Privacy policy.

1. About this policy

Kokonomichi (“we,” “us,” or “our”) provides Lootcraft, a household inventory app (“the Service”). This policy explains how we handle personal information when you create an account, use the Service, or contact us.

Lootcraft helps you organize household items, manage storage locations, share inventory, and review consumption and waste. This policy applies to Lootcraft; it does not automatically apply to other Kokonomichi products.

2. Information we collect

Account and sign-in information

When you create an account, we collect your name and email address. For email-and-password accounts, our authentication system stores a hashed password and email-verification information.

If you choose Google sign-in, we receive your Google account identifier, email address, email-verification status, and, where provided, your name and profile picture. Our authentication system also processes and stores provider tokens and account-linking information. Google does not share your Google password with us.

Google sign-in requests the openid, email, and profile permissions. It does not request access to Gmail messages, Google Drive files, Calendar events, or other Google account content.

Household and inventory information

We store information you enter or generate in the Service, including household names, memberships and roles, storage names and descriptions, items, quantities, expiry dates, preferences, notes, and records of additions, consumption, and loss. Inventory records may identify the account that performed an action.

Receipt imports

If you use receipt import, we collect the photos, images, or PDF files you upload, file information, extracted text and item suggestions, your edits, and analysis results. Uploaded receipts may contain personal information printed on the receipt. You choose which files to submit.

Technical and support information

We process session identifiers, IP addresses, browser or device information, request and error logs, and timestamps to operate and protect the Service. We also process the information you send us when you contact support and records of verification-email delivery, including delivery failures and complaints where available.

Information stored on your device

The app uses secure device storage for authentication information and preferences, including your theme and inventory view. Browser-based authentication also uses cookies to complete sign-in and maintain sessions. Receipt selection and preparation may create temporary files in the app’s local cache.

3. How we use information

We use this information to:

• Create and manage accounts, verify email addresses, and authenticate users.
• Provide shared household inventory, storage management, reports, and other features you request.
• Process receipt imports and present suggestions for you to review before inventory changes are saved.
• Remember preferences, respond to support requests, and send account-related messages.
• Diagnose problems, prevent abuse, protect the Service, and meet applicable legal obligations.

We use information received from Google to support account creation, sign-in, account linking, and the account and household features described here. We do not sell Google user data or use it for advertising.

4. How information is shared

Other members of your household

When you create or join a household, other members can see your name, email address, membership role, and shared household information. Household inventory and receipt-import results are available to members of that household through the Service. Share household invitation codes only with people you want to join.

Service providers

We use Amazon Web Services (AWS) to host the Service, store the database and private receipt files, and maintain operational logs. We use Amazon Simple Email Service (SES) to send verification emails. SES processes your email address, name where included, verification link, and delivery information to deliver these messages.

Optional AI receipt processing

If you choose to submit a receipt for analysis, we send the uploaded image or PDF and household inventory context to OpenAI. This context includes household item names, identifiers, units and quantities, and storage identifiers, names, types, and descriptions. We use the results to suggest inventory additions for your review.

The receipt-analysis request does not include your Google sign-in profile or authentication credentials. Personal information contained in the uploaded document is included in the content sent for analysis.

You can use manual inventory entry without submitting receipts for AI analysis.

Connected tools

If you authorize a connected tool or assistant to access your inventory, it can receive household inventory information and, where you grant permission, make inventory changes. Information received by an external tool is also subject to that provider’s policies.

Legal and security purposes

We may disclose information when required by law or when reasonably necessary to investigate abuse, protect users, or protect the Service.

Google processes information under its own Privacy Policy.

5. Storage and security

Account, household, inventory, and import records are stored in a server database. Uploaded receipt files use private object storage. Authentication information and preferences are also stored on your device as described above.

We host the Service in the AWS US East (Northern Virginia) region (us-east-1), in the United States. Depending on where you live and which providers process a request, information may be processed outside your country.

We use safeguards designed to protect information, including encrypted connections, encrypted hosted database and file storage, private file access, and account and household access checks. No method of transmission or storage is completely secure.

6. Retention and deletion

We retain account information while your account is active and as needed to provide the Service. Household information is retained while needed by the household. The following retention periods apply to our hosted systems:

Uploaded receipt files

Scheduled for expiry 90 days after storage. Files may be deleted sooner, including when an import is dismissed.

Automated database backups

Retained on a rolling 30-day basis.

Application logs

Retained for 30 days.

Extracted receipt results and inventory history

Retained while needed by the household to provide inventory features and history, or until removed through an applicable deletion request.

Uploaded files, extracted results, and saved inventory are separate records. File expiry does not automatically delete information already extracted from a receipt or saved to household inventory. These retention periods describe our hosted systems; copies processed by external providers are also subject to their applicable terms, retention settings, and legal obligations.

Deleting your account or personal information

To request deletion of your account or personal information, contact support@kokonomichi.io. We may need to verify your identity to protect your account.

We handle requests within applicable legal deadlines. When we delete your account, we remove your account and personal information from our active systems. Shared household inventory and history may remain available to other members after we remove information identifying you from those records.

Deleted information may remain in existing automated database backups until they expire within the normal 30-day retention cycle. We may retain limited information where required by law or necessary to address security incidents or legal claims, and only for as long as necessary for those purposes.

7. Your choices and requests

You choose whether to sign in with Google or use email and password, which household information to enter, and whether to upload receipts. Camera and photo access are requested when you use those features; you can manage permissions through your device settings.

You can review and remove the app’s connection to your Google account in Google Account settings. Removing that connection does not automatically delete your Lootcraft account, end existing Lootcraft sessions, or erase information already stored by the Service. Contact us separately to request account deletion.

Contact us to request access to, correction of, or deletion of your personal information, or to ask about other rights available under applicable law. You can also contact us about access granted to a connected tool. Information already received by that tool may need to be managed with its provider.

8. Age requirement

Lootcraft is intended for adults aged 18 or older. You must be at least 18 to create an account or use the Service.

9. Changes to this policy

We may update this policy as the Service or its data practices change. We will publish the revised policy here and update its date and version. Where required, we will provide notice and obtain consent before using information for a new purpose.

10. Contact

For privacy questions and requests, contact Kokonomichi at support@kokonomichi.io.