Pantrove Privacy Policy

1. Privacy overview

bee n moss operates Pantrove: Grocery List (com.beenmoss.pantrove). Android is in closed testing; iOS is in preparation. Pantrove keeps a working copy of your list on your device and synchronizes it with our servers when you are signed in and connected. Feature availability depends on your version and platform.

2. Information we handle

• Account information: email address, display name, a one-way argon2id password hash, the date you accepted the terms, and the sign-in methods you use (email and password, Google, or Apple).
• Household information: household names and icons, members and roles, and invite codes, which expire after seven days.
• List content: items you add or create, categories, quantities, units, notes, who added or bought an item, and timestamps.
• Optional photos you attach to custom items are resized on your device before upload and stored in Cloudflare R2. Photo URLs can be viewed by anyone who has the URL, including outside your household. Do not upload sensitive or confidential images.
• When notifications are enabled in a supported build, we handle a random device identifier, platform, notification preferences, and the push token issued by Firebase Cloud Messaging. Notifications are not enabled in the current Android closed-test release.
• Operational data includes IP addresses used for rate limiting and security, request/error metadata, and service diagnostics. Sentry crash reporting is disabled in the current Android release; Google advertising diagnostics are described separately below.

3. Sharing inside a household

Household members can see the shared list, items, notes, photos, and display names. Add only people you trust and avoid sensitive information in items or notes. Household membership restricts list access, but possession of a photo URL allows viewing the image without signing in.

4. Notifications

Notifications are not enabled in the current Android closed-test release. In a supported build, permission and notification preferences control whether Firebase Cloud Messaging and the platform push service deliver messages about household changes. Those messages may contain a member name and grocery item name and may be visible on your lock screen.

5. Advertising

Free accounts may see a Google AdMob banner on the Household and Settings screens, never on the shopping list or add-item flow. Ad requests are non-personalized and limited to general-audience content. Active Pantrove Plus subscribers see no ads; a household created by an active Plus subscriber also receives ad removal while members select that household.

When ads are requested, the Google Mobile Ads SDK collects and shares your IP address (which may estimate approximate location), app and ad interactions, diagnostic and performance information, and device identifiers such as the Android advertising ID and app set ID. Google uses these for advertising, measurement, analytics and fraud prevention. Non-personalized ads still use data for these purposes. Ad data is transmitted using encrypted connections.

Where required in the EEA, UK and Switzerland, a Google consent message lets you consent, decline or manage options. Ad privacy choices in Settings lets you revisit your choices. You can also reset or delete the advertising ID in Android settings. Ads are requested only when the consent SDK permits them. Providers determine retention of their advertising data under their own policies. See https://policies.google.com/privacy

6. Service providers and disclosure

We do not sell your account or household information. We use application hosting and a PostgreSQL database, Cloudflare R2 for photos and private database backups, Spacemail for account email when configured, Google and Apple for supported sign-in and store services, Google AdMob for advertising, and Firebase Cloud Messaging when notifications are enabled. RevenueCat is not used. Providers may process data outside your country. Information may also be disclosed where reasonably necessary for legal compliance, security, or protection against abuse.

Purchases and subscription verification

Paid checkout is disabled in the current Android release. When available, Google Play or Apple processes payment; Pantrove does not receive your payment-card details. Our server verifies purchase tokens or transaction identifiers, product, store, subscription status and expiry, and links access to your Pantrove account identifier. Store notifications update renewal, expiry and refunds. We use this information to provide paid benefits and prevent purchase abuse.

7. Retention and deletion

• Account and list data are kept while your account is active.
• Deleting your account removes sign-in methods, sessions, password-reset records, notification devices, and Pantrove purchase/entitlement records. Your email, name, and password hash are removed or replaced. An anonymized account row and technical identifier remain to preserve shared records; deletion does not cancel store subscriptions.
• Shared household items and photos remain for other members, with your display name replaced by “Former member”. Sole-owned households are made inactive and their memberships and invites removed; this is not an immediate purge of all stored list data or photos.
• Private database backups have a 14-day retention policy, so deleted account information may remain in backups until they expire. Photos are stored separately in R2 and are not included in these database backups. Advertising and store providers have their own retention policies.
• Signed-in sessions expire after 30 days of inactivity; password-reset links expire after one hour.

8. Security, children, and changes

Pantrove uses hashed passwords, expiring tokens, encrypted connections, rate limits, and secure on-device token storage, but no method is completely secure. Pantrove is not directed to children below the minimum age for online services in their location. This policy may change as the product, providers, or laws change; the date above identifies the current version.

Your choices and privacy requests

We use account and household information to provide sign-in, shared lists, synchronization, support and security; optional photos support custom items. Purchase records verify paid benefits. Advertising information is used for the purposes described in the Advertising section.

You can edit supported profile and list fields, delete your account in Settings, and revisit ad consent where available. Depending on your location, you may also have rights to request access, correction, deletion, a copy of your information, or limits on processing. Email [email protected] to make a request; we may verify account ownership and explain any legal or shared-household retention limits. Do not send passwords or authentication codes.

9. Contact

For privacy questions or requests, email [email protected] with “Pantrove privacy” in the subject. Do not send passwords, reset links, or authentication codes.