Privacy policy

Who is responsible

KaamShaam is made and run by Abeera Umair, an independent developer. There is no company behind it and no other organisation involved. Questions about anything here go to support@wewiselabs.com.

What is collected, and why

This is the whole list. Nothing is collected that is not named here.

Your email address

To identify your account, to sign you in, and to send you the codes that confirm your address or reset your password. It is never used for marketing, because there is none.

Your display name

Shown to the other people in your household so they can tell who added or bought something. You choose it, and it does not have to be your real name.

Your password

Kept only as an Argon2 hash, which is a one-way fingerprint. The password itself is never written down anywhere, and it cannot be read back or recovered by anyone - including the developer. If it is forgotten, it is reset, never retrieved.

An identifier from Google or Facebook, if you sign in with one

A number that provider uses for your account, stored so that signing in again reaches the same KaamShaam account. Your email address and display name come across at the same time. Nothing else is requested, no password ever reaches KaamShaam, and KaamShaam cannot read anything else in your Google or Facebook account. Facebook's identifier is specific to this app: it means nothing anywhere else and cannot be used to find you on another service.

Which household you are in, and whether you own it

A household is the thing a list is shared inside. Your membership is what decides which list you see.

The household's name, its categories and its list names

They are what the household typed in. They are shown to every member of that household.

The shopping data itself - items, quantities, units, notes, preferred store, and whether something has been bought

This is the product. It is shared with everyone in your household by design.

Which account added each item and which marked it bought, and when

Stored with the item as a record of where it came from. The app does not show it to anybody: KaamShaam deliberately has no activity feed and no who-did-what screen. It is listed here because it is in the database, not because it is on a screen.

Your device's notification token and whether it is Android or iOS

So your phone can be told the shared list changed. It is removed when you sign out or delete your account.

Invitation codes, as a hash

So an invitation can be checked without the code itself being stored. The plain code exists only in the message you share.

Sign-in sessions and the codes emailed to you, stored only as hashes

A session record is what keeps you signed in without your password travelling again, and it is revoked the instant you sign out or delete your account. Verification and password-reset codes are held the same way, so the code sitting in your inbox exists in readable form only in that email and nowhere on the server.

A record of each change that syncs, with the device and the time

So the same change is never applied twice when a phone comes back online, and so two people editing at once produce one sensible result rather than a lost edit.

Server request logs - the method, the path, a request id and your IP address

To keep the service working and to rate-limit abuse: the limits are counted per address, so without it one machine could hold the door open on everyone's account. Passwords, tokens, invitation codes and request bodies are deliberately never written to a log.

What is never collected

Most apps collect at least some of the following. KaamShaam collects none of it, which is unusual enough to be worth stating rather than leaving to be assumed.

• No analytics and no telemetry. Nothing measures how you use the app. The Facebook sign-in library is capable of reporting app activity to Meta and is switched off so that it does not.
• No crash reporting. No third party is told when something goes wrong.
• No advertising identifier, no advertising, and no tracking across apps or websites.
• No location, at any precision.
• No contacts, no calendar, no photos, no camera, no microphone and no access to your files.
• No age or date of birth. The app is not directed at children and does not knowingly collect anything from them.

Your password cannot be recovered

Passwords are stored only as an Argon2 hash. A hash is a one-way fingerprint: it can confirm that the password you typed is the right one, and it cannot be turned back into the password. There is no plaintext password stored anywhere in the system.

This means nobody can tell you what your password is — not support, not the developer, nobody. A forgotten password is reset, never looked up.

Notifications never say what changed

Who can see your data

The other members of your household. This is the product working as intended, and it is the one thing worth being certain about before you start a list: everything in a household — every item, every note, who added it and who bought it — is visible to everyone in that household. It is shared property, not private notes.

The services that run KaamShaam. Running an app needs a few outside services, and each sees only what it needs to do its job:

• A hosting provider, which runs the server software and its logs.
• A database provider, which stores the data described above.
• An email delivery service, which sends verification and password-reset codes. It sees your email address and the code.
• A push notification service, which delivers the nudge to your phone. It sees your device token, and the notification carries no personal text.

They are named by role rather than by brand because a provider can be replaced without this policy changing meaning. They process data on instruction only, and none of them is given the data for their own use.

Nobody else. Data is never sold, never rented, never used for advertising and never shared with anyone beyond the services above — except where the law would require it, which has never happened.

How long it is kept

Your data is kept while your account exists. When you delete your account, your record is stripped of everything identifying within 30 days, and the household’s shared shopping data stays with the household.

The full explanation — the exact steps, the email route if you no longer have the app, what is removed and what is kept — is on the delete your account page.

How it is protected

• Everything between your phone and the server travels over HTTPS. A release build of the app refuses plain HTTP outright.
• Passwords are hashed with Argon2, the current recommended algorithm for the job.
• Signing in issues a short-lived token that is refreshed rather than a permanent one, so a captured token stops working quickly. Deleting your account or signing out revokes every session immediately.
• Invitation codes are stored as a hash, so a copy of the database does not let anyone join your household.
• Passwords, tokens, invitation codes and request bodies are never written to a log.

No system is perfectly secure, and it would be dishonest to say otherwise. What is promised here is the care taken, not a guarantee.

Your choices

• You can change your display name at any time in the app.
• You can leave a household, which ends the sharing without deleting your account.
• You can turn notifications off in your phone's own settings; the app keeps working.
• You can delete your account, which is described in full on the deletion page.
• You can ask what is held about you by emailing the address below, and you will be told.

Changes to this policy

If this policy changes, the date at the top changes with it. Changes that affect what is collected or who sees it will be described in the app before they take effect, not applied quietly.

Contact

support@wewiselabs.com