oneroof Privacy Policy

Last updated: November 11, 2026

oneroof ("the app") is an iPhone app provided by Kenichi Kodani, an individual developer ("the developer"). This policy explains what information the app handles and how it is treated.

1. Principles

• The app helps families manage schedules, tasks, shopping, expenses and a family board.
• The developer does not collect data for advertising, tracking or analytics.
• Your family's data (events, tasks, shopping items, expenses, receipts, posts, attachments, presets, templates, budgets and so on) is stored on your device and in Apple's iCloud (CloudKit), as described below. The developer cannot access this family data.

2. Information stored on your device

The family data above and app settings (language, appearance, notification settings, favorite colors, saved filters and similar) are stored inside the app's container on your device. Family data also synchronizes with iCloud automatically from setup, as explained in section 3. Changes made while offline remain on the device until synchronization is possible.

3. iCloud (CloudKit) and sharing with your family

• Setup requires an Apple Account signed in to iCloud. When you create a family or join one by invitation, the app connects to that family's iCloud data. Family data you save then synchronizes automatically, even if you have not used "Save to iCloud" or invited anyone.
• The family creator's iCloud stores the family data in a private CloudKit database. Invited participants access it through CloudKit's shared database using their own Apple Accounts. The developer cannot read these databases.
• Inviting other people is optional and separate from automatic iCloud storage. Family members you invite can view and edit the shared family data. You can stop sharing, remove participants or leave a share from Settings > Sharing. After sharing stops, participants no longer receive updates.
• To identify "you" within the family, a SHA-256 hash of your CloudKit user identifier is stored in the shared zone. Your Apple Account email address and name are not stored.

4. Attachments and receipt images

• Photos and documents saved as attachments to events, tasks and posts, and saved receipt images, synchronize with iCloud automatically as family data. No separate invitation or manual cloud-save action is needed for this upload. Invited family members can view them.
• Receipt text recognition runs on the device; no external OCR or AI service is used.
• Photos saved in original quality may contain metadata such as the capture location.
• Newly saved receipt images expire 30 days after saving. When the app next checks an expired image, it removes the local copy; after a successful sync, it also clears the image from iCloud. The app no longer displays expired images, while the extracted text, line items and amounts remain. Older images without an expiry date follow the on-device retention setting for local copies. That setting cannot extend a 30-day expiry. “Remove from this device” deletes only the local copy; an iCloud copy remains until its expiry or deletion of the family's cloud data.

5. Calendar access

If you enable calendar import or export, the app reads and writes only the iPhone calendars you select. Calendar contents are never sent to the developer. Events saved by calendar import become family data and synchronize with iCloud and invited family members.

6. Microphone and speech recognition

Voice input converts microphone audio into text. On supported devices and languages this happens on the device; otherwise audio may be sent to Apple's speech recognition service. Recordings are not stored.

7. Camera

The camera is used to capture notices and receipts. Images used only for text recognition are processed on the device and are not uploaded. If you save an image as an attachment or save a receipt with its images, those images synchronize with iCloud automatically and are available to invited family members, as described in sections 3 and 4.

8. Feedback form

Messages sent from Settings > Support > Send feedback are transmitted over HTTPS to the developer's server (Cloudflare Workers) and stored as an issue in the developer's private GitHub repository, together with:

• the feedback type and message
• a reply email address (optional, only if you enter one)
• the app version, build number and iOS version

No family data, photos or identifiers are sent. Cloudflare processes your IP address temporarily for rate limiting; it is not stored in the issue. Stored feedback is deleted once resolved or on request.

9. Paid plan (subscriptions)

• Purchases, renewals, cancellations and refunds are handled by Apple's App Store (StoreKit). The developer never receives payment details such as card numbers.
• Entitlement checks happen on the device and are not sent to the developer's servers.
• Sharing a purchase through Apple Family Sharing gives members of your Family Sharing group Premium too. A oneroof invitation alone does not share Premium.
• Manage or cancel subscriptions in Settings > Apple Account > Subscriptions on your iPhone.

10. Notifications

Reminders for events and tasks are scheduled as local notifications on the device. The app receives silent notifications from iCloud to refresh family changes. The developer does not store notification tokens.

11. Tracking, advertising and analytics

The app uses no tracking, no advertising and no third-party analytics SDKs.

12. Children

Family data about children follows the same storage and sharing rules described above. The app has no separate developer-managed account; setup requires an Apple Account signed in to iCloud. Joining a family share uses the invited person's own Apple Account.

13. Deleting data

Deleting an item removes it from the app's current views. Previous contents remain in the local and iCloud change history and saved snapshots used for synchronization; item deletion is not permanent erasure of that history. Stopping sharing prevents future updates and does not erase copies already downloaded by participants. To remove the owner's cloud data, use Settings > Apple Account > iCloud > Manage Account Storage and remove oneroof's data. Each participant must separately remove their local app data and any exported copies. Change history, saved snapshots and attachments (except receipt images, which expire as described in section 4) are retained for as long as the owner's oneroof data remains in iCloud; the app does not compact or erase them automatically. Deleting the app removes its local container; copies in device backups may remain according to Apple's backup settings. To delete feedback you submitted, contact the address below.

In the app, Settings > Data > "Reset oneroof on this device" erases oneroof's data on that device and returns it to setup. For a participant, the app first attempts to leave the family share. If it cannot confirm departure, for example while offline or signed out, you can choose to erase the local data after a warning. This does not confirm removal of the former account from the share and does not delete the family's iCloud data. If necessary, ask the family creator to remove the former account in sharing settings.

The person who created the family can use Settings > Data > "Delete family" to delete the family's iCloud data (events, tasks, board posts, attachments and change history) for every member. Copies already on other family members' devices remain until each of them resets their own device.

14. Changes to this policy

When this policy changes, this page is updated together with the "Last updated" date.

15. Contact

Kenichi Kodani (individual developer) Email: support@kei.kyoto