Privacy Policy

Effective date: 11 September 2026. This policy applies to the iTems apps for iPhone, iPad and Mac, the iTems web app, iTems accounts and iTems Cloud, receipt delivery from connected stores, and the website items-home.com.

The short version

  • iTems works without an account. Without one, your inventory lives on your own device and, if you turn on iCloud sync, in your own iCloud.

  • With an iTems account and iTems Cloud, your inventory is stored on our servers in the EU so it can sync between devices and be shared with people you choose.

  • AI features send only what is needed for the task you started — the text of a receipt, a product name or a photo — to an AI provider, and only when you use them. The providers do not use your data to train their models.

  • We do not sell personal data, we do not run advertising, and we do not track you across other apps or websites.

  • You can export your data and delete your account from inside the app at any time.

1. Who is responsible

iTems is developed and operated by Tommy Riise Handeland, Norway, who is the data controller for the processing described here. Contact: [email protected].

2. How iTems is built, and why it matters

iTems is local-first. The app keeps your collections, items, photos, receipts and documents in a database on your device. Nothing leaves the device unless you use a feature that needs a server: an iTems account, iTems Cloud sync, sharing, receipt delivery, AI features, support, or optional iCloud sync through Apple.

The sections below describe each of those situations. Read only the ones that apply to how you use iTems.

3. What we process, and why

3.1 Using the app without an account

Your inventory data stays on the device. If you enable iCloud sync in Settings, the same data is stored in your personal iCloud account under Apple’s terms and Apple’s privacy policy; we have no access to it.

The app sends usage statistics to our servers: which screens and features are used, app version, device model, operating system version, language and country, tied to a random identifier the app creates. This tells us which features matter and where the app fails. It is not used for advertising and is not shared with third parties. Legal basis: our legitimate interest in understanding and improving the product.

3.2 Your iTems account

When you create an account we process:

  • Name, email address and, if you add one, phone number. Email and phone are verified with a one-time code and are used to sign you in, to reach you about your account, and to match receipts delivered by connected stores.

  • A password, stored only as a salted hash, or a Sign in with Apple identifier if you sign up that way. Apple may give us a private relay email address instead of your real one.

  • Two-factor authentication data: an authenticator secret, or your phone number when you choose SMS codes.

  • Language, region, notification preferences and an optional profile picture.

  • The devices and sessions you are signed in on: device name and model, app and OS version, sign-in time, IP address and browser or app identifier. You can see and end sessions in the app.

  • Your subscription status: which iTems Cloud or PRO product is active and when it expires. We never see your payment card.

Legal basis: performance of the contract with you (providing the account), and our legitimate interest in keeping accounts secure.

3.3 iTems Cloud, sync and sharing

If you sign in and use iTems Cloud, the inventory you choose to sync is stored on our servers: collections, items and their fields, photos, receipts, files and documents, locations, categories, custom fields, maintenance logs, consumables and shopping lists, notes, and the activity log of shared collections. Some of that may be information about other people — for example an item’s owner, a person you note as heir to an item, or a contractor in a maintenance log. You decide what to record; please only record what you are entitled to.

When you share a collection, the people you invite see its contents and the activity log shows who changed what. Invitations are sent to the email address you enter, and members see each other’s name and profile picture. Members can leave, and owners can remove members, at any time.

Cloud storage is measured against your plan’s quota. When the quota is reached, new uploads are refused until you free space or upgrade; nothing is deleted.

Legal basis: performance of the contract with you. For information about other people that you record, you are responsible for having a lawful reason to do so.

3.4 AI features

Several features use AI models run by external providers. Each is started by you, and each sends only the input the task needs:

  • Receipt scanning: the app reads the text of a receipt on your device. That text (store, date, lines, amounts) is sent to OpenAI to be turned into items.

  • Product identification and bulk capture: the photo you take of a product, drawer or shelf is sent to Anthropic and/or OpenAI to recognise the items in it.

  • Technical specifications, maintenance advice and warranty estimates: the product’s title, and for warranties the purchase country and date, are sent to OpenAI.

  • Product photos: a product name is sent to Google Custom Search to find product images. Translation of some texts uses Google Cloud Translation.

The providers process the data on our behalf to answer the request and, under the API terms we use, do not use it to train their models. Requests are made from our server, so the providers do not receive your name, account or IP address. Photos and texts are not stored on our server beyond what is needed to complete the request. These providers are based in the United States; see section 5 on transfers.

Legal basis: performance of the contract, for the feature you chose to use. Results can be wrong; you always confirm before anything is saved.

3.5 Receipts from connected stores

Stores that integrate with iTems can send digital receipts to their customers. A store sends the receipt (PDF), the purchase date and the email address or phone number you gave the store. We match it against verified contact details on iTems accounts. If it matches you, the receipt appears in your app. If no verified account matches, the receipt waits and is delivered if that email or phone number is later verified on an account. You can delete delivered receipts in the app.

