Privacy Policy

1. Introduction

Welcome to WhichDrawer ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, visit our website at whichdrawer.app, or use related services (collectively, the "Service").

By using WhichDrawer, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account, we collect your email address and password. If you sign in with Apple, we receive your name and email from Apple.
• Profile Information: You may optionally provide additional profile information such as your name or profile picture.
• User Content: Photos of items and organizers you upload, item names, descriptions, quantities, categories, and any other information you enter into the app.
• Feedback and Support: Information you provide when contacting us for support or providing feedback.

2.2 Information Collected Automatically

• Device Information: Device type, operating system version, unique device identifiers, and mobile network information.
• Usage Data: How you interact with the app, features used, time spent, and actions taken.
• Crash Reports: Technical information about crashes and errors to help us improve the app.
• Analytics and Session Replay: We use PostHog to understand how the app is used. This includes product analytics events (screens viewed, features used) and session replay, which records how screens are navigated and tapped. Replays are masked before they leave your device: every image (including your item and organizer photos), all text shown on screen (item names, labels, notes and anything you type) and, on iOS, system pickers such as the photo picker are replaced with placeholders. A recording shows the layout of the screen and where it was tapped, not the content of your inventory. Analytics is tied to your account identifier, never to your email address.

2.3 Information from Third Parties

• Authentication Providers: If you sign in with Apple, we receive basic profile information as permitted by your settings with Apple.
• Payment Processors: We use RevenueCat for subscription management. They process payments through Apple App Store and Google Play Store. We do not directly collect or store payment card information.

2.4 Information Collected on Our Website

Our website uses PostHog and Google Analytics (loaded through Google Tag Manager) to count visits and to learn which links bring people to it. Website analytics is never linked to a WhichDrawer account.

• Blog and guide pages: We record each page you view, the page that linked to it, any campaign tags in that link (such as utm_source), your browser and device type, an approximate location derived from your IP address, and whether you tap a link to the App Store. These pages set no cookies, store nothing on your device, and do not record your session; Google Analytics runs there with its storage consent set to denied.
• Home page: We record the same information. PostHog also stores a random identifier, the current visit's session ID, and the page and referring site of your first visit (including any query string) in a cookie and in your browser's local storage so that a repeat visit can be recognised. It keeps this visit's referring site and campaign tags in session storage. Google Analytics stores a random identifier and the current visit's session ID in two cookies, so that a repeat visit can be recognised. The home page does not record your session.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Create and manage your account
• Process subscriptions and transactions
• Enable features like AI-powered image search
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage trends and preferences
• Detect, investigate, and prevent security incidents and fraud
• Comply with legal obligations

4. AI-Powered Features

AI Photo Search finds items by what they look like. It uses Replicate, a third-party AI service. From app version 1.3.1, the app asks for your permission before it sends any photo there, and this section describes version 1.3.1 and later. Earlier versions sent the item photos you saved, and any photo you searched with, without asking; update the app to make your choice.

• What is sent: With your permission, the app sends Replicate the item photos you save and any photo you search with. Replicate turns each photo into a visual embedding (a numeric fingerprint) used to match photos of the same item. Nothing is sent before you allow it.
• Your choice: The first time you search with a photo or save an item with photos, the app asks whether to allow this. If you choose Not now, your photos still save, and text search, barcode scanning and everything else keep working; only AI Photo Search stays off.
• Turning it off: You can turn AI Photo Search on or off at any time in Account → Privacy. Turning it off stops the device you turn it off on from sending any further photo straight away. Your other devices running version 1.3.1 or later stop the next time the app on each is opened or comes back online; a device still on an earlier version does not stop, so update it. Embeddings already made stay in your account until you delete the photo, its item, or your account.
• Data Storage: Embeddings are stored securely in our database with the photo they came from, and are used only to provide search to you and the people you share that item with.
• Replicate's retention: Replicate removes the inputs and outputs of requests made through its API, including the photo, after one hour by default (Replicate data retention). Photos are otherwise handled under Replicate's own privacy policy.

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (hosting, analytics, crash reporting, payment processing).
• Shared Organizers: If you share an organizer with another user, they can view the contents you've shared.
• Community Templates: If you submit a layout template to the community, other users can see and use it. Your email and account details are not shown; a display name appears only if you choose to enter one when you submit.
• Legal Requirements: When required by law, legal process, or to protect our rights, privacy, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with password hashing
• Row-level security in our database
• Regular security audits and monitoring
• Access controls and employee training

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. You can request deletion of your account and data at any time. After deletion:

• Your personal data will be removed within 30 days
• Photos and item data will be permanently deleted
• Anonymized, aggregated data may be retained for analytics
• Some data may be retained as required by law

8. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your data in a portable format
• Opt-out: Unsubscribe from marketing communications
• Restrict Processing: Limit how we use your data
• AI Photo Search: Withdraw permission to send photos to Replicate at any time in Account → Privacy (section 4)

To exercise these rights, contact us at privacy@whichdrawer.app or use the in-app settings.

9. Children's Privacy

WhichDrawer is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We use Supabase for our backend services, which may store data in various regions. We ensure appropriate safeguards are in place for international transfers.

11. Third-Party Services

Our Service integrates with the following third-party services:

• Supabase: Backend and database services
• RevenueCat: Subscription management
• Replicate: AI image processing for AI Photo Search, only with your permission, as described in section 4
• Apple: Authentication and payments
• Google: Payments (Google Play); Google Tag Manager and Google Analytics on our website, as described in section 2.4
• Sentry: Crash and error monitoring. Reports carry your account identifier and technical diagnostics; they never include your email address, and request parameters that could contain what you typed are redacted before sending
• PostHog: Product analytics and masked session replay in the app, as described in section 2.2, and website analytics, as described in section 2.4
• Have I Been Pwned: Checks whether a password you choose has appeared in a known data breach. Only the first five characters of the password's one-way hash are sent; the password itself never leaves your device
• Cloudflare Turnstile: A security check that helps tell people from automated attacks when you sign in, create an account, reset your password or change it. Cloudflare receives technical signals from your device to do this, such as your IP address and device and browser characteristics. It does not receive your email address or password

Each service has its own privacy policy governing their use of your data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page
• Updating the "Last updated" date
• Sending an in-app notification or email for significant changes

Your continued use of the Service after changes indicates acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: