Privacy

Last updated 23 September 2026. Applies to Coathook version 1.0. Coathook is made by Gitglue Ltd.

The short version

Coathook is a shared memory for one household of up to five people. Everything you put in it is shared with the rest of your house, because that is what the app is for. It goes to one database that we run, and nowhere else. There are no adverts and no analytics inside the app. Nobody signs in, so we hold no account, no password, no email address and no phone number.

Who holds what

Your house's things live in one database that we run. Nobody else has access to it, and it is not shared with, sold to or read by any other company.

What the app holds about you

Your house holds:

• You — the name you typed, whether you are a grown-up or a child, the colour your cards wear, and a picture if you chose one. You can pick that picture from your own contact card; the app takes the picture only, never a name, a number or an address.
• Your jobs — what they are called, any notes, who they belong to, who made them, any date and whether it matters, whether they are done, and who nudged them.
• Your shopping — what is on the list, how much, which shop, any notes, who wants it and who bought it.
• Your kitchen — what is in the freezer, the fridge and the cupboard, how much, any notes, when it arrived and when to use it by.
• What your house calls things — if you type or change the name of something you scanned, your house keeps that name for that barcode, so the next scan knows it.
• Your places — the name, the map pin and the ring you chose for a place such as home or a supermarket, any note on it, and whether it nudges you as you arrive or as you leave.
• What you told the house — the sentence you spoke or typed, when, and what it made. Keeping your own words is what lets the app show you what you said and fix it if it got it wrong.
• Your phone's way in — an anonymous session with no name attached to it, so the house knows which member this phone is. It also holds the quiet hours you set on this phone and its time zone, so a notification somebody else sends you during them arrives without a sound.
• Where Apple can reach your phone — if your phone takes notifications, Apple gives this install of the app an address, and the house keeps it so it can ask Apple to light up your screen when somebody hands you a job or wants something from the shops. It is held against your phone's way in, never against your name or anything else you typed, and it goes when that way in goes: forgetting a phone, leaving the house, or ending the house.
• Proof that your phone is running the real app — when your phone asks us to look up a barcode or to send a notification, it proves it is the genuine Coathook app on a real iPhone, using a key Apple vouches for. We keep the public half of that key and a count that goes up each time it is used. It is held against your phone's way in, never anything else about the phone, and it goes when that way in goes: forgetting a phone, leaving the house, or ending the house.
• A way back into the house — your phone keeps a key of its own, so that if it ever loses its sign-in it can find its way back into the house without anybody sending a code. We keep a fingerprint of that key, never the key itself. It is held against your phone's way in, and it goes when that way in goes: forgetting a phone, leaving the house, or ending the house.
• Your watch's way in — if you wear an Apple Watch with Coathook on it, your phone lends it a key of its own, so the watch comes into the house as you without anybody sending a code. It is another way in, held and forgotten like a phone's: it shows among your phones, and forgetting them, leaving the house or ending the house takes it too. A key the watch never takes goes after a day.
• How often you asked — how many times in each hour your phones asked us to look something up or send a notification, so that nobody can flood the house. Each hour's count goes after a day, and all of it goes when you leave.
• The six letters somebody used to let you in, which last an hour and work once.

When a child in the house is given a phone, the house also holds the record that a grown-up in the house said yes: who said it, when, and which version of the notice they read.

Where you are

The app never reads your location. When you save a place, your phone is asked to watch for that ring and to wake the app when you cross it. The app is told "you have arrived", nothing more. Your position is never collected, never stored and never sent anywhere.

The pin you dropped on a place is a different thing, and the app does hold it: it is a map coordinate you chose, usually your home or a shop, and it is shared with your house so their nudges work too.

Your camera, your voice, your pictures

• A barcode is read on your phone. The number — only the number — is sent to us, and we look it up in our own list of products and then in open databases of products, so that your phone never talks to anyone but us. When none of those knows it, we may ask a commercial database of products that we pay for, and it too is sent the number and nothing else. We keep the product. We do not keep who asked, and the list of products holds nothing about any house. A name from any of them is only shown if it passes a filter meant for children aged 8 and under.
• A name your house types for a barcode is kept for your house. It is added to the shared list of products only if it passes that filter for children, and only the name goes: nothing about who typed it or which house it came from. Once it is on the shared list it stays there, because it is no longer anybody's.
• Dictation runs on your phone. No sound is sent anywhere and no recording is kept.
• The sentence you say is turned into items on your phone.
• Reading a photograph of a cupboard, or a screenshot of a shop order, is not in this version of the app. When it returns, the same rule will hold: only the words that come out of it become items, the picture is never uploaded, and it is deleted once it has been read.

What we do not do

• No adverts, and no advertising identifier.
• No analytics, no crash reporting, no measurement of how you use the app.
• No tracking of you across other companies' apps or websites, at all.
• No selling, sharing or renting of anything to anybody.
• No accounts, no passwords, no email addresses, no phone numbers.

Children in a house

A house can include children, and they are full members: they own jobs, they earn, and they appear everywhere everyone else does.

A child cannot be given a phone in the house unless a grown-up who is already in the house says yes on their own phone first. Before they say yes, they are shown exactly what the house will hold about that child, including the plain statement that where the child is never leaves the child's phone.

A grown-up can, at any time and from inside the app:

• read the whole of what the house holds about a child, line by line;
• take the yes back, which signs that child's phone out of the house straight away;
• remove the child from the house entirely.

