Cataloc — Privacy Policy

Last updated: 21 October 2026

What Cataloc stores, and where

Cataloc stores the following in its own private storage on your device:

• The households, containers and items you create, including their names, tags, quantities, expiration dates and loan details.
• The insurance details you choose to add to a thing: its value and currency, purchase date, brand, model, serial number and a photo of the receipt.
• The photos you take or choose, saved as files inside the app's own folder, and the date each photo was taken.
• A history of changes you have made within the app.
• Your settings: language, appearance, which household you last opened, whether you have allowed your phone's assistant and search to see your things, whether you have allowed an assistant to propose adding one, which reminders you have turned on and how far ahead they come, a record of which reminders have already gone off, which first-run tips you have already seen, whether the one-time store review request has already been made, the name this device goes by in a household's history, and what the store last told the app about your plan — whether PRO is active, and whether it was bought outright. That last pair is a copy of the store's own answer, kept so that opening the app without a network does not lock a paying customer out of their own catalogue. It is not a record of a payment, and it holds nothing about how you paid.
• If you have set up a shared folder, the password for it, and the key derived from your folder passphrase if you have locked one. If you password-protect your exports, that password too. All of these are kept in the device's own secure storage — the Keychain on iOS, the Keystore on Android — rather than alongside the catalogue.

Households are kept separate from one another: each has its own catalogue, search and history, and nothing passes between them.

None of this is transmitted anywhere by default. It is not backed up to any service run by the developer, because no such service exists.

Your device's own backup (iCloud Backup on iOS, or Google's backup on Android) may include this data if you have those features enabled. That is between you and Apple or Google, and is governed by their privacy policies.

Syncing a household across devices

Syncing is entirely opt-in. Neither method is set up out of the box, and there is no Cataloc account or Cataloc server in either one.

Pairing two phones directly

• One phone shares a household and displays a QR code and a single-use code, valid for five minutes. The other phone must present that code to connect.
• The two phones then exchange that household directly over your local network: its containers, items, tags, history, member names, and the photos attached to them.
• Nothing is sent to the internet by this method. There is no server in the middle, no relay, and no copy retained anywhere by the developer.
• The connection is open only while the invite or join screen is on screen. Cataloc does not listen on your network in the background and does not advertise itself.

Syncing through a shared folder

Instead of pairing in person, you can point several devices at one shared folder and let them keep each other current. This is off until you configure it under Settings → Shared folder.

• You choose the folder. It might be a drive on your own network or hosting space of your own. The sync screen names a few providers that hand you a WebDAV address, purely as examples of where to look — Cataloc has no default provider, no arrangement with any of them and no folder of its own, and the developer never learns the address you use.
• It runs on its own once you have set it up. Cataloc checks the folder when you open the app, and publishes what you changed about ten seconds after you stop changing it. There is no button and no schedule: the app reaches the address you gave it while you are using it, and at no other time. It never syncs in the background.
• A copy of the household — items, photos and history — is written to that folder. Anyone who can read the folder can read your catalogue, so treat access to it exactly as you would access to the data itself.
• Protection in transit is whatever the address you entered provides: an https:// folder is encrypted in transit, an http:// one is not. Prefer https://.
• You can lock the folder. Under Settings → Shared folder, "Lock this folder" encrypts everything Cataloc writes there — the containers, items, names, dates and the photos — on your phone, before it is sent. Whoever keeps the folder then holds files they cannot read. You choose a passphrase and type the same one into every phone that syncs there; it never leaves your devices, and there is no copy of it anywhere else, which also means nobody can recover it for you. Anything written to the folder before you turned the lock on stays there unencrypted until you delete it yourself, from the folder. Even with the lock on, whoever keeps the folder can still see how many devices publish to it, how many photos there are and how large each file is — never a name, a date or a picture.
• Whoever operates that folder — a hosting company, or you — is responsible for it, under their terms rather than this policy.

Either way, each device keeps its own complete copy. Removing a member on one device does not delete the copy already on the other — it only stops future syncs. Once you sync a household with someone, they hold a full copy of it, exactly as if you had handed them an export file.

