Privacy Policy
Last updated 22 July 2026
Commonkeep is a shared shopping list for a household. To keep a list in sync across phones, it has to store that list on a server. This page explains exactly what is stored, who can see it, and what leaves the app.
The short version: we store your email address, an optional display name, and the lists you write. There is no advertising, no analytics, no tracking, and no AI. One outside company is involved: an email provider that delivers your sign-in code. Everyone in your household can see the household's lists, but never each other's email addresses.
Who we are
Commonkeep is published by Jerome Coloma (sole trader). Questions about privacy go to commonkeepapp@tallbottech.com.au.
What we collect
- Your email address. Held in the authentication system so we can send you a sign-in code and recognise you when you come back.
- A display name, if you set one. Optional, and shown to the other members of your household so they can tell who added what.
- The content you create. Items, including the exact line you typed or dictated; stores you set up, including any address text you type into them; shopping trips and any prices you record on them; and repeating items you schedule.
- An activity log. Every add, tick off, edit, and delete is recorded so the household can see recent changes and so your phones can reconcile after being offline. The log is append-only.
All of the above is linked to your user account.
What we do not collect
- No profile photos.
- No location or GPS data. A store's address is free text you type, and nothing else.
- No device identifiers, advertising IDs, or contacts.
- No age or date of birth.
- No analytics, no advertising, no third-party trackers, no push notifications, and no crash reporting. Nothing about how you use the app is measured or sent anywhere.
- No AI or language models. Typed and dictated lines are interpreted by fixed rules running on your phone, and are not sent anywhere for interpretation.
To be straightforward with you: the app ships with a slot for a crash-reporting service that is switched off and left empty, so no crash data is produced or transmitted today. If that ever changes, this page will be updated before it does.
Signing in
Commonkeep uses a code sent to your email address. There are no passwords, and there is no sign in with Apple, Google, or any other social account, so no other company is told that you use Commonkeep.
The one third party
Sign-in emails are delivered by Resend, an email provider based in the United States. Our server hands Resend your email address and the message containing your code. That is all it receives. It is not given your lists, your household, or anything else. The app on your phone never contacts Resend directly.
No other company receives your data.
Microphone and speech
If you use the microphone to add an item, Commonkeep asks for microphone and speech-recognition permission, and then uses your device's built-in speech recognition to turn what you said into text. Depending on your phone, its settings, and the language you use, that recognition may be performed by your device's operating system on the device itself or by the operating system vendor's servers. That step is handled by Apple or by your Android device's supplier under their privacy policies, not by us. We do not record, keep, or receive audio. The resulting text becomes an item on your list exactly like a typed one.
The microphone is only active while you are dictating an item. Commonkeep asks for no other permissions. It has no camera access: it can show a QR code to invite someone, but it never scans one.
What other people in your household can see
A household is a shared space, and it is meant to be shared. Anyone who is a member of your household can see:
- Every item in it, including the exact wording you typed or dictated.
- Every store, trip, and price recorded on a trip.
- Every repeating item.
- The full activity log, so they can see who added, changed, or removed what.
- Other members' display names and roles.
Email addresses are never shared with other household members. They are kept in the authentication system, which is not part of what syncs to anyone's phone. Invitation codes are stored only as a one-way hash and are never sent to members' devices.
A household can hold up to 20 members. Anyone with a valid invitation can join, so treat an invitation the way you would treat a key. Invitations expire after 14 days.
Please keep in mind that anything you write on a shared list is visible to everyone in that household, and stays visible in the activity log after you remove it.
Where your data is stored
Your lists are stored on servers we control, and a copy of your household's data is cached on each member's phone so the app works offline. Access is restricted to the app's own accounts and to the person who maintains the service.
How long we keep it
Your lists are kept for as long as your household exists. The activity log is append-only: entries are added and never trimmed, so a household's history grows over time. Expired invitations stop working after 14 days.
Deleting your data
Inside the app today you can:
- Leave a household. Your membership is removed and the household's data stops syncing to your device.
- Delete a household when you are its last remaining member. This permanently removes its items, stores, trips, and activity log.
Deleting your account itself, including the email address held for sign-in, is done by request. See Delete your account for the exact steps and what to include.
There is currently no way to export your data out of Commonkeep. If that changes, this page will say so.
Children
Commonkeep is a household shopping list intended for general use by adults. It is not directed at children, it collects no age information, and it has no age gate. If you believe a child has provided us with personal information, contact us and we will remove it.
Your rights
You can ask us what personal information we hold about you, ask for it to be corrected, or ask for it to be deleted. Email commonkeepapp@tallbottech.com.au and we will respond within 30 days. If you are unhappy with how we handle a request, you can raise it with the privacy regulator in your country.
Changes to this policy
If Commonkeep changes in a way that affects this policy, this page is updated and the date at the top is revised. Material changes are published here before they take effect.