The store is responsible for having your permission to send the receipt. Legal basis for our part: performance of the contract with you, and the store’s and our legitimate interest in delivering receipts you asked for.

3.6 Support and feedback

When you contact us through the in-app Help Center, we store your messages and attachments together with diagnostic information the app adds automatically: app and OS version, device model, subscription status, notification setting, counts of items, collections, locations, files and photos, network type, screen size, language and time zone. We use this to answer you and to fix problems. Legal basis: our legitimate interest in providing support, and performance of the contract.

3.7 Push notifications

If you allow notifications, the app registers a device token with our server so we can notify you about warranties, maintenance, receipts and shared collections. The token is sent to Apple’s push service to deliver the notification. You can turn notifications off in system settings at any time.

3.8 Security

To protect accounts we keep a log of security-relevant events — sign-ins, failed attempts, verification codes, unusual activity — with IP address, browser or app identifier and time. Repeated abuse can lead to temporary blocking of an address or account. Legal basis: our legitimate interest in preventing abuse, and our legal obligation to protect personal data.

3.9 The website

items-home.com uses a first-party, cookie-free visit counter. For each page view we store the page path, the referring site, the country derived from your IP address, and a salted hash of your IP address and browser that cannot be turned back into either. The IP address itself is not stored. One cookie, items_market, remembers the region you picked. If you sign up for the beta program, we store your email address, language, time, IP address and browser identifier to send you the invitation and prevent abuse.

4. Who receives data

We use these service providers, who process data on our instructions under data processing agreements:

  • DigitalOcean (Amsterdam, the Netherlands) — servers, database and file storage for accounts, iTems Cloud and the website.

  • Cloudflare — network protection and delivery in front of our servers.

  • Apple — App Store purchases and subscriptions, Sign in with Apple, push notifications, and iCloud sync if you enable it. Apple acts under its own terms.

  • OpenAI (United States) — AI processing described in 3.4.

  • Anthropic (United States) — AI processing of photos described in 3.4.

  • Google — Custom Search for product images and Cloud Translation.

  • Postmark (ActiveCampaign, United States) — sending verification and account emails.

  • Infobip (EU) — sending SMS verification codes.

  • Pusher (EU cluster) — real-time updates between devices in shared collections.

  • Stripe — payment processing if you buy a subscription on the web instead of in the App Store. Stripe handles your card details; we receive the subscription status.

We share personal data with nobody else, except when the law requires it or to protect the rights and safety of users. We do not sell personal data.

5. Transfers outside the EU/EEA

Our own servers are in the EU. OpenAI, Anthropic, Google, Postmark, Cloudflare and Stripe may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses.

6. How long we keep data

  • Data on your device: until you delete it or uninstall the app.

  • Account and iTems Cloud data: for as long as your account exists. When you delete your account, the account and all inventory data stored in iTems Cloud are deleted immediately; copies in backups are overwritten within 30 days.

  • Sync history used to reconcile devices: 30 days. Sync state for devices that have not been used: 30 days.

  • Sign-in sessions and tokens: until they expire or you end them.

  • Security logs: 90 days for events, 180 days for alerts and blocks.

  • Support threads: for as long as your account exists, or until you ask us to delete them.

  • Website visit statistics: 400 days. Beta sign-ups: until the beta program ends or you ask to be removed.

  • Receipts from stores that could not be matched to an account: until they are matched, or you ask us to delete them.

7. Security

Data in transit is encrypted with TLS. Passwords are stored as salted hashes. Accounts can be protected with two-factor authentication. Access to production systems is limited to the people who operate the service and is logged. No system is perfectly secure; if a breach affects your data we will inform you and the supervisory authority as the law requires.

8. Your rights

Under the GDPR and the Norwegian Personal Data Act you have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to processing, and to receive your data in a machine-readable format. Where processing is based on legitimate interest you can object at any time.

Most of this you can do yourself in the app: Settings lets you edit your profile and contact details, export all your data, end sessions, and delete your account. For anything else, or if you use iTems without an account, write to [email protected]. We answer within one month.

If you believe we process your data unlawfully you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or to the authority in the country where you live.

9. Children

iTems is not directed at children. You must be at least 13 years old to create an iTems account, and where your country sets a higher age for consenting to online services, that age applies. If we learn that we hold an account for a younger child we delete it.

10. Changes to this policy

When we change how iTems handles data we update this page and the effective date at the top. For changes that matter to you we also tell you in the app or by email before they take effect. Earlier versions are available on request.

11. Contact

Tommy Riise Handeland, Norway. Email: [email protected].

This policy is written in English. Translations are provided for convenience; if they differ, the English version applies.