Privacy policy
This covers the CoHiro app. The niugio.com website policy is separate and covers only that website.
Last updated: 11 August 2026.
The short version
CoHiro stores your email address, a display name, and whatever you and the people you live with put into your shared list and inventory. Choosing the name is optional; having one is not. If you skip it, we use the name Apple or Google shared when you signed in, and if there is none, the part of your email address before the @ sign. It is kept in Germany. There is no advertising, no tracking, no profiling, and nothing is sold or shared with anyone for marketing.
Three things are worth knowing before you read further, because they surprise people: notifications quote what you typed, your display name can default to part of your email address, and deleting your account does not delete what you added to a shared household. Each is explained below.
1. Who is responsible
Niugio UG (haftungsbeschränkt), Urbanstraße 71, 10967 Berlin, Germany.
Email: support@cohiro.app.
Company details: Impressum.
2. What we store, and why
Your account
Your email address, because it is how we know which account is yours and where we send you a code if you forget your password. It reaches us one of two ways: you type it when you sign up with a password, or Apple or Google hands it to us, already verified, when you use Sign in with Apple or Sign in with Google. Your password is never stored: only a cryptographic hash of it, which cannot be turned back into your password. And if you sign in with Apple or Google, there is no CoHiro password at all: the provider confirms who you are, and we never receive the password you use with them.
Signing in with Apple or Google. These buttons create the same kind of account as signing up with an email and password: same household, same lists, same rules, same rights. The provider sends us exactly three things: your verified email address, a stable user id (the provider's way of telling us “same person as last time”), and your name, if you chose to share it. Nothing else: no contacts, no photos, no password. One verified email address means one account: if you sign up with a password using your Gmail address and later tap Sign in with Google with that same address, you land in your existing account, not a duplicate.
Apple's Hide My Email. If you choose it, Apple gives us a private relay address (it looks like x1y2z3abc@privaterelay.appleid.com) instead of your real one. The relay address is the address we hold: it is your sign-in identity here, and any email we send you is addressed to it and routes through Apple's relay to your real inbox. We never learn your real address, and forwarding is controlled from your Apple ID settings, not by us.
A display name. Choosing one is optional; having one is not. If you do not choose one, we use the name Apple or Google shared when you signed in, and if there is none, the part of your email address before the @ sign. A name you set yourself is never overwritten. So if you sign up as firstname.lastname@example.com and skip the name field, the people in your household will see firstname.lastname. You can change it at any time in the app under Account.
What you and your household put in
The things the app is for: item names, shopping-list lines, notes you attach to them, the names of your shelves and of your household, whether something is in stock or running low, and a history of who changed what. All of it is free text, so it contains whatever you type.
This is a shared app, and that is the point. Everything you add to a household is visible to every other member of it, including your display name against the things you added. Do not put anything in a note that you would not want the people you live with to read.
Your devices
If you allow notifications, we store a push token for that device so we can reach it, along with which platform it is. We also store your time zone, so that "the 6pm shop" means 6pm where you are, and your quiet hours if you set them.
While you have the app open, the other people in your household can see a small green dot against your name. It is on by default, and you can switch it off in the app under Account. Nothing about it is stored: it disappears the moment you close the app.
We do not collect your location, your contacts, or your advertising identifier. The camera is used only to read a QR code when joining a household; no image is stored or transmitted. Screenshots you choose to attach to feedback are covered below.
Feedback you send us
If you use the feedback sheet in the app, we store what you wrote, the app version and the platform it came from, and whether you agreed to be contacted about it. Nothing else is attached. If you agreed, we use the email address on your account, and only about what you sent.
You can attach up to three screenshots. These are optional and the feedback works without them. They are stored privately, they are never public, and nobody in your household can see them. Before a screenshot is uploaded, the app re-encodes the image on your device, which removes the camera metadata that photos normally carry, including location. When we read your feedback we open the images through a link that stops working after seven days.
Your feedback reaches us as an email: the text you wrote, and the links to any screenshots you attached, pass through Resend on the way (see the table in section 6).
Feedback is not household content. The people you live with cannot see it, or see that you sent it.
What is required, and what is optional
An email address is the one thing we cannot do without: it is how we tell accounts apart, so there is no account, and no shared household, without one. Everything else in this section is optional: a display name you choose rather than accept, notifications, quiet hours, feedback and its screenshots. Declining any of them costs you that feature and nothing else. No law requires you to give us any of this.
3. Why we are allowed to do this
The GDPR requires a legal ground for every use of your data, and requires us to name it. These are ours:
| What | Our legal ground |
|---|---|
| Your account, everything your households put in, invites, and the features you switch on: notifications, quiet hours, your time zone | Performance of a contract, Article 6(1)(b). This data is what providing CoHiro to you consists of. |
| Crash reports | Our legitimate interest in finding out that the app is broken and fixing it, Article 6(1)(f). The reports are stripped of anything that identifies you (section 5) precisely so that this interest never outweighs yours. |
| The online dot | Our legitimate interest in helping a household coordinate, Article 6(1)(f). It is momentary, visible only inside your household, and the switch under Account turns it off. |
| Feedback you send us | Our legitimate interest in reading it and acting on it, Article 6(1)(f). It exists only because you chose to send it. |
| Contacting you about your feedback | Your consent, Article 6(1)(a). The switch is off unless you turn it on, and you can withdraw it at any time (section 10). |
| Deleting your account, and the small records that prove we did | Our legal obligations under the GDPR itself, Article 6(1)(c), alongside the contract. |
One distinction worth naming: when your phone asks whether CoHiro may send notifications, that is the operating system asking, not us collecting consent in the legal sense. Our ground for the processing behind it is that you asked for the feature; the prompt is how your phone makes sure of that.
