Attic Privacy Policy

Last updated: 13 November 2026

Attic is a local-first household inventory and subscription tracker published by Low Noise Works. This policy explains how information is handled when you use Attic, including optional accounts, cloud sync, and household sharing where available in your version and plan.

Low Noise Works is responsible for personal data processed to provide Attic. For privacy questions, requests about your data, or account deletion, email [email protected].

Information Attic handles

Attic stores the information you choose to enter or import. This may include:

• Inventory item names, descriptions, serial numbers, categories, storage locations, purchase details, prices, warranties, and notes.
• Subscription names, providers, costs, billing dates, renewal details, and reminders. Tracking a subscription does not give Attic access to that provider's account or your bank account.
• Photos, receipts, documents, and text extracted from receipts.
• Settings, record identifiers, edit history, timestamps, and synchronization information.

Information may also be supplied by another member of a shared household. Avoid adding personal information about others unless you have an appropriate reason to do so. Storage locations are labels you enter, such as a room or cupboard; Attic does not need GPS location to provide this feature.

Local storage, accounts, and sync

You can use Attic's local inventory features without an account. Inventory and attachments are stored on your device. They are uploaded for cloud synchronization when you set up and use the relevant cloud features. Local-first does not mean that the app never makes network connections: security checks, Google SDK services, and font downloads may connect independently of inventory sync.

If you create an account, Firebase Authentication processes your email address, password credentials, account identifier, and verification and sign-in information. Account and household services also process membership roles, invitations, plan or entitlement information, device identifiers used for sync, and synchronization timestamps.

When cloud sync is active, records and supported attachments are processed through Google Firebase services, including Cloud Firestore and Cloud Storage. Cloud operations may use Cloud Functions. Availability and the data synchronized depend on the features enabled for your account.

Household sharing

If you create or join a shared household, other authorized members can access shared household content according to their permissions. Household administrators may access member contact information and manage membership. Invitations use the invitee's email address and an invitation code.

Share only information you intend household members to see. Removing access does not automatically erase copies already downloaded, exported, or saved by another person.

Google services and network requests

Receipt text recognition uses Google ML Kit on your device. Images and recognized text are not sent to Google by ML Kit for recognition. If you save a receipt or extracted information in Attic and use cloud sync, that saved content can be synchronized separately.

ML Kit can contact Google for updates and sends performance and usage metrics about its APIs. See Google ML Kit's privacy information.

Firebase and Google Play Integrity may process technical information such as IP addresses, app and device information, authentication activity, and integrity or security signals to operate services and prevent abuse. App security checks may run when the app starts. See Firebase's privacy information and Google's Privacy Policy.

Where fonts are downloaded at runtime, requests to Google's font servers may disclose your IP address and technical request information. These requests do not include your inventory or receipt content.

The current app does not include advertising SDKs, Google Analytics for Firebase, or Firebase Crashlytics. Technical processing by the services described above still occurs.

Device permissions

• Camera and selected photos: to capture or attach images and receipts when you choose those features.
• Files and documents: to import attachments or backups and save exports you select.
• Notifications and exact alarms: to deliver reminders on your device. Android may also allow reminders to be rescheduled after a restart.
• Internet access: for account, sync, security, and other network services described in this policy.

You can manage available permissions in your device settings. Denying a permission may prevent the corresponding feature from working. Notification text can be visible on your lock screen depending on your device settings.

How and why information is used

We use information to provide the features you request, manage accounts and sharing, synchronize data, deliver reminders, answer support requests, and protect the service.

Where the GDPR applies, we rely on performance of our agreement with you for requested account and cloud services; legitimate interests in maintaining service reliability, preventing abuse, and handling support requests; and legal obligations where processing is required by law. Where consent is required for particular processing, we rely on that consent and you may withdraw it. A device permission does not by itself replace any consent required by law.

An email address and authentication information are necessary to create and use an account. You can choose not to provide them and continue using local features. Attic does not make solely automated decisions about you that produce legal or similarly significant effects.

Data sharing and international transfers

We do not sell personal data or use inventory content for targeted advertising. Information is disclosed to Google services as described above, to authorized household members when sharing is enabled, and to recipients or applications you choose when exporting or sharing files. If you email us, your message and email address are processed through our Microsoft Outlook email service to handle your request.

Information may also be disclosed when required by law or where necessary to protect rights and investigate abuse. This policy does not control how independent recipients handle copies you share with them.

Service providers may process information outside your country, including in the United States. Cloud features are not limited to processing in the European Economic Area. Where applicable, Google's data-processing terms provide international-transfer safeguards, including standard contractual clauses or recognized adequacy frameworks. Details are available in Firebase's Data Processing and Security Terms. Contact us for information about safeguards applicable to your data.

Data retention and deletion

Local records remain in the app's storage until removed. Deleting an item from the interface can mark it as deleted for synchronization and retain record contents or history; it should not be treated as immediate permanent erasure. Clearing Attic's app storage removes that installation's local data. Exported files and copies held elsewhere must be deleted separately.

Cloud account and household data are retained to provide the account and synchronization services until they are deleted or an erasure request is fulfilled. Deleted-record markers and history may remain to support synchronization. Service-provider security logs and backup copies follow the relevant provider's retention processes. Information needed to comply with a legal obligation or resolve a dispute may be retained for that purpose.

Signing out, disabling sync, clearing local app storage, or uninstalling Attic does not delete your cloud account or cloud household. Signing out also leaves local content on the device. Syncing again can download information still held in the cloud.

Request account deletion

To request deletion of your Attic account and associated personal data, email [email protected] with the subject “Attic account deletion,” preferably from the email address used for the account. You may also request deletion of specific data without deleting your account. Do not send your password. We may need to verify your identity and clarify which shared household data is affected. Shared records involving other members require consideration of their rights; we will explain any data that must be retained and why.

Support correspondence is kept as needed to resolve and document your request, meet applicable obligations, and handle related disputes. There is no promise of immediate erasure from every backup or another member's device.

Exports and security

Backups, reports, and other exports can contain your inventory, financial details, documents, and personal information. Store and share them carefully. Copies sent to another app or storage provider are subject to that recipient's practices.

Cloud access uses authentication and access controls. These protections do not amount to end-to-end encryption, and local databases and exports should not be assumed to have separate app-level encryption. Protect your device, account credentials, and exported files. No storage or transmission method guarantees absolute security.

Your privacy rights

Depending on applicable law, you may request access to, correction of, deletion of, restriction of processing of, or a portable copy of your personal data. You may object to processing based on legitimate interests and withdraw consent where processing relies on it, without affecting the lawfulness of earlier processing.

Contact the email address above to exercise these rights. Where the GDPR applies, we normally respond within one month; if a permitted extension is needed, we will explain it. You can complain to your local data protection supervisory authority. These rights can be subject to legal conditions and exceptions. For data stored only on your device, we may need you to use the app's local controls because we do not hold a copy.

Children's privacy

Attic's household-sharing features do not require children to have accounts or provide personal details. If you believe a child has supplied personal data without the authorization required by applicable law, contact us so we can investigate and address it.

Changes to this policy

We may update this policy as Attic changes. The date above identifies the latest revision. Material changes will be communicated where required by law.