Privacy Policy

Last updated: 10 October 2026

Overview

AddItemTo is designed with privacy in mind. You can use the app without an account, and your data then stays on your device. Your data only reaches our servers if you sign in, use AI scanning or turn on sync. An account is needed for AI scanning, for Pro Cloud (cloud sync and sharing), for following an inventory someone has shared with you, and for the web app. You sign in with Sign in with Apple or with Google.

Data Controller

The data controller responsible for your personal information is:

Company Name: Add Item To Ltd
Company Number: 16799293
Trading Name: additem.to
Location: United Kingdom
Contact: privacy@additem.to

Legal Basis for Processing (UK and EU GDPR)

We process your personal data under the following legal bases:

• Using the app without an account: Legitimate interests (providing the app functionality on your device)
• Your account, Pro Cloud and the web app: Contract performance (providing sign-in, cloud sync, sharing and the web app)
• Payments and the web trial: Contract performance (taking payment and managing your subscription), and legal obligation (keeping financial records)
• AI scanning: Contract performance (providing the scan you ask for). We also record when you agreed to AI scanning
• Photos: Contract performance (storing and syncing the photos you add) and legitimate interests (service delivery)
• Website fonts: Legitimate interests (showing the website and web app correctly; see Service Providers)

Data Collection

Using the App Without an Account

• All item and location data is stored locally on your device
• No account or personal information is required
• Nothing is sent to our servers unless you sign in, use AI scanning or turn on sync
• Your data may be included in your iOS device backup if you have that turned on

Your Account (Sign in with Apple or Google)

To use AI scanning, Pro Cloud, the web app, or to follow a shared inventory, you must sign in. We collect:

• Account identifier: A unique user identifier from Apple or Google, depending on how you sign in
• Email address: With Sign in with Apple, only if you choose to share it (otherwise Apple gives us a private relay address). With Google, the email address of your Google account
• Name: The name Apple or Google shares with us, used to identify you in shared inventories
• Agreements: When you accepted our Terms of Service and this Privacy Policy, and which version
• Sign-in sessions: For each device or browser you are signed in on, its IP address and device or browser type, so you can see your sessions and sign them out. These are deleted when you sign out of that session or delete your account

Pro Cloud (Cloud Sync, Sharing and the Web App)

Pro Cloud collects:

• System-generated account identifier (linked to your Apple or Google sign-in)
• Item and location data synced to our secure servers, including anything you add in the web app
• Transaction history for audit purposes
• Subscription status and plan information

Payments

• App Store: In-app purchases are processed by Apple. We receive your subscription status and a transaction identifier from Apple. We never see your payment details
• Web: Web subscriptions are processed by Stripe. When you create an account on the web, we create a Stripe customer record with your email address and name, and start a 7-day Pro Cloud trial. No card is needed for the trial, and it ends by itself if you do not add one
• When you subscribe or add a card on the web, the payment page is run by Onelink, Stripe's merchant of record service. Onelink collects your name, billing address and payment details to take payment and work out any sales tax or VAT, sends your receipts, and handles payment support. We do not see or store your full card number
• Stripe's privacy policy applies to the data Stripe processes: stripe.com/privacy. Onelink's own terms apply at checkout and on link.com

Email Address Retention

If you provide your email address during sign in:

• Purpose: Used to identify your account, and only for critical account communications (subscription issues, security alerts, policy changes)
• Storage: Encrypted in our secure database with TLS encryption in transit and at rest
• Retention: Retained while your account exists, and deleted with your account
• Shared with: Stripe, if you create an account on the web (see Payments)
• Not used for: Marketing, newsletters or promotional emails
• Your control: Deleting your account deletes your email address. You can also contact privacy@additem.to

Note: If you choose to hide your email when you use Sign in with Apple, we receive a private relay email from Apple instead. This relay email is under Apple's control and we cannot use it to contact you directly.

NFC Tag Data

The app reads the unique identifier (UID) from NFC tags to identify items and locations. By default, nothing is written to the tag. If you choose to enable the optional Tap to Open feature, the app writes a single link to the tag (https://additem.to/t/ followed by a random code) so that tapping the tag can open the app. You can remove this link at any time by disabling Tap to Open.

Important: We do not store any personal information, item names, descriptions, photos, or other sensitive data on NFC tags. The tag carries at most its UID and, if you enabled Tap to Open, the random link. Both reference data stored locally on your device or, with Pro Cloud, in our cloud database. Anyone scanning an NFC tag sees only the UID or the random link. They cannot access your item information without having access to your additem.to account.

Camera Usage

The camera is used for photo attachments, OCR text scanning (Scan to Fill feature), and AI item scanning. Photos you choose to attach are stored locally on your device, with cloud backup for Pro Cloud users. Photos used for AI item scanning are handled differently: see the AI Item Scanning section below.