How long things are kept

• Your house lasts until whoever started it ends it. Ending it removes everything the house holds, on every phone in it. There is no undoing that.
• A sentence you told the house lives as long as the things it made. Delete the last of them and the sentence is emptied at the same moment: the words are removed and a marker is left in their place. A sentence that made nothing is emptied once it is more than 90 days old. Either way, the marker goes 90 days after the words did.
• The address Apple gave a phone, the key it proves itself with, and the fingerprint of the key it finds its way back with, last exactly as long as that phone's way in. Forget the phone, leave the house, be erased from it or end it, and all three go in the same breath. A watch's way back lasts exactly as long as the watch's way in, the same way.
• The count of how often somebody asked is kept for a day.
• Everything else lasts until somebody in the house deletes it, or the house ends. Every job, shopping line, kitchen item and place can be deleted, and deleting takes it off our server there and then. All that is left is a note of which item went and when, with none of its words, so every other phone in the house takes it off too.

What you can ask for

All of it is in the app, and none of it needs an email to us:

• See it. Settings, then the people in your house, then "What we hold" beside a name. It is the whole of it, line by line: their name and picture, the jobs they own, what they have earned, what they want from the shops and what they have bought, what they put in the kitchen, every sentence they told the house, the places the house knows, what the house calls the things it scanned, every phone they have had in the house, where Apple can reach the phones still in it, how those phones prove they are the app, and any yes a grown-up gave for them. "Send it" hands all of that over as a file with their name on it, through the share sheet.
• Remove a person. A grown-up can erase somebody. Their name, picture, colour, phones and sentences go. A job they owned passes to whoever started the house, so the house's own record survives without them in it.
• End the house. Settings → End this house. Everything goes, for everybody.

Erasing a person does not empty the house of every trace of them, and it is worth being exact about what is left:

• Their row in the house stays, emptied. The name becomes "Someone", the picture and the colour go, and the row is marked as having left. What the row keeps is the internal identifier the house's other rows point at, which house it belongs to, and whether they were a grown-up or a child.
• If a grown-up had said yes for them, that whole record stays, marked as taken back and when. It still holds which grown-up said yes, when they said it, and which version of the notice they read. A record that only said a yes had been withdrawn would not show what was withdrawn.
• The house's running totals stay, because they are counts and not a person.

Ending the house removes all of it, including everything in this list.

If you would rather ask us than tap it yourself, write to support@coathook.app and we will do it.

Suggesting something

Settings has a page for telling us an idea or something that isn't right. What you write, and any screenshots you choose to add, come to us and nobody else. We keep them with your member identifier and your house's, a random string and not a name, and which version of the app sent them, so we can tell which house and which version a problem is in. Nothing on that page is shown to the rest of your house. We read every one, but we do not reply, so there is no need to put anything in it you would not want read. A screenshot shows whatever was on your screen, so choose ones that show only what you mean to.

If you leave the house or ask us to erase you, what you sent stays but no longer points at you. Ending the house has the same effect. Write to support@coathook.app to have one removed.

Paying for the house

A house pays one subscription, and a grown-up in it buys it through their phone's app store. To know whether a house has paid, the app tells a company that checks subscriptions for both app stores the house's own identifier, which is a random string and not a name, and the store tells it what was bought, when, and when it renews. That company holds no name, no email address and nothing the house keeps. The payment and your card stay with the app store; we never see them.

When a house stops paying, every phone in it opens to a page asking a grown-up to keep it going. Nothing is deleted, and What we hold and Ending the house still work from there.

This website

Everything above is about the app, which counts nothing. The website, coathook.app, uses Google Analytics to count which pages are opened, which buttons and links are pressed, roughly which country a visit comes from, and what kind of browser and device it is. Google Analytics keeps its own cookies in your browser to tell one visit from the next.

To switch it off, choose Cookies at the bottom of any page and say no. The website then loads nothing from Google, deletes those cookies and counts nothing, and remembers that in your browser.

The six letters in an invite link are never sent: the website tells Google which page was opened, never the letters after it. Advertising features are switched off, so nothing is used to follow you to other websites or to show you adverts.

The list before launch

Until Coathook comes out on 23 October 2026, the website has a list you can join to hear when it does. If you join, we keep your email address, the day you joined, the six letters of your own link and, if you came from someone else's link, the six letters of theirs. The list is kept by the website, apart from the database your house's things live in.

We use it for two things: to write to you when Coathook is out, and to count the houses that joined from your link so we can give yours the free months it earned. We do not share it, sell it or use it for anything else.

We delete the whole list by 31 January 2027. To come off it sooner, write to support@coathook.app and we will take you off.

Changes to this policy

When this changes, the date at the top changes with it, and the copy at https://coathook.app/privacy is the current one. When what the house holds about a child changes, the notice a grown-up reads changes too, and any yes given against the old notice stops counting until a grown-up reads the new one.

Who to write to

Coathook is made by Gitglue Ltd, and Gitglue Ltd runs the one database your house's things live in. Write to support@coathook.app with anything about this policy or about what the house holds.

Who is the data controller for a house's things, in the legal sense of that term, is still being settled with advice, and this policy does not answer it. The address above is where to write either way. When it is settled, this section will say so and the date at the top will change.

If you are in the UK, you can also complain to the Information Commissioner's Office.