The short version
PickUp Note works with no account and no server. You can install it, write down your errands and lists, save the places that matter to you, note where you parked and get reminded at a useful moment — and none of that leaves your phone. Most people who use PickUp Note never send us anything at all.
A small number of features do need our server, and each of them is something you turn on: sharing a list with your household, signing in, encrypted backup, exporting your cloud data, validating a purchase, notifications about shared lists, and three lookups the app makes on your behalf (a barcode, the weather, a place). Every one of them is off until you switch it on.
- No advertising, no tracking, no advertising identifier. The app asks for none and contains no advertising or tracking software.
- This version of PickUp Note contains no analytics and no crash reporting.
- PickUp Note keeps no continuous location history — not on your phone and not on our server.
- We never see your card. Purchases go through Apple and Google; payment details never reach us.
- Your backup is encrypted on your phone before it is uploaded, and we cannot read it.
1. Who is responsible for this policy
The company responsible for PickUp Note and for the decisions described here is [TO BE COMPLETED: legal entity name], registered at [TO BE COMPLETED: postal address]. You can reach us about anything in this policy at [email protected].
Where the law requires a named data protection officer or an EU/UK representative: [TO BE COMPLETED: data protection officer or representative, or a statement that none is appointed].
2. What stays on your phone
Unless you switch on one of the optional features in section 3, everything PickUp Note holds is stored only on your phone, in the app’s own private storage:
- Your errands and reminders, your lists and list items, and their notes.
- The places you save yourself, with their names, coordinates and radius.
- Where you parked, with any photo, note or timer you attached to it.
- Photos you take inside the app.
- Which barcodes you have scanned and what you named them.
- Your settings, including which features and which context sources you have enabled.
- The app’s working notes about why it suggested something, and its record of which notifications it sent or held back. These carry no text of yours — only categories, codes and identifiers.
Your calendar, if you allow access to it, is read on the phone and stays there. PickUp Note stores only the identifier and the start and end time of an event it has linked to an errand, plus a one-way fingerprint of the title so it can notice the event was renamed. Calendar titles and contents are never uploaded.
The camera is used only to read barcodes. The image is decoded on the phone and discarded; camera frames never leave the device and there is no mechanism in the app that could upload one.
3. What leaves your phone, and only when
None of the following happens when you first install PickUp Note. Each one starts only when you take the action that starts it, and each can be stopped again.
| When you… | What leaves your phone | Who receives it |
|---|---|---|
| Sign in | Your e-mail address if you use the e-mail sign-in link; otherwise the account identifier and, if you allow it, the name and e-mail that Apple or Google chooses to pass on. Also basic details of the phone itself: platform, model name, OS version and app version. | PickUp Note’s server. Apple or Google see that you signed in to PickUp Note. |
| Share a list or errand with your household | The content you shared — titles, notes, quantities, and any price or shop name you typed — plus who created, claimed, bought or cancelled each item, and when. | PickUp Note’s server, and the household members you invited. Nobody else. |
| Invite someone to your household | The address you typed, and a single-use invitation link. | PickUp Note’s server, and whoever you send the invitation to. |
| Turn on encrypted backup | An encrypted copy of your personal lists and reminders. See section 5. | PickUp Note’s server, which cannot read it. |
| Ask for a copy of your cloud data | Nothing new. We assemble what we already hold into a file for you to download. | You. |
| Buy something in the app | The receipt or purchase token that Apple or Google issues, so we can check it is genuine and unlock what you paid for. Never your card, bank or billing details — we never receive those and never see them. | PickUp Note’s server, and Apple or Google, who processed the payment. |
| Receive a notification about a shared list | A push message carrying only identifiers: a message type, the household, the kind of thing that changed, its identifier and a version number. No titles, no names, no item text, no location. The words you actually read are written by the app on your own phone. | Apple’s and Google’s push services, then your phone. |
| Scan or type a barcode we do not recognise | Only the barcode number. Never the photo, never your list, never your household or its name, never your notes. | PickUp Note’s server, and from there a product database (see section 8). |
| Use a weather-based reminder | A 0.25° grid square — a box roughly 28 km across — and nothing finer. See section 4. | PickUp Note’s server, and from there a weather source (see section 8). |
| Search for a place, or look for shops near you | The words you typed, or a search point rounded to about 110 m, and the category you asked for. Never your saved-place names, never your list text. | PickUp Note’s server, and from there a map data source (see section 8). |
What sharing a household necessarily reveals. A shared list is shared. The other members can see what is on it, and they can see who added, claimed, bought or cancelled each item. That is what the feature is for, and it cannot be switched off inside a shared list — only by not sharing, or by leaving the household. Your personal lists, your private saved places, your location, your calendar, your battery and whether you are moving are never visible to them.