AI Item Scanning

The app includes an optional AI scanning feature that analyses a photo to identify an item and pre-fill its details. It only runs when you choose to scan an item. Nothing is sent for analysis automatically. Before your first scan, we ask you to confirm you understand how it works.

What happens when you scan an item:

• Your photo is sent over an encrypted connection to our server, which passes it to OpenAI's API for analysis
• OpenAI returns a set of suggested fields (item name, manufacturer, model, category, etc.), which you review and edit before anything is saved
• OpenAI may keep the photo for up to 30 days to monitor for abuse, then deletes it
• Our server holds the photo only until the scan finishes, then deletes it. The photo is only kept if you choose to attach it to an item
• AI scanning needs an account, on every plan including Free. Free includes a small number of scans, and paid plans include a monthly allowance

What we may store:

• We keep a record of each scan, linked to your account: the suggestions returned, the type of scan, whether it worked (and why not, if it failed), and usage details such as how many scans it used
• We use this to run the feature, handle any billing disputes, and improve scanning accuracy over time. It is not sold or used for advertising
• Scan records are kept while your account exists and deleted with your account

Your control:

• AI scanning is opt-in per scan. You choose when to use it
• It never runs automatically. Your photos are only analysed when you tap Scan with AI
• Choosing not to use it does not affect any other app functionality

OpenAI:

When you use AI scanning, your photo is processed by OpenAI. OpenAI's privacy policy applies to data processed through their API: openai.com/privacy. OpenAI states that API data is not used to train their models.

Location Information

The iPhone app can record your device's GPS coordinates during check-in and check-out transactions (optional, on by default). The Android app and the web app don't record location.

What we collect:

• Latitude and longitude coordinates
• GPS accuracy (in meters)
• Timestamp of GPS reading

What we DON'T collect:

• Background location tracking
• Continuous location monitoring
• Location data outside of transactions

How we use it:

• Provide an audit trail of item movements
• Verify transaction locations for security

Your control:

• On iPhone, you can turn GPS recording off in Settings at any time
• Disabling GPS will not affect any other app functionality
• GPS data is stored locally on your device, and synced to our servers only if you use Pro Cloud
• You can delete transactions to remove associated GPS data

Without Pro Cloud: GPS data is not sent to our servers (standard iOS device backup may apply)
Pro Cloud users: GPS data syncs with transactions to our secure servers

Photo Attachments

All users can attach photos to their items. Photos are always stored locally on your device. Pro Cloud users also get secure cloud backup.

What we store:

• Original photos you upload (stored in secure cloud storage)
• Compressed thumbnails for faster loading
• Photo metadata (filename, size, dimensions, upload date)
• Optional captions you add to photos

How we use it:

• Display photos alongside your items
• Sync photos across your devices (Pro Cloud users only)
• Share photos with users you've granted access to
• Create thumbnails for performance optimization

Your control:

• You can delete a photo at any time. It is removed from your device straight away and disappears from your other devices on the next sync
• The stored copy in our cloud storage is kept for up to 30 days so the deletion can sync everywhere, then it is permanently deleted
• When your Pro Cloud plan ends, your cloud photos are deleted from our storage 30 days later, with the rest of your cloud data
• Photos are also stored locally on your device for offline access

Important: Photos are subject to our content policies. See our Terms of Service for details on prohibited content and content moderation.

Content Moderation

We respect your privacy and do not proactively monitor or scan your photos. However, we reserve the right to review content if:

• Content is reported by another user
• We receive a legal request or court order
• We have reason to believe content violates our Terms of Service or applicable laws

Manual Review: Reported content is reviewed manually by our team. We do not use automated scanning or AI to monitor your photos under normal circumstances.

Illegal Content: If we discover illegal content (particularly child sexual abuse material), we are legally required to report it to the appropriate authorities:

• UK: Internet Watch Foundation (IWF) and National Crime Agency (NCA)
• International: National Center for Missing & Exploited Children (NCMEC)
• Law Enforcement: Local police authorities as required

To report abuse: If you encounter inappropriate or illegal content, please email abuse@additem.to with details. Reports are reviewed within 48 hours.