Device name. Each install has a name — taken from your device's own name unless you change it — and a random identifier. These are shared only with devices and folders you have set up, so that changes can be attributed to a person in the household's history. They are never sent anywhere else.

Sharing, labels and export

Sharing a list. You can turn a shelf or a tag into a single web page, photos included, and hand it to your device's share sheet. It opens in any browser without an app or an account — which also means anyone who receives the page or its link can see everything on it, so share it only with people you would show the shelf to. If you switch on the "ask to borrow" button, you type in a WhatsApp number or an email address, and it is written into the page itself so that tapping the button opens a message to you. It travels with the file: anyone the page is forwarded to has that number or address, not only the person you sent it to. Left off — which is how it starts — nothing of the sort is included.

Labels. A printed label can carry a QR code, a short code and the container's name. Scanning the QR opens that container in Cataloc. Each of those elements can be switched off before printing, so a box that leaves the house need not carry its name or location on the outside. Printing or sharing a label produces a PDF through your device's own print and share systems.

Export everything. This writes a single JSON file containing your data and photos, and hands it to your device's share sheet. Where that file then goes is entirely your choice. Cataloc does not upload it anywhere.

Password-protected exports. Under Me, you can choose a password for your exports. Every export from then on is encrypted on your phone before it is written, with the same encryption as the folder lock, so having the file is no longer the same as reading it. The password is kept in the Keychain or Keystore so exporting stays one tap; it is never sent anywhere, and nobody can recover it for you — lose it and that file cannot be read again. Only the file's format, version and the date it was exported stay readable, so that Cataloc can tell you the file needs a password. Exports made before you turned this on stay as they were.

Insurance report

The insurance report turns your catalogue into one PDF: each thing with its photo and the day it was taken, its value, receipt, brand, model and serial number, grouped by where it is kept, with subtotals. It is built on your phone and handed to your device's print or share sheet. Nothing is uploaded by Cataloc; where the file goes from there is your choice.

Whoever receives the report can see everything in it — values, serial numbers and receipts included — and keeps their own copy. Send it only to people you would show those to. A shared web list never includes values or serial numbers. Syncing and exporting carry the insurance details like any other field of a thing.

Your phone's assistant and search

This is off when you install Cataloc. You are asked about it plainly while setting up, and you can change the answer at any time under Settings → Assistant. It is free, and consent is the only thing that turns it on: there is no subscription anywhere in this, and nothing at all happens until you say yes.

What it does

When you turn it on, Cataloc writes a list of your things into your phone's own search index — the one behind Spotlight on iPhone and behind system search on Android. For each container and item that list holds its name, the full path to where it is kept, its household's name, its tags, its short code, a reference to its photograph, how many of it there are, its expiration date if it has one, and — if it is out on loan — the name you typed for whoever has it.

That is what lets you search your phone rather than the app, and what lets you ask Siri or your Android assistant where something is and be told which shelf it is on.

The borrower's name is the one piece of this that is not yours. Ask where the drill is while it is lent out and the answer is "lent to Marta", because that is the useful answer — but it also means a name you typed about somebody else sits in your phone's index for as long as the loan is open. Marking the thing returned takes it straight back out, as does turning this setting off. If you would rather no borrower's name ever reached the index, either do not record who has your things or leave this setting off.

What this does and does not mean

• Nothing is uploaded. The index is on your phone. There is still no Cataloc server, and the developer still has no way to see any of it.
• It does leave Cataloc. This is the honest qualification to "everything stays in the app's own storage" above. The index belongs to the operating system, not to Cataloc, and what can read it is governed by Apple's and Google's rules rather than by this policy. On iPhone, Apple's own privacy policy covers Siri, Spotlight and Apple Intelligence; on Android, Google's covers system search and the assistant.
• Every household is included while the setting is on. There is no per-household switch.
• Turning it off removes it. Switching the setting off, or using "Remove everything from search", takes the whole list back out of the system index. Deleting a container or item removes it from the index too.