4. Notifications quote what you typed
When someone starts a shop or calls one off, the people in the household get a notification. The household name is the title. The body names who did it, by their display name, and quotes any note they wrote.
To deliver it, that text passes through Expo's push service and then through Apple's or Google's notification service, and it can appear on a locked screen. This is how push notifications work on every app, but it means the text you type into a note is not confined to Germany and is not confined to the app. Keep that in mind when writing one.
5. Crash reports
When the app fails, it sends a crash report to Sentry so the fault can be fixed. The report contains the error, where in the code it happened, and technical details about the device such as its model and operating system version.
It does not contain your email address, your name, or anything you typed into the app. The name of your device is removed before the report is sent, because people often name their phone after themselves.
Each install of the app carries a random identifier, so that a hundred reports from one broken phone read as one problem rather than a hundred. It is created on your device, it is not your account, and it is not connected to your email address or your name.
Crash reporting cannot currently be turned off. It is the only way we learn that something is broken, and it carries nothing that identifies you.
We do not use any advertising or analytics service, and we have switched off the crash tool's optional usage statistics, so crash reports are the only diagnostics that leave your device. There is no advertising in CoHiro and no profiling of any kind.
6. Where your data is, and who processes it
Your account, and everything in your households, is stored in the European Union, in Frankfurt. Crash reports are kept in the European Union as well. Two things are narrower than "everything stays in Europe", and we would rather name them: notifications have to leave to reach your phone (section 4 explains that), and the short-lived server functions that do things like delete an account may run on machines outside the EU while they work. They store nothing.
Three of the four companies below are American businesses running European infrastructure. That is ordinary and it is lawful, but it is not the same thing as saying your data never leaves Europe, so we would rather write it out than let one word in a table imply something tidier than the truth.
| Who | What they receive | Where |
|---|---|---|
| Supabase | Your account and everything in your households | Frankfurt, Germany |
| Sentry | Crash reports: what went wrong, where in the code, and the device model and operating system. Not your email address, not your name, and nothing you typed into the app. | European Union |
| Resend | Your email address and the sign-up and password emails we send you, including the one-time code in them. Also the text of any feedback you send us, with links to any screenshots you attached, because feedback reaches us as an email. | Sent from Ireland. The company itself is American. |
| Expo, Apple, Google | Only if you turn notifications on: your household's name, the display name of whoever did the thing, any note they wrote, and a code that identifies your device | Outside the EU |
We have a data processing agreement with every one of them, which is what Article 28 of the GDPR requires of us. For Supabase, Resend and Expo it forms part of the terms we agreed to when we signed up. With Sentry we accepted it separately.
Where any of them moves data outside the European Union, that transfer is covered by the standard contractual clauses the European Commission publishes for exactly this purpose, and in some cases also by the EU-US Data Privacy Framework. If you would like to read the clauses themselves, write to support@cohiro.app and we will send you a copy. None of them is permitted to use your data for their own purposes, to sell it, or to combine it with data from anywhere else.
When you sign in with Apple or Google, the sign-in itself happens on the provider's servers, under the provider's own privacy policy: they necessarily learn that you use CoHiro. What they send us afterwards (your verified email or relay address, your user id with them, your name if you shared it) is stored with Supabase in Frankfurt, like everything else about your account. Signing in this way adds no tracking and no advertising: we use the providers to know who you are, nothing more.
7. Deleting your account
You can delete your account yourself, in the app under Account. There is no need to ask us. Full instructions are on the account deletion page.
This includes the identity Apple or Google passed to us: the email or relay address, the provider user id and your name are all deleted with the account. If you used Hide My Email you can also switch the relay address off in your Apple ID settings; that is between you and Apple, and works whether or not your CoHiro account still exists.
What is deleted: your email address, your display name, your settings, and the record of your devices.
What is not deleted: if you shared a household with other people, the things you added to it stay, because they are still using them. What changes is that those entries stop carrying your name. If you were the only person in a household, it is deleted with your account.
Screenshots you attached to feedback are deleted when you delete your account. The words of the feedback itself stay with us, because a problem you reported may still be one we are fixing, but they stop carrying your name and are no longer linked to you. If you would like the words removed as well, email support@cohiro.app and we will do it.
8. How long we keep things
Your account and its contents are kept until you delete them. There is no automatic expiry, and we do not delete inactive accounts. The household activity history is kept for two years and then removed automatically. Crash reports are deleted by Sentry automatically after 30 days.
9. Children
CoHiro is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has an account, write to us and we will remove it.
10. Your rights
Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict how it is used, to object to its use, or to receive what you gave us in a portable, machine-readable form you could take to another service. Most of that you can do yourself in the app; for anything else, including a portable copy, write to support@cohiro.app and we will put it together for you.
Two of these deserve their own sentence. Where we rely on a legitimate interest (crash reports, the online dot, reading your feedback), you can object at any time: use the off switch where one exists, or write to us. And where we rely on your consent (being contacted about your feedback), you can withdraw it at any time, without affecting anything done before: one line to support@cohiro.app is enough.
You also have the right to complain to a supervisory authority. For us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
11. Changes
If this policy changes in a way that affects you, we will say so in the app rather than quietly updating this page. The date at the top always reflects the current version.