Data Storage & Security

• Local data is stored in a database on your device, protected by your device's built-in encryption
• Cloud data (Pro Cloud) is stored on secure cloud servers
• Photos (Pro Cloud) are stored in secure cloud storage with TLS encryption
• All data is encrypted in transit (HTTPS/TLS) and at rest
• We use industry-standard security practices
• Photos sent for AI scanning are processed by OpenAI, which may keep them for up to 30 days for abuse monitoring before deleting them
• We do not share your data with anyone except the service providers listed below

Service Providers

We use these companies to run the service. They process data on our behalf, or as separate controllers where their own terms apply:

• DigitalOcean: Hosts our API server and database (your account, Pro Cloud data and AI scan records)
• Cloudflare: Hosts this website and the web app, and stores cloud photos (Cloudflare R2)
• Apple: Sign in with Apple, and App Store payments
• Google: Google sign-in, if you choose it. This website and the web app also load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address to Google when a page loads
• Stripe: Web payments, the web trial and your Stripe customer record. Stripe's Onelink service sells web subscriptions as merchant of record
• OpenAI: AI scanning

International Data Transfers

If you sign in, use AI scanning, pay on the web or use Pro Cloud, your data may be transferred and stored outside the United Kingdom and European Economic Area (EEA). Several of our service providers, including Apple, Google, Stripe, Cloudflare and OpenAI, are based in the United States:

• Cloud Storage: Data stored in our cloud infrastructure may be processed outside the UK/EEA
• Safeguards: Our infrastructure providers offer Standard Contractual Clauses (SCCs) approved by the UK ICO
• Security: All data transfers use TLS encryption and enterprise-grade security

If you use the app without an account: your data is not sent to our servers. Standard iOS device backup (iCloud) may apply based on your iOS settings.

AI scanning: If you use the AI scanning feature, your photo is transferred to OpenAI's servers (United States) for processing. OpenAI participates in the EU-US Data Privacy Framework. You choose when to use AI scanning. It never runs automatically.

Analytics

We do not use any analytics or tracking services in the app, the web app or this website. Your usage patterns and behavior are not monitored or collected. Until you play a video, the only third-party request this website makes is for fonts from Google Fonts (see Service Providers). Videos in our guides load from YouTube (youtube-nocookie.com) only when you press play, and YouTube may then store data on your device.

Your Rights (UK and EU GDPR)

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

Right of Access

• Request a copy of your personal data
• Data kept only on your device: you already hold it, and you can export your items as CSV in the app on any plan
• If you have an account: download a copy of your data as a JSON file from Account in the web app, or contact privacy@additem.to

Right to Rectification

• Correct inaccurate or incomplete data
• Edit items, locations, and photos directly in the app

Right to Erasure ("Right to be Forgotten")

• Delete the app to remove all local data
• Delete individual photos (removed from your device straight away, and permanently purged from our storage within 30 days)
• Delete individual items, locations, or transactions in-app. Deleted items can be restored from Recently Deleted for 30 days, then they are permanently removed from your device (and, for Pro Cloud users, our servers), or sooner if you delete the inventory or your account
• If you have an account: delete your account in the app or the web app to permanently remove your account and all your cloud data from our servers immediately. This also deletes your Stripe customer record and cancels any web subscription. An App Store subscription is managed by Apple, so cancel it in your Apple account settings

Right to Restrict Processing

• End your Pro Cloud plan to stop cloud processing (your cloud data is then deleted 30 days after the plan ends)
• Turn off GPS recording in the iPhone app's Settings to stop location data collection

Right to Data Portability

• Export your items as CSV in the app, on any plan
• If you have an account: download your data as a JSON file from Account in the web app
• Contact privacy@additem.to to request data export

Right to Object

• Object to processing for direct marketing (we don't do any marketing)
• Object to automated decision-making (we don't use automated decisions)

Exercising Your Rights

To exercise any of these rights, contact us at privacy@additem.to. We will respond within one month.

Right to Complain

If you're unhappy with how we handle your personal data, you have the right to complain to the UK's data protection authority:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Add Item To Ltd's ICO registration reference: ZC021383

Data Retention

• Data on your device: Stored indefinitely on your device (until you delete it or the app)
• Pro Cloud items and locations: Retained while your Pro Cloud plan is active and for 30 days after it ends, then permanently deleted from our servers. Data held in the app on your devices is not affected, but if you only use the web app, this is your only copy
• Deleted items: Moved to Recently Deleted, where you can restore them for 30 days; after 30 days permanently removed from your device and, for Pro Cloud users, from our servers (or sooner if you delete the inventory or your account)
• Deleted photos and inventories: Kept for up to 30 days so the deletion can sync across your devices, then permanently removed from our servers
• Pro Cloud photos: Deleted from our cloud storage 30 days after your Pro Cloud plan ends
• Account details and AI scan records: Retained while your account exists
• After Account Deletion: Your account, including your email address, and all your cloud data and photos are permanently deleted from our servers at the time of your request. Your Stripe customer record is deleted at the same time. Stripe may keep payment records it must keep by law

Children's Privacy

AddItemTo is not directed to children under 13. We do not knowingly collect information from children.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted in-app with an updated date.

Contact Us

Questions about this privacy policy?

Email: privacy@additem.to