Privacy policy

Where's My Crap? (“the app”, “we”) remembers where you put things, so you can ask later. To do that it has to keep what you tell it. This page says what we collect, why, who else handles it, and how to get rid of it. The app is in beta, on iOS, Android, and the web.

The short version

• We keep what you tell the app, so it can tell you back.
• No ads. We do not sell your data. The app has no analytics or tracking. This site counts visits with our own analytics, described under “This website”.
• A few service providers handle data to make features work. They are listed below.
• You can download all your data, or delete your account and everything in it, from the app.

What we collect

Your account

• Your email address, to sign you in and to reset your password.
• Your password, stored only as an argon2id hash. We never store the password itself.
• Sign-in sessions. We store a hash of each session token, not the token. On the web, the app keeps its token in your browser's local storage; on phones, in the secure keychain or keystore.

Your stuff

• Each item's name, where it is, and any notes you add.
• Check-ins: when we asked if something is still there, and your answer.
• Photos you choose to add. Our server re-encodes each one and removes its metadata, including EXIF data and GPS location, before it is stored.
• Saved files (PDFs and images, for example receipts and warranties). Images are cleaned like photos. PDFs are stored exactly as you upload them, including any metadata inside the PDF (such as author, software, and dates). Remove it before you upload if that matters to you.

Your devices

• If you turn on notifications: your phone's push token, its platform (iOS or Android), and when it was registered and last seen. Signing out removes them.
• Some settings stay only on your device and never reach us: theme, shake to find, and your check-in streak.

Voice

• The app uses the microphone only while it listens: after you tap the mic, or shake your phone to find something (you can turn shaking off in Settings). It stops by itself after a short silence.
• We never receive your audio. Speech becomes text on your device's speech recognizer. On iOS it runs on the phone when your language supports it. On Android it runs on the phone when the offline speech model for your language is installed. Otherwise the phone's recognizer may send audio to Apple or Google, under their privacy policies. On the web, your browser's speech recognition is used, and some browsers (for example Chrome) send audio to their own servers.
• When you stash something by voice, the text of what you said goes to our server and to Anthropic (Claude Haiku), only to pull out the item's name, place, and notes. You check the result before it is saved. We do not store the transcript itself. Typed stashes are not sent to Anthropic.
• When you ask where something is, your question goes to our server to search your items.

Search

To find things when you word them differently (“passport” vs. “travel documents”), our server can send an item's name, place, and notes, and your search questions, to Google Vertex AI. It returns a list of numbers (an embedding), which we store with the item. When this feature is off, search uses your words only.

Households

You can share your stuff with the people you live with. Households are optional.

• Members of your household see your email address, and the items you share with the household (name, place, notes, photo, and file). They can mark a shared item as moved or found. Only you can edit or delete it.
• Items you mark “Just me” are never shown to anyone else, in lists or in search.
• Nothing is shared before you join: items you saved earlier stay “Just me”, and so does the first thing you stash after joining, until you choose to share it.
• Before you join, the invite shows the household's name, its owner's email, and how many members it has.
• Invites are single-use links that expire after 7 days. We store only a hash of each invite. The owner can see and revoke open invites. Open invites are deleted when their maker leaves, when the household gets a new owner, or when a member is removed.
• Leaving a household, or being removed, makes all your items “Just me” again. If the owner leaves, the member who joined first becomes the owner. When the last member leaves, the household is deleted.
• Your data download includes your household's name and size, not the other members' emails. Deleting your account takes you out of your household first.

Who else handles your data

We use these service providers. Each one gets only what its job needs.

• Google Cloud (United States, us-central1): runs our server, database, photo and file storage, and search embeddings (Vertex AI).
• Anthropic: reads voice stash transcripts to fill in the item, as above.
• Expo, then Apple or Google: deliver push notifications. A notification never contains an item's name or place, only a generic line like “Quick check-in: 2 things to confirm.”
• Apple, Google, or your browser maker: speech recognition, when it does not run on your device.
• Sentry, only when crash reporting is turned on for a build: crash and error reports. They are scrubbed: no item text, request bodies, error messages, query strings, screenshots, or sign-in headers. They identify you only by your account id (reports from our server use a hash of it), never your email.

We may also disclose data if the law requires it, and we would tell you unless we are not allowed to.

How we protect it

• All traffic uses HTTPS.
• Photos and files are private. The app gets them through signed links that stop working within 7 hours.
• Our logs never hold item text, request bodies, or tokens.

How long we keep it, and how to delete it

• We keep your data until you delete it.
• Delete an item, and its photo and file go with it.
• Download your data: in the app, Settings → Danger zone → Download my data. You get a JSON file with every item, check-in, and device, and links to your photos and files.
• Delete your account: Settings → Danger zone → Delete my account. This removes your account, sessions, devices, items, check-ins, photos, and files.
• During the beta we may delete accounts that have been inactive for a long time. We will tell you by email first.

Your choices and rights

You can see, change, download, and delete your data in the app at any time. Microphone, camera, photos, and notifications are each off until you allow them, and you can turn them off again in your phone's settings. For anything else, including questions about the laws where you live, contact us.

This website

This website sets no cookies. To count visits it runs our own analytics, served from api.foxd.io. For each page you view, and when you tap an email link, it records the page address, the page that sent you here, your IP address and the country it comes from, and your browser, operating system, and device type. Those last three are worked out from your browser's user agent, which we do not keep.

To tell visits apart, it keeps a random visitor id in your browser's local storage and a random session id in its session storage. You can clear both in your browser settings. We keep these records for 365 days, then delete them. Its fonts are served from this site.

Children

The app is not for children under 13, and we do not knowingly collect their data. If you think a child under 13 has an account, contact us and we will delete it.

Changes

If we change this policy, we will update this page and its date. For a big change, we will tell you in the app or by email before it applies.

Contact

Questions or requests: accounts@foxd.io.