Storli Privacy Policy

Last updated: 11 November 2026

1. In short

• Storli helps you keep track of things you store and own. To do that, we store what you enter.
• You can use Storli without an account. Everything then stays on your device, and we see nothing.
• With an account, your data is stored with our database provider Supabase, so you can use several devices and share places with family.
• When you use the AI features, the text and photos you choose are sent to Anthropic, which produces the answer.
• We show no ads, we do not sell data, and we do not track you across apps and websites.
• You can download your data and delete your account in the app at any time.

2. Who is responsible

The controller is JMV Holding AS, org. no. 920 206 824, C. Sundts gate 55, 5004 Bergen, Norway.
Privacy questions: hei@storliapp.no.

3. What we process

3.1 Without an account

Everything you enter – places, boxes, items, photos and settings – is stored only on your device (in the app, or in the browser's local storage for the web app). We do not receive this data. The AI features require an account and are not available without one.

3.2 Account and sign-in

• Email address – to create your account and sign you in (with a one-time code/link by email).
• Name – if you enter it in your profile, or if the sign-in provider shares it.
• User ID – an internal ID that links your data to your account.
• Sign in with Google, Facebook or Apple – we receive what the provider shares, normally email address, name and an ID with that provider. We never receive your password. If you choose "Hide My Email" with Apple, we only receive a relay address.

3.3 What you enter in the app

• Places: name, type, address, provider, unit number, opening hours, access code, contact person and phone number, rent, currency, contract dates, reminders and notes.
• Zones, shelves, boxes and items: names, labels, quantity, category, condition, used value and replacement value, sale status, listing texts and notes.
• Photos you take or choose of boxes and items.
• History, transfers and tasks: who did what and when (e.g. "box moved from A to B").
• Sharing: who has access to which places and with which role (owner, editor, viewer).

You decide what you enter. If you enter information about others (e.g. a contact person's name and phone number), you must be allowed to do so. Access codes and other sensitive details are optional – only enter them if you are comfortable doing so.

3.4 AI features

When you ask AI to recognise contents, suggest what to sell, write a listing or estimate value, the app sends the following through our server function to Anthropic:

• text describing the task, and relevant details about the items (e.g. name, category, condition),
• the photos you selected for that request (up to 6 per request).

We do not send your email address or name with the request. Answers are stored in Storli only if you choose to add them.

3.5 Technical information

• Server logs at Supabase and at the web host: IP address, time, type of request and error codes. Used for operations, troubleshooting and preventing abuse.
• AI usage limit: we count AI requests per user to prevent abuse and keep costs down.
• We use no analytics tools, advertising IDs or third-party tracking technology, in the app