The lookups above are made by our server on your behalf, not by your phone directly. That is deliberate: the product database, the weather source and the map data source never see your IP address, and never receive any identifier for you, your phone or your household. Results are cached on our side so that repeated questions do not reach them again.
4. Location
PickUp Note keeps no continuous location history. It does not record where you have been, it does not build a timeline of your movements, and it does not send your position to our server or compare your position with anyone else’s. There is no place in the app, and no column on the server, that a location trail could be written to.
Location is used in five bounded ways, and only these:
- Places you save yourself. You create them; they carry the name, coordinates and radius you chose. They stay on your phone unless you deliberately share a place with your household, in which case its coordinates travel to the members of that household so their phones can use it too.
- Arrival reminders. If you grant location permission, the app asks the operating system to tell it when you enter or leave a place you saved. The watching is done by iOS or Android, not by us, and what we receive is “you arrived at the place you called Supermarket” — not a coordinate, and not a stream.
- Where you parked. Saved when you ask for it. It stays on your phone and is never uploaded, to us or to anyone. The app keeps at most the five most recent parking spots and nothing older than 30 days.
- Weather. The app snaps your position onto a fixed 0.25° grid square — a box roughly 28 km across — and asks about that square. A more precise coordinate is refused by the server outright rather than quietly rounded, and nothing more precise is ever stored. The forecast for a square is shared by everyone who asks about it, and the record of it carries no user, phone or household. A square nobody has asked about for seven days is deleted.
- Nearby place search. The centre point is rounded to about 110 m before it leaves your phone. Our server keeps one row per phone holding that rounded point and the time of the last search, overwritten each time, so it can enforce its own rule that a nearby search happens only when you have actually moved. It is one row, never a list, so there is no trail to reconstruct, and it is deleted after seven days without use. We are stating this rather than describing the searches as leaving nothing behind, because that would not be true.
Everything else the app knows about your situation — whether you are moving, whether you are in a vehicle, your battery level, what your calendar looks like — is held in memory for the length of one decision and then discarded. It is never stored and never uploaded.
5. Encrypted backup
Backup is off unless you switch it on. When you do, your phone generates a key, keeps it in the phone’s own secure keystore, and encrypts every backup record with it before upload. PickUp Note holds no key, keeps no copy of yours anywhere, and has no way to obtain one: we cannot read it.
The honest limit of that statement: our server does see the routing information it needs to store and order the records — what kind of record it is, its identifier, its version number, when it was last changed, whether it has been deleted, and how large it is. It does not see the contents.
This means we cannot recover your backup for you. When you turn backup on, the app shows you a recovery code. It is the only way to read your backup on another phone. Write it down. Nobody, including us, can regenerate it.
Photos, parking spots, notification history and your settings are not included in backup; they stay on your phone only.
6. No analytics and no crash reporting
This version of PickUp Note contains no analytics and no crash reporting. There is no usage-measurement code in the app, no crash reporter, and no server that receives either. We do not count screens you opened, features you used or how long you spent doing it.
This is a deliberate choice rather than an oversight. The ordinary way to add crash reporting ships the text of an error along with it, and error text is exactly where this project has repeatedly found private values escaping. If a future version adds either, it will be optional, off by default, described here before it ships, and this page will say so.