Letting the assistant add things

There is a second, separate setting, off unless you turn it on, which lets your assistant offer to add something to your catalogue.

An assistant can never write to your catalogue. When you ask one to add something, Cataloc opens with what it heard already filled in, and nothing is saved until you confirm it. Assistants mishear and they invent; this setting changes what they can propose, never what they can do.

Photographing a whole shelf

Cataloc lets you take one photograph of a shelf and tap or drag a box around each thing on it, giving each one a name and choosing whether it is an item or a container. Every thing you mark is saved with its own crop of that picture. This is free.

Nothing finds the things on the shelf for you. The boxes are where you drew them, and nothing is named unless you type a name or ask for a suggestion, as described under Name suggestions.

The cropping happens on your phone. The original picture of the shelf is discarded once the things you marked have been saved. Their saved crops can be copied to your chosen devices or shared folder if you enable household sync.

Name suggestions

On a phone with its own built-in AI model — an iPhone with Apple Intelligence turned on (iOS 27 or later), or an Android phone with Gemini Nano, such as recent Pixel and Galaxy models — a name field beside a photo shows a sparkle button. Tapping it asks that model, on your phone, what the thing in the photo is called — or, on a photo of a shelf, the thing inside the box you drew — and puts its answer in the field for you to keep, change or delete.

• Only when you tap it. Nothing is looked at when you take a photo, and nothing is ever named without you asking.
• On your phone only. Cataloc uses only the model built into the device: Apple Intelligence on iPhone, and Gemini Nano through Android's AICore. It does not use Apple's Private Cloud Compute, Google's online Gemini or any other online service, and neither the photo nor the answer is sent to an AI service. A photo and name you save can later travel through household sync. Apple's and Google's own privacy policies cover those models.
• It can be wrong. Results vary with the model, and AI makes mistakes. The name saved is whatever is in the field when you save.
• Only where the phone has such a model. On phones without one, or while it is still downloading, the button does not appear. Cataloc never starts that download itself.

Google's ML Kit on Android

On Android, two features run on Google's ML Kit library: scanning a label's QR code, and name suggestions. ML Kit sends Google diagnostic and usage information about how those features ran. Google lists it as:

• information about the device and the app, such as the phone model, the Android version and Cataloc's version;
• identifiers for the device and for this installation of the app;
• performance and error information, the settings the feature ran with, the size of what it processed, and its version;
• for name suggestions, the languages the phone is set to.

• Not your things. Google's list does not include your photos, the codes you scan, the names in your catalogue or the names the model suggests.
• Encrypted in transit, and not shared. Google says the information is sent over HTTPS and not passed to third parties. Google's privacy policy covers it.
• The developer never sees it. It goes to Google, not to Cataloc, and there is still no Cataloc server.
• Only when the feature runs. Nothing is sent while you do not scan and do not tap the sparkle.
• Not on iPhone. Cataloc's iPhone app contains no ML Kit: scanning and name suggestions use Apple's own frameworks, and nothing is sent.

Cataloc cannot delete what Google has received, because it never had it. “Delete all data” on the Me tab erases everything Cataloc keeps on your phone.

Permissions

Camera — requested when you tap "Take photo", and when you scan a label's QR code or a pairing code. Photographs are written to the app's storage and, if you enable household sync, copied to your chosen devices or shared folder. Declining the camera does not block anything: you can still pick pictures from your library, and items do not require a photo at all.

Photo library — requested only when you tap "Library". Cataloc reads only the single picture you select and stores a copy in its own folder. If you enable household sync, that copy can travel to your chosen devices or shared folder. Cataloc reads the date the picture was taken from its metadata; every other piece of metadata, location included, is dropped when the photo is re-encoded.

Local network (iOS) — requested the first time you sync, so that two phones can find each other on your Wi-Fi, or so Cataloc can reach a shared folder held on your own network. Used only for syncing.

