Privacy policy

The controller of your personal data is Javier Rubio Roca, an individual, who develops and operates Costia Inventory. Contact for privacy matters: support@costia.app.

Your homes, rooms, places, items, history and settings are stored in a database on your device, so the app keeps working offline once you are signed in.

The phone, web and desktop apps ask you to sign in with a Costia account before you can use them; what is collected from then on is described below. The one exception is the desktop app's private mode. Crash reports are described separately: the phone apps and the website start sending them with the app, before and regardless of sign-in, when the build includes them.

When you sign in with a Costia account (email, Google or Apple), your inventory is synced to Inventory's servers so it is available on your other devices: homes, floors, places, items, quantities, notes and tags, and the history of changes with the text you typed to the assistant.

We also keep your account identifier and email, when you last used the app, and who belongs to each home. The account itself (email, sign-in identifiers, password hash where one exists, sessions) is held by the Costia account service, which is shared by the Costia apps.

If you choose an image as a floor plan (from your photo library, through the system picker), it is resized on your device and kept with that floor. It is also uploaded to private storage at Cloudflare R2, in the EU, under an opaque key. The storage is not public: the image is reachable only through short-lived links the app requests for you. The app never opens your camera.

Searching by typing for a name works on your device, for everybody. The assistant (chat, voice capture through Gemini or Siri, and asking where something is) and search by meaning are Premium features and need an account. Before anything is sent for them, the app asks your permission, once for your account, saying what is sent, to whom and what for; without it neither runs, and you can withdraw it at any time in Settings, under AI and your data.

With your permission, when you use the assistant, the message you typed, the part of your home the assistant reads to answer (names, descriptions and paths of places and items) and the conversation so far are sent to a language-model provider through the Vercel AI Gateway. The provider's own retention terms apply. What you ask the assistant to do is applied on your device at once, as one change you can revert from History; a place you did not ask for is created only once you say yes.

Search by meaning runs on Inventory's servers, not on your device. With Premium and your permission, the text of each item in your homes (its name, description, position, tags and the path of the place it is in) is sent in the background, without you doing anything, to an embedding model through the same gateway, and the numeric summary it returns (an embedding) is stored on Inventory's servers; what you search for is sent the same way when you search. In a home shared with other people, this is done on behalf of a member who gave permission. Withdrawing your permission stops it and deletes the embeddings of your homes, unless another member of a shared home still allows it.

Your conversations with the assistant are stored on Inventory's servers. The usage ledger records only counts of AI use (tokens, model, estimated cost), never its content. We keep the record of your permission (when you gave or withdrew it, and the version of this policy) while your account exists.

You can report any of the assistant's answers from the chat, as offensive, wrong or harmful, or for another reason, with an optional note. The report, the text of the answer, the conversation it belongs to and your account identifier are stored on Inventory's servers so that a person can review it, and are deleted with your account.

If you suggest an idea or tell us about a bug, from Settings → Suggestions or through the assistant (which only proposes it: nothing is sent until you tap Send), the text you write is sent with your account identifier and the app's version, platform and language. It is linked to your account and held by the Costia account service, not by Inventory's servers. We use it to handle, with the help of AI, what you sent us and to tell you how it progresses: in the app and, if you ask, by email when it is accepted or declined.

To do that, the text goes to a language model through the Vercel AI Gateway, to check whether it is about the app or repeats another suggestion; it is stored with the data that goes with it as a confidential issue for the Costia team at GitLab Inc.; and Claude, Anthropic PBC's AI agent that analyses suggestions, reads it together with the app's code. If you ask to be told by email, the account service sends it through Resend. Nobody else ever sees what you wrote.

Premium is bought through the App Store or Google Play. We use RevenueCat to know whether a subscription is active: it receives your Costia account identifier and the purchase state (product, renewal date, store). It does not receive your inventory or your email. We never see your payment details; the store handles the payment.

When the build includes it, the phone apps and the website send crash reports to Sentry, from the moment the app starts and whether or not you have signed in, so that a failure while signing in can be fixed too; the desktop app sends them only once you have signed in, and never in private mode. A report holds the error, the technical stack, the operating system, the app version and, only if you are signed in, your account identifier. Personal information is not sent by default, screenshots are off, and any field that looks like text you typed (names, notes, titles, emails, searches, messages) is replaced with [redacted] before it leaves the device.

There are no ads, no analytics and no tracking in Costia Inventory, no advertising identifier, and we do not sell your data or use it to build profiles. The app does not use your location, contacts or calendar.

The microphone is used only when you tap a mic to dictate — in the assistant, or in the name of something you put away — and the app asks for it the first time. Your voice is turned into text on your device: the audio never leaves it, is not stored and never reaches us. The text waits in the field until you send or save it, and is then an ordinary message to the assistant, or the name of a thing like any other you type.

The desktop app has a private mode, the only way to use Costia Inventory without an account: the database is encrypted with your password, and the only thing that leaves your computer is the question sent to the language model at the address you configured, with your own API key. Crash reports are not sent in that mode.

Performance of a contract (art. 6.1.b): your account, your synced inventory, your plan images and, if you subscribe, the state of your purchase are what it takes to provide the service you asked for when you signed in.

Consent (art. 6.1.a): sending what you type to the assistant and the text of your home to the AI provider, for the assistant and search by meaning. You give it in the app before first use and can withdraw it at any time in Settings; withdrawing does not affect what was done before.

Legitimate interest (art. 6.1.f): crash reports, the security of the service, the minimal technical logs needed to keep it running, and reviewing the reports you send about the assistant's answers.

The suggestions you choose to send us are processed to handle what you ask (art. 6.1.b) and in our legitimate interest in improving the app (art. 6.1.f).

In the desktop app's private mode there is no processing on our side, because we receive nothing.

Only service providers that process data on our behalf: the model provider behind the Vercel AI Gateway (assistant messages and, for search by meaning, item text and searches; Premium only, and only with your permission), Sentry (crash reports), RevenueCat (purchase state), Cloudflare and the hosting of Inventory's servers. Cloudflare, Inc. hosts the web app (inventory.costia.app) and serves it from its global network, the app's connections to our servers go through that same network, which protects them against attacks, and it stores the floor-plan images and runs our DNS; to deliver and protect all that it processes the technical data every request carries — the IP address, the browser or device user agent and the address requested — and it does not keep the content of what is sent. Google and Apple only issue the identity token when you sign in with them. The suggestions you send also reach the Vercel AI Gateway, GitLab and Anthropic, as described under Suggestions. Nobody receives data to advertise to you.

Your data stays until you delete it or delete your account. When you delete your account we erase the homes nobody else belongs to, with their floors, places, items, history, search index, assistant conversations and plan images, your reports of the assistant's answers, the record of your AI permission, and your membership in shared homes; the Costia account service erases the text of your suggestions and its copy at GitLab. Backups and logs are kept for a limited period and then expire; ask us at the address above if you need to know the current period.

Under the GDPR you have the right to access your data, to have it rectified, to have it erased, to receive it in a portable format and to object to or restrict its processing. Most of this you can do yourself in the app: edit or delete anything you entered, and delete your account from the deletion page. For the rest, write to us and we will answer within one month.

You may also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, www.aepd.es) or the authority of your country.

Costia accounts are for people aged 13 and over. The app is not directed at children.

If this policy changes in a way that matters, the date at the top changes and the app tells you. The current version is always on this page.