7. No AI, no profiling, no automated decisions about you
PickUp Note uses no artificial intelligence, no machine learning and no predictive model. When the app decides that now is a good moment to remind you of something, it is applying deterministic rules — ordinary conditions such as “this errand is tagged for this shop”, “you are within its radius”, “it is inside its opening hours” — that run entirely on your phone. The app can show you every condition that contributed, in plain sentences, on its “Why now?” screen.
We do not profile you, and no decision about you is made automatically. Nothing in PickUp Note scores you, classifies you, predicts your behaviour or makes a decision that produces a legal or similarly significant effect. Your content is never used to train any model, ours or anyone else’s.
8. Other companies involved
We keep this list short on purpose. These are the only third parties that receive anything, and this is everything each one receives.
| Who | What for | What they receive |
|---|---|---|
| Apple | Sign in with Apple; App Store purchases; push notifications; on-device map search | For sign-in, that you signed in to PickUp Note. For purchases, the payment itself — we never see it. For push, a message containing only identifiers and version numbers. Map searches you type on an Apple device are handled by Apple under its own rules and never pass through us. |
| Sign in with Google; Google Play purchases; push notifications | The same three things, in Google’s equivalents. | |
| Open Food Facts | Naming a product from its barcode | Only the barcode number, sent by our server. No identifier for you, your phone or your household, and not your IP address. |
| OpenStreetMap data services (Nominatim for search; Overpass for nearby places and opening hours) | Finding a shop by name, finding shops near you, and their opening hours | The words you typed, or a point rounded to about 110 m, and a category. Sent by our server, so no identifier for you and not your IP address. Place data is © OpenStreetMap contributors. |
| Weather source: MET Norway (forecasts) and MeteoAlarm (severe-weather warnings) | Forecasts and severe-weather warnings | Only the 0.25° grid square, sent by our server. Warnings are fetched per country on a fixed schedule and are never requested per person, so they reveal nothing about where anyone is. |
| E-mail delivery: [TO BE COMPLETED: e-mail delivery provider] | Sending the sign-in link, and notices about account deletion | Your e-mail address and the message. |
| Hosting: [TO BE COMPLETED: hosting and object-storage provider(s)] | Running the server and storing what section 3 describes | Whatever our server holds, stored on their infrastructure on our instructions. |
We do not sell your data. We do not share it for advertising. We do not disclose it to anyone outside this list, except where we are legally obliged to and where the law permits us to tell you.
9. Your rights, and the buttons that exercise them
Depending on where you live, you may have rights to access your data, to receive a copy of it, to correct it, to have it deleted, to object to or restrict how we use it, and to complain to a supervisory authority. We do not charge for any of this and you do not need an account to use the parts that work on your phone.
Getting a copy
- Settings › Data Export builds a complete copy of everything on your phone, as machine-readable files plus your photos. It is assembled on the phone and goes nowhere until you choose to send it somewhere. This works with no account.
- The same screen requests a copy of everything we hold in the cloud for your account, if you have one: your profile, your devices, your purchases, your household memberships and the shared content you can see, plus your encrypted backup exactly as it is stored — only you can decrypt that part. The file is available for 7 days and is then deleted automatically. One request per day.
Deleting
- Settings › Privacy switches off any context source, and includes a way to delete everything the app holds on this phone.
- Settings › Account Deletion deletes your account. Your sessions and push registrations are revoked at once, and nothing is destroyed for 14 days so that you can change your mind — signing in again during that time cancels it. After that we permanently delete your profile, your devices and push registrations, your encrypted backup, your export files and the invitations you sent.
- Shared household history is not destroyed with you, because it belongs to the household as much as to you: the record that a shopping item was bought survives, but your name is replaced with “Former member” and the link to you is severed, so the history stays intact and nobody can tell it was you.
- If you own a household that still has other people in it, you have to hand it over or delete it first. We will not silently delete another family’s shared data on your way out.
- Deleting your account does not touch what is on your phone. PickUp Note keeps working without an account; if you also want the local copy gone, use the local delete above.
To exercise a right that is not a button in the app, write to [email protected]. We may need to confirm you control the account before we act on a request about it.
