What stays on your device
Everything you enter in PrepTracker is stored locally on your phone or computer: your inventory, household details, go-bags, plans, emergency contacts, medical cards, evacuation routes, settings, and readiness history. We cannot see any of it. If you delete the app or clear its data, that information is gone; we hold no copy, so we cannot restore it. The app includes a backup feature so you can keep your own copy.
The Vault is encrypted on your device and unlocked with Face ID, Touch ID, your phone's fingerprint or face unlock, or your passcode, through the phone's own authentication. Vault contents are never transmitted anywhere.
The optional weekly email
If you turn on the weekly email in Settings, we store the following on our servers so we can send it: your email address, the household name you chose, your country, your app language, and a short plain-text summary that your own device produces. The signup screen shows you exactly what is sent before you confirm. We do not receive your item list; the summary is a short readout your device composed.
Emails are delivered through Resend, our email provider, acting on our instructions. Every email includes an unsubscribe link. Unsubscribing deletes your record from our servers. You can also email us to have it removed.
Optional alerts (push notifications)
If you turn on alerts in Settings, your phone gives us an address to deliver notifications to: a push subscription in the browser version, or a device token from Apple or Google in the store apps. We store that address together with your country, your broad region, your app language, and your community code if you have one, so that regional alerts and messages from your community's coordinators reach the right phones. We never store a name, email address, or anything from your supplies with it. Notifications are delivered by Apple and Google's notification services. Turning alerts off deletes the address from our servers; so does uninstalling the app, after the next delivery attempt fails.
The app can also show a weekly reminder that is scheduled entirely on your device and never leaves it.
Community mode
Community mode is optional. You turn it on by entering a community code (for example AMC) and, where the community asks for it, your membership ID and last name. The join screen states what is shared before you confirm; tapping the button is your consent, and you can see the exact record at any time under More → Community.
What is shared, and with whom. Two small records leave the phone on their own: when you join, whenever your figures change (at most every few hours), and at least once a week.
1. To PrepTracker, anonymously. Your readiness percentage, days covered, household size, country, community code, app language, app version, and whether the weekly email and alerts are on, stored under a random install identifier that the app creates on your phone. It carries no name, email address, membership ID, device identifier, or location. We use it only to show your community's coordinators aggregate figures for their country (averages and counts); groups smaller than five households are never shown. Leaving community mode deletes this record from our servers.
2. To your community organization, identified. If your community operates its own readiness service, the app first checks your membership ID and last name against the organization's own member list, then sends the same figures together with your membership ID and the region label the organization returned, directly from your phone to a server the organization runs. PrepTracker never receives, stores, or relays this record and cannot read it. The organization is responsible for that data under its own rules; ask your community's coordinators about access, correction, and deletion. The app tells you on the community screen whether this service exists for your community and when it last shared.
What is never shared in community mode: your items and quantities, documents, the Vault, medical cards, contacts, email address, phone number, precise location, or device identifiers.
Messages from your community. Coordinators can send notifications and place a message in the weekly email for members in their country. They see only counts of how many devices and subscribers a message reached, never who.
Household link
Household link is optional. It lets the phones in one household (up to eight) share one list: stock, plans, storage places, go-bags, household settings, and the Vault. You turn it on by adding a phone from Settings, or by joining from a QR code or link that another phone in your household shows you.
How it travels. Your list is encrypted on your phone (AES-GCM) with a key that is created on your phone and passed to the other phones only inside the QR code or the link fragment. The key never reaches us. The encrypted changes go through a relay we run (a Netlify function with Netlify Blobs storage) so that the phones do not need to be online at the same time.
What the relay holds. A random household identifier; a random identifier for each phone; a hash of each phone's secret (so that only your phones can read or write the household); each phone's public key and the household key wrapped for it; the encrypted changes and an encrypted snapshot of the list; the phone's name as you typed it, encrypted; when each phone joined and last synced; and, if your phone has a notification address (the same one alerts use), that address, so that a silent notification can tell the other phones to sync. Join codes are stored as a hash and expire after 15 minutes or one use. The relay cannot read your list, the Vault, or the phone names: it holds ciphertext.
What is never sent. Your name, email address, phone number, location, or the contents of your list in readable form.
Stopping. Removing a phone (from any phone in the household) deletes that phone's record on the relay and renews the household key, so the removed phone cannot read later changes; it keeps the copy it already has. Leaving does the same for your own phone. When the last phone leaves, everything the relay held for that household is deleted. Encrypted changes are kept while at least one phone remains in the household; older changes are trimmed as newer ones arrive, and the record of a removed phone is cleared after 60 days. If you delete the app without leaving the household first, the encrypted copy stays on the relay until the other phones leave; it cannot be read without the key.
Community mode and household link. Phones in one household report as one household to your community, not as several.
Anonymous usage counts
To understand roughly how many people use PrepTracker and where community distribution is working, our server keeps simple aggregate tallies: a total visit count and counters by country, broad region, and campaign code (for example, a QR code scanned at a community event). These are just numbers being incremented. We do not store IP addresses, device identifiers, or per-visit records, and we do not use cookies or analytics SDKs.
Since version 37.0 the once-a-day count also carries two yes/no outcomes (whether the last update check and the last household sync succeeded), kept as daily totals so we can notice silent failures, and, for a phone in a household, a one-way hash of the random household identifier. The hash lets us count a household once rather than once per phone; it is kept in daily sets for 120 days, cannot be turned back into the identifier, and is never shown or exported.
Other connections the app makes
Barcode lookup. When you scan a product barcode, the app sends the barcode number to Open Food Facts, a public product database, to fetch the product name and package size. Nothing about you is sent with it; the request carries only the barcode and, as with any internet request, your network address is visible to that service.
Live alerts feed. The optional feed fetches public hazard alerts (weather, earthquake, disaster declarations) for your country and region through our server, which passes on only the country and region.
Update check. The store apps read a small file from our website once a day to learn whether a newer version is available. It carries no identifier.
Crash and performance data. Apple and Google may share anonymized crash reports with us if you have allowed that in your phone's settings. We do not add our own analytics or crash-reporting tools.
Deleting your data
Because almost everything is on your device, deleting the app deletes it. For the few things we hold: unsubscribe from the weekly email (link in every email, or Settings) to delete your email record; turn alerts off to delete your notification address; leave community mode to delete your anonymous readiness record; leave the household (or remove the phone from another phone in it) to delete your phone's relay record, and the whole household when the last phone leaves. For the identified record held by your community organization, contact that organization. You can also email us and we will remove any record we hold for your email address or install identifier.
How long we keep things
Email, alert, and readiness records are kept while the feature is on and removed as described above. A readiness record that has not been refreshed by the app for a long time is flagged as stale to coordinators and eventually removed. Household link data is kept while a phone remains in the household, as described above. Console activity (which coordinator sent what, and how many it reached) is kept as an audit record.
Links to other sites
Some suggestions in the app link to outside retailers, and a few of those are affiliate links, which means we may earn a small commission if you buy something. Following a link takes you to a site with its own privacy practices, and nothing about your PrepTracker data goes with you.
Languages
The app is available in English, German, French, Spanish, and Indonesian. This policy is published in English; the join screen, the alerts and email sign-up screens, and the community screen explain the same points in the app's language before you turn a feature on.
Children
PrepTracker is a household tool intended for adults and is not directed at children under 13. We do not knowingly collect personal information from children.
Changes to this policy
If this policy changes, we will update this page and the effective date above. Meaningful changes are noted in the app's release notes.
Contact
Cubed Holdings LLC, Connecticut, USA
preptracker26@gmail.com ·
hello@cubed-holdings.com