outright, email us at the address at the bottom of this policy.

Sharing through your own Google Drive (Share & Forget)

Share & Forget is optional and needs sign-in with a Google account. It works on Android, iPhone and iPad. If you signed in with Apple on an iPhone or iPad, you connect a Google account in the app first. It keeps a shared inventory in a folder in the owner's own Google Drive. For this, the app asks Google for access to the files Store & Forget creates, and nothing else in your Drive. Your inventory never passes through our server.

What goes into the shared folder. You mark each area Private, View-only or Editable. Private areas never go into it. For the others, the folder gets the area and spot names, item names, descriptions, specifications, tags, notes and expiry dates, and one photo per item. With "Share all photos and files" on, it also gets every other photo on those items and the documents attached to them. Prices, fields you marked private, loan records and search vectors stay out.

Encryption. Everything in the folder is encrypted on your phone before it's uploaded, the inventory's name included, and the files in it have random names. The key travels inside the invite. So that members can get back in on a new phone, each member's Google Drive keeps a copy of the key in the same private app-data folder your backup uses. That means Google holds both the encrypted folder and a copy of the key, so we don't claim Google can't read it. We never receive the key.

How members reach the folder, and what they can see. The shared folder is set so that anyone who has its link can read it, and it can't be found by searching Drive. That lets members' phones read it directly from Google Drive with an access key that belongs to our app, without the Google Drive app and without the folder being shared with their account. We never give out the link: its location is stored encrypted on our server, and only members get it. Everything in it stays encrypted, so the link alone shows nothing of your inventory. Google Drive does show who made each file and when it changed. So members can see the Google name, email address and profile photo of the owner and of every editor, and when they last changed something. Viewers' details don't appear. When an editor changes something, their phone puts it in a folder in the editor's own Google Drive, shared the same way, and the owner's app later copies it into the owner's folder.

Inviting someone. You invite a person by the email address of their Google account, and then you send them the invite link yourself, by email or any chat app on your phone. The link carries the key. It opens a page on our website, but the key is in the part of a link that browsers never send to a server, and the page doesn't send it anywhere. The address itself stays in your own Google Drive, in that same app-data folder, and on your phones.

What our server keeps. Our server (a Cloudflare Worker, run by Cloudflare as our service provider) handles membership only. It never holds your items, photos, files or the key. For each shared inventory it keeps:

• which accounts are members and what each of them can do,
• a public key for each member's phone, up to five per member,
• the inventory's name and each member's display name, both encrypted so we can't read them,
• a random ID for the shared inventory, and where its folders are in Google Drive, encrypted so we can't read it,
• a one-way hash of each email address you invite.

The hash is how an invite only works for the account it was sent to. When someone joins, our server hashes the email address of their Google sign-in the same way and compares the two, without storing the address. We keep the hash while the invite is open, which is at most seven days, and after the person joins, for as long as they're a member.

Leaving, removing and stopping. A member who leaves or is removed is taken off our server, hash included, and a removed member stops syncing at once. When someone is removed, the owner's app also copies the shared folder to a new place in the owner's Drive, the removed person isn't told where, and the old folder goes to the owner's trash. An editor who leaves has their own folder moved to their Drive trash. When the owner stops sharing, every member is removed, open invites are cancelled, and the shared folder goes to the owner's Google Drive trash, where Google keeps it for 30 days unless the owner empties the trash sooner. Anything members already downloaded stays on their phones, and Google Drive can keep earlier versions of a changed file for up to 30 days. After you stop sharing, our server keeps a record with only you in it: your user ID, the encrypted name and your phones' public keys. To have it erased, email us at the address at the bottom of this policy.

Store & Forget's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in (Google, Apple, Firebase Authentication)

Signing in is optional. You need an account to buy scan credits, to earn extra scans by watching a rewarded ad, to back up your inventory to your Google Drive or iCloud, or to share an inventory. On Android you sign in with Google. On iPhone and iPad you can sign in with Google or with Apple. Google Sign-In provides the app with your Google account's email, name, and profile photo. Sign in with Apple provides your name, if you choose to share it, and your email address or a private relay address from Apple's Hide My Email. Either way, Firebase Authentication issues a user ID that identifies your account to our scan-credit service. We never receive your Google or Apple password. You can use the entire core app without ever signing in. You can delete your account at any time; see Delete your account below.