10. How long we keep things
| What | How long |
|---|---|
| Everything on your phone | Until you delete it. Completed list items are cleared after 90 days by default, and you can change that. The app’s own working notes about its decisions are kept 7 days, its suggestions 30 days, and its record of notifications sent 90 days. |
| Parking spots | The five most recent, and nothing older than 30 days. |
| Shared household content | Until it is deleted, or the household is. |
| Household invitations | 72 hours, then they expire. You can revoke one sooner. |
| Encrypted backup | Until you turn backup off, delete your cloud data, or delete your account. |
| Cloud export files | 7 days, then deleted automatically. |
| Account deletion | 14 days of grace, then permanent deletion. |
| Push registrations | Removed as soon as Apple or Google tells us the registration is dead, and in any case after 90 days without renewal. |
| Weather forecast for an area | Deleted once nobody has asked about that area for 7 days. |
| The rounded search point behind a nearby search | One row per phone, overwritten each time, deleted after 7 days without use. |
| Cached place details / opening hours / product names | 7 days / 24 hours / 30 days. These caches are keyed on the search term, the place or the barcode, and hold no link to any person. |
| Server records that stop a repeated request being applied twice | 30 days. |
| Server logs and security records | [TO BE COMPLETED: the log and audit retention this deployment is actually configured for. The app records these entries without any content — identifiers, event codes and timings only — but the period is a hosting setting, and stating one we do not enforce would be a false promise.] |
| Encrypted off-site database backups | [TO BE COMPLETED: backup rotation period. Deleted records survive in these until the rotation completes; they are restored only for disaster recovery.] |
11. Children
PickUp Note is a household errand app and is not directed at children. It carries no advertising, no social features and no way for a stranger to contact anyone — joining a household requires an invitation that only an existing member can issue. We do not knowingly collect anything from a child under [TO BE COMPLETED: minimum age, per the jurisdictions the app is sold in]. If you believe a child has given us information, write to [email protected] and we will delete it.
12. How we protect what we do hold
- Everything between the app and our server travels over HTTPS; the app refuses to talk to a server that is not using it.
- Sign-in tokens are held in the phone’s secure keystore, never in ordinary storage.
- Every request for household data is checked against your membership on the server before a single row is read.
- Your content is deliberately kept out of logs: they carry identifiers, codes and timings, never titles, notes, coordinates, tokens or receipts.
- Backups you upload are encrypted before they leave your phone, with a key we do not have.
No system is perfectly secure, and we do not claim otherwise. If something goes wrong in a way that affects you, we will tell you and the relevant authority where the law requires it.
13. Where your data is handled
Our server and its storage are operated in [TO BE COMPLETED: hosting region(s)]. Apple, Google and the data sources named in section 8 operate their own infrastructure internationally under their own terms. Where personal data is transferred out of the region you are in, the legal basis for that transfer is [TO BE COMPLETED: transfer mechanism, e.g. standard contractual clauses].
14. The legal basis for what we do
Where the law asks us to state one: we handle the data described in section 3 because it is necessary to provide the feature you asked for, or because you consented to that feature when you switched it on — and you can withdraw that consent at any time by switching it off. Purchase records are kept because we are required to. This policy is governed by the law of [TO BE COMPLETED: governing law and the supervisory authority you may complain to].
This section describes our practices. It is not a statement that any particular regulation has been satisfied — that is a legal conclusion, and one for our counsel and the relevant authority to reach rather than for us to assert on a web page.
15. Changes to this policy
If we change how PickUp Note handles your data, we will update this page and change the effective date at the top. For any change that materially affects what we collect or what we do with it, we will tell you inside the app before it takes effect, and where a feature relies on your consent we will ask again rather than carry the old answer forward. Older versions remain available on request.
16. Contact
[TO BE COMPLETED: legal entity name],
[TO BE COMPLETED: postal address].
E-mail: [email protected].
Language. This policy is published in English only. The PickUp Note app itself is available in ten languages, but a privacy policy is the legal description of what the software does with your data, and a machine translation of one is a liability rather than a courtesy: a mistranslated retention period or a softened promise would misinform you. If we publish it in another language, that version will have been prepared by a human translator, and the English text will remain the authoritative one.