Notifications — requested only when you turn on a reminder under Settings → Notifications, and never anywhere else. If you refuse, the switch stays off. Both reminders — for things you have lent out coming due, and for expiration dates — are off until you turn them on. They are scheduled locally, on your phone, from your own catalogue: there is no push service, no notification token and no server, and nothing about a reminder leaves the device. Only this phone is reminded; other members of a shared household are not, and the person who has something of yours is never contacted by Cataloc. Cataloc shows no badges.

The text of a reminder is written on your phone, and a loan reminder names the thing and the person you lent it to. Your phone may show that on its lock screen and on a paired watch, as it does any notification. If you would rather it did not, turn loan reminders off, or change how your phone previews notifications in its own settings. Turning a reminder off, or turning off notifications for Cataloc in your phone's settings, cancels everything already scheduled.

Cataloc requests no other permissions. It does not use location, contacts or the microphone.

What Android lists on the store page. Android prints every permission an app declares, including the ones granted automatically and never prompted for. Besides the camera, Cataloc's are: network access, and viewing and changing network and Wi-Fi state, used for syncing and nothing else — to reach a shared folder, and to find another phone on the same Wi-Fi when you pair two directly; posting notifications, asked for only when you turn a reminder on; running at start-up, which is how reminders already scheduled survive the phone being restarted, and which does nothing else; connecting to Android's on-device AI service (AICore), which is how a name suggestion reaches Gemini Nano on the phone and is not network access; preventing the phone from sleeping, declared by the library that loads photos, which may briefly hold the phone awake while it reads one; vibration, which React Native declares by default and Cataloc never uses; and Google Play billing, for buying Cataloc PRO, where Google handles the payment. That is the whole list. There is no location, no contacts, no microphone, no access to your phone's shared storage (a photo you pick reaches Cataloc through the system photo picker, one picture at a time), no fingerprint or face unlock, no push messaging, no app badges, no install tracking, no exact alarms, and nothing that lets the app draw over other apps.

In-app purchases

Cataloc is free for one household and 200 containers and items. Cataloc PRO lifts both limits and does nothing else: every feature described above — marking several things on one photograph, the insurance report, reminders, and letting your phone's assistant and search see your things — is free. PRO is $3.99 per month, $14.99 per year, or $29.99 as a single payment that never renews.

If you subscribe, the transaction is handled entirely by Apple or Google, using the payment method already on your Apple or Google account. Cataloc never sees your payment details, and there is no Cataloc account: renewals, price changes, refunds and cancellation are all handled by the store, and cancelling is done there rather than here. The developer receives the payout and the store's standard sales reporting, which contains no personal data.

Cataloc records only a local flag noting whether the store currently reports an active subscription, so the app works correctly when it is offline.

Nothing you have already catalogued is ever removed, hidden or made read-only, whether you subscribe, never subscribe, or subscribe and then stop.

Deleting your data

"Delete all data" on the Me tab erases every household, container, item, photo and history entry from the device permanently, takes everything back out of your phone's search index along with it, and cancels any pending reminders — with nothing left for them to be about, none are scheduled again. Deleting the app does the same.

Making it smaller. Settings → Storage is a gentler version of the same thing. It can re-encode your photographs at a lower resolution, delete photos that nothing in the catalogue uses any more, merge bursts of edits in the history into one line, delete history older than a date you choose, and forget old records of deletions once every phone in the household has synced past them. All of it is permanent, the screen shows how much it will free before you confirm, and none of it sends anything anywhere.

Because there is no server, there is no copy for the developer to hold, and therefore nothing to request the deletion of. Export first if you want to keep a copy — once it is gone, it is gone.

Copies you have already sent elsewhere are outside the app's reach: a shared sync folder, a device you paired with, an exported file, a shared page or an insurance report you sent all have to be deleted where they now live.

Children

Cataloc is not directed at children and collects no personal information from anyone, including children.

Governing law

This policy is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein.

This policy is published in French, in English and in Brazilian Portuguese. If there is any conflict or ambiguity between the versions, the French version governs.

Changes

If this policy changes, the updated version will be published with the app and the date above will change.

Contact

Questions about this policy: support@wiltonpelicari.com