Usage analytics (optional — off unless you opt in)

To understand which features people use and where the app is rough, you can optionally share anonymous product analytics. This is off by default. It is available only when you are signed in, and only after you turn on Advanced Settings → "Share usage analytics." While you are signed out, no analytics are collected at all.

When you opt in, the app uses Google Analytics for Firebase to record anonymous, behavior-only events:

• Which actions you take — e.g. starting a scan, saving an item, purchasing scan credits, or earning credits from a rewarded ad — plus standard app-lifecycle events (first open, session start).
• Basic technical context — your app version and general device/OS information.
• Errors — when something fails, such as a backup, a restore, a scan or a purchase: which part of the app it was and a short error code. Never the error text, and never what you were working on.
• Prices — whether you use prices: a rough count of how many items have a price (for example 1-9 or 10-49) and how many currencies you use, up to 3. Never an amount, a currency, or which items.

Each event is tied only to a random, app-generated analytics instance ID. We do not send your name, email, or account ID to analytics, and we never link these events to your identity.

We do not send your inventory to analytics. Item names, photos, attached documents, descriptions, specs, tags, notes, price amounts, dates, and the names of your areas and spots are never included in any analytics event — analytics see that you saved an item, never what the item is. You can turn analytics back off at any time from Advanced Settings → "Share usage analytics," which stops further collection. Analytics data is processed by Google under Google's privacy policy.

Cloud backup to your own Google Drive or iCloud (optional)

If you turn on cloud backup, the app copies your inventory (item text and photos, and your attached documents if you leave that option on) into a private, app-specific folder in your own Google Drive (the Drive "app data" area). This data lives in your Google account, under your control — we cannot see or access it, and it is not visible in your normal Drive file list. You can disconnect backup or delete the backup folder at any time from your Google account. This uses Google Drive, governed by Google's privacy policy.

On iPhone and iPad, the backup goes to a private folder for the app in your own iCloud Drive if you signed in with Apple only, or if you choose iCloud in the backup settings. It isn't shown in the Files app, and we can't see or access it. To delete it, open Settings on your iPhone, tap your name, then iCloud, and find Store & Forget in the storage list. This uses iCloud, governed by Apple's privacy policy.

Moving your inventory to another device (optional)

"Move to another device" copies your inventory (item text, photos and attached documents) from one of your devices to another over your local Wi-Fi network. You start it on both devices and pair them by scanning a QR code. The data is encrypted and goes straight from one device to the other. It does not pass through our servers or any cloud service, and we never see it. While a transfer runs, the app shows a notification so it can finish if you switch apps or the screen turns off.

Ads (Google AdMob)

Store & Forget shows ads. When you're signed in, they start after a number of free scans; if you use your own Gemini key, they start right away; while you're signed out on the free trial, there are none. You can also choose to watch a rewarded video to earn extra scans. Buying Remove ads turns the other ads off. Ads are served by Google AdMob, which may collect and use a device advertising ID and related device/ad information to serve and measure ads. This data is processed by Google as an advertising partner. On Android you can reset or delete your advertising ID in your device's Google settings. On iPhone and iPad, AdMob uses your device's advertising identifier (IDFA) only if you tap Allow when Apple's tracking prompt appears before the first ad. You can change that at any time in Settings > Privacy & Security > Tracking. See how Google uses information from apps that use its services and Google's privacy policy.

Scan-credit service (our server)

To meter free and paid scans, the app talks to a small server we operate (a Cloudflare Worker). It receives your Firebase user ID to track how many scans your account has left, and the rewarded-ad reward callback that grants you credits. On paid/credit-backed scans it also receives the photo and text for that scan — including the single photo of a price tag or expiry date when you use quick snap — and immediately forwards it to Google's Gemini API to produce the result. It does not store your photos or item text. We keep a per-account scan/credit balance, not your inventory. The same server keeps the free-unlock records and own-key scan counts described under "Using your own Gemini API key".

To keep the free scans from being abused, the app proves to our server that it's the genuine app, using Firebase App Check. On Android that relies on Google Play Integrity. On iPhone and iPad it relies on Apple's App Attest, or DeviceCheck on older devices. These checks carry no name, email or inventory.

When you are signed in, search indexing and Smart Find go through this server too. It receives the item text you saved, or the words you typed into the search box, passes them to Google's embedding model, and hands back the search vector. It does not store them. Alongside that it keeps anonymous counts of how many of these operations your account has performed (plain numbers, grouped as search / save / re-index), which is what lets us keep the shared free AI tier healthy and detect abuse. Those counts carry no item text, photos, or locations. Signed out, or on your own API key, none of this reaches us — the indexing call goes straight to Google.

The same server handles Share & Forget Classic, as described under "Sharing through our servers" above. That is the one case where it stores content, and it stores it encrypted. For Share & Forget it stores no content, only the membership records described under "Sharing through your own Google Drive".

Diagnostics you send us (optional)

If something goes wrong, you can tap Send diagnostics in your profile. The app first shows you the whole report, and nothing is sent until you tap Send. The report holds the app and phone versions, recent error codes, and counts such as how many items and photos you have. It never includes item names, photos, notes, places or your location. If you're signed in, it also carries your user ID so we can match it to your support email. We keep each report for 30 days, then it's deleted automatically.

Buying scan credits or an unlock (Google Play or the App Store)

If you buy a scan-credit pack or a one-time unlock, such as Remove ads or No cap BYOK, the purchase is handled by Google Play Billing on Android, or by Apple through the App Store on iPhone and iPad. Google or Apple processes the payment. RevenueCat, which manages purchases for us as our service provider, receives your user ID from the app and the purchase details from the store. We receive a purchase confirmation so we can add the credits to your balance or turn the unlock on for your account, and we keep which unlocks your account holds and when it got them. We do not receive your card number or other payment details.

How the app updates itself

Store & Forget updates over two channels, and neither one asks you to install anything from outside Google Play or the App Store:

• Google Play in-app updates. When a newer version is on the Play Store, the app can show Google's own update panel. The update is downloaded and installed by Google Play, through Google's official update mechanism. We never download or install an app package ourselves, and the app never asks you to sideload one.
• App Store updates (iPhone and iPad). New versions come from the App Store. The app never downloads or installs a new version itself. It only opens its App Store page when you ask it to.
• Over-the-air JavaScript updates (Expo / EAS Update). Smaller fixes ship as a JavaScript bundle downloaded from Expo's update service, which is the standard update mechanism for React Native apps. This can change the app's JavaScript only — it cannot add native code, cannot add or change a permission, and cannot change what the app is allowed to do on your device. When one has downloaded, the app tells you, and it applies the next time you restart the app.

What an update check sends. On launch, the app asks Expo's update service whether a newer bundle exists. That request carries the platform ("android" or "ios"), the app's runtime version and release channel, the ID of the bundle it is currently running, and an EAS client ID — a random identifier generated the first time the app runs and kept in the app's own private storage. It is not your device's advertising ID, not a hardware identifier, and is not linked to your Google account, your name, or your inventory; clearing the app's data or uninstalling the app discards it. No inventory data of any kind is sent in an update check. Expo processes this as our service provider, under Expo's privacy policy.

Notifications

If you turn on reminders (for items you have lent out, or for items about to expire), the app schedules those notifications on your device. Nothing about them is sent to us or to anyone else, and no reminder is delivered through a server.

Permissions the app requests

• Camera — to let you photograph items as you store them, to photograph a document you want to attach, and to quick-snap a price tag or expiry date. Photos are saved to the app's private storage on your device; a quick-snap photo is deleted after it is read. The camera also scans the pairing code when you move your inventory to another device.
• Photos / Media library — to let you attach existing photos from your library to an item.
• Files / documents — to let you pick a receipt, warranty card, or manual from your device and attach it to an item. The app only reads the file you choose, and copies it into its own private storage; it does not browse or scan your files.
• Notifications — to deliver the optional lend and expiry reminders described above.
• Foreground service (data sync) — keeps a "Move to another device" transfer running in the background, with a notification on screen while it runs.
• Tracking (iPhone and iPad only) — Apple's App Tracking Transparency prompt, shown before the first ad. See "Ads" above.
• Internet / network — for the optional features above (AI, sign-in, ads, cloud backup, sharing, buying credits).

How to delete your data

Delete your account

Signing in creates a Store & Forget account. To delete it, open the app, go to Profile and tap Delete account. You'll sign in once more, with Google or Apple, to confirm, and the deletion starts right away.

It deletes:

• your account and sign-in
• your backup in your Google Drive or iCloud
• if you signed in with Apple, the app's Sign in with Apple access, which we revoke with Apple
• your Koala Credits, including unused ones
• the features you unlocked, free or paid, such as Remove ads. Deleting your account doesn't refund a purchase.
• everything else our server holds for your account, such as unlock records and scan counts
• the shared inventories you own, and your place in ones others share with you. If other people still use one you own, stop sharing it first; the delete screen lists them. A shared folder you own in Google Drive goes to your Drive trash, which Google empties after 30 days.

What stays:

• the items on your phone, unless you tick Also erase everything on this phone
• your purchase records, which belong to your Google Play account or Apple Account. Google or Apple keeps them, and RevenueCat, which manages purchases for us, keeps your purchase history under your old user ID.
• a record of how many free scans your Google or Apple account has used and whether own-key scans were switched off for it. It's stored under a one-way code made from that account's ID and holds no email, name or inventory. We keep it for as long as we offer free scans, so deleting an account and signing in again doesn't start a new set of free scans.

Don't have the app anymore? Email privacy@hyperkoalastudio.com from the email address on your account and ask us to delete it. If you signed in with Apple and hid your email, include the relay address, which your iPhone lists under Settings > your name > Sign in with Apple. We'll delete the same data within 30 days and reply when it's done. Your backup is in your own Google Drive, so delete that part yourself: in Google Drive on the web, open Settings, then Manage apps, find Store & Forget and choose Delete hidden app data. An iCloud backup is deleted from your iPhone's Settings. See "Cloud backup" above.

Delete your inventory and other data

Your inventory lives on your device for as long as you keep it there. You can delete it at any time:

• Delete individual items, areas, spots, or attachments: use the delete actions inside the app on each detail screen. Deleting an attachment removes the file from your device, not just the entry.
• Erase everything in the app at once: open Advanced Settings, tap Erase data and choose This device only. This wipes the local database (all areas, spots, items) and removes every photo and attached document from the app's private storage.
• Delete the app entirely: uninstall Store & Forget from your device. Your phone or tablet removes the app's private storage, including the SQLite database, all photo files, and all attached documents. An iCloud backup stays in your iCloud until you delete it.
• Delete your cloud backup: open Advanced Settings, tap Erase data and choose Cloud backup only, or delete the app's hidden data in Google Drive or iCloud (see "Delete your account" above).
• Leave or stop a Share & Forget Classic inventory: from the sharing screen. This removes your membership and your uploaded snapshot from our server; see "Sharing through our servers" above for what remains and how to have it erased.
• Leave or stop a Share & Forget inventory: from the sharing screen. Leaving takes you off our server. Stopping also moves the shared folder to your Google Drive trash; empty the trash to erase it before Google's 30 days are up. See "Sharing through your own Google Drive" above for what remains.
• Delete what our server holds for your account (your scan-credit balance, unlock records, own-key scan counts, and any shared-inventory data): delete your account (above), or email us at the address below.

Children

This app is not directed at children under 13, and we do not knowingly collect any data from children.

Changes to this policy

If we materially change how the app collects, uses, or shares data, we will update this policy and update the in-app and store listing references to it. The "Effective date" at the top reflects the most recent change.

Contact

Questions about this policy, or requests to delete data we hold for your account, can go to privacy@hyperkoalastudio.com.