Privacy
Last updated: November 2, 2026
What Inventory stores
- Your email address, to know whose inventories they are. You can own 3 inventories.
- For each inventory: its name, the email addresses of its members (up to 5, the people you add), and the time it was made.
- For each item: the name and the quantity. If you add them, also the unit, low stock level, location, SKU or barcode, tags, notes and price. It also has the time of the last change. A deleted item stays as an empty mark, so that the phones of your team do not bring it back.
The names and the notes are text that you write. Do not write more than you want the people of your team to see. An inventory can have 10,000 items.
Who can see an inventory
Only the members. The owner adds a person by email address. The person signs in with that address and then sees the inventory. The app sends no email. A member of one inventory can never read the items of another inventory. A person who is not a member gets "not found". Inventory pages are hidden from search engines.
A QR code label holds only the address of an item, such as /t/<inventory>/i/<item>. It holds no secret and no data. A person who scans it sees the item only if they are signed in and are a member.
Where, and for how long
Each phone keeps a copy of the inventory in the browser (IndexedDB and local storage), so the app works with no network. When you sign out, the phone deletes that copy. The server keeps the inventory in a Cloudflare D1 database until the owner deletes it, or deletes their account. The server deletes nothing by itself.
The owner can choose "Delete inventory" in the settings. That deletes the inventory, its items and its members. A member can choose "Leave inventory". Cloudflare D1 keeps point-in-time backups of the database for up to 30 days, so deleted data can stay in a backup for that time. Nobody reads these backups except Kevin, and only to restore.
Delete my account
Sign in and choose "Delete my account". The server then deletes every inventory you own, with all its items. You leave the inventories of other people. It also deletes your sign-in account. This cannot be undone.
Your sign-in is shared with Kevin's other apps. So you are signed out of them too. A request goes to Kevin automatically. He deletes what those apps keep for your account within 30 days of your request.
Signing in
To sign in you use Google (on Google's site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on utilarium.app for 30 days. Inventory pages ask the sign-in service whether you are signed in. That request goes to auth.utilarium.app and carries your sign-in cookie if you have one. It carries none of your data. For details, read the sign-in section of Coro's privacy page.
You can also try the app without an account. A trial inventory stays on your phone and the server never sees it.
The camera
The Scan button uses the camera of your phone to read a code. The picture stays on your phone. The page sends nothing to a server and keeps no picture.
Counts and error reports
Cloudflare, the host, counts requests to the site. The count has none of your data. Cloudflare also measures visits with Cloudflare Web Analytics. It sets no cookies. Our own code sets no cookie and keeps no profile of you. Only the sign-in service sets a cookie, and only when you sign in.
When you make an inventory, add an item, print labels, or import or export a CSV file, the page sends one anonymous count. It has the tool, which job (for example "labels_printed"), the page type, a random number for this page load, and mobile or desktop. No cookie, no IP address, no name, no item, no email.
The Worker also counts, with no content, how many writes it handles and how often a limit stops a request. If the page has an error, it sends a report with the error message, page type and browser. It has no item, name or email. Cloudflare keeps technical request logs, with no IP address, for 7 days.
Your rights, your contact and the law
Who is responsible
I am Kevin Amado, and I am responsible for the data in Inventory. I am one person in Alberta, Canada. Write to kamadorueda@gmail.com with any question or request about your data.
Why data is used, and for how long
- Counts, error reports and logs: to run the tool and fix errors. The legal basis is my legitimate interest. Counts stay 90 days. Logs and error reports stay 7 days. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.
- Cloudflare also records about one request in ten in more detail. That record has your browser, operating system, language, network and approximate location (country, region and city). It is deleted after 7 days.
- Features you turn on, such as sign-in, sync, reminders or sharing: to give you that feature. The legal basis is your consent or our contract. This page says how long each kind of data stays.
- Data in your browser: I do not receive it. It stays until you clear it.
Who receives your data, and where it goes
Cloudflare hosts this tool and handles the data for me. It works in the United States and in other countries. For transfers from the EU and the UK, it relies on the EU-US Data Privacy Framework and standard contractual clauses. Cloudflare Web Analytics counts visits to this page with a small script. Cloudflare says that it uses no cookies and does not identify you. If you sign in with Google, Google receives your sign-in request. I do not sell your data. This page names any other service.
Your rights
- You can ask for a copy of your data.
- You can ask me to correct it, delete it or stop using it.
- You can ask me to move it to another service.
- You can object to how I use your data.
- You can take back a consent at any time.
- Write to the address above. I answer within 30 days.
- If the request is about an account, write from the email address of that account. This shows me it is you.
- You can also clear the data of this site in your browser. That removes what the page keeps there.
- If you delete your account in one app, I get a request to delete what my other apps keep for it. I finish it within 30 days.
Complaints
If you are not happy, you can complain to a data protection authority. In the EU, this is the authority of your country. In the United Kingdom, it is the ICO. In Canada, it is the Office of the Privacy Commissioner of Canada. For Alberta, it is the Office of the Information and Privacy Commissioner of Alberta. In Saudi Arabia, it is SDAIA. I would like to answer you first.
Children
This tool is not for children under 13, or under 16 in the EU without a parent's permission. If a child gave me data, write to me. I will delete it.
If you collect data about other people
You may use this tool to collect data about other people, such as joiners, customers, guests or signers. You then decide why and how. You must tell them, and you must have a lawful reason. I use that data only to run the tool for you, as your processor. I use it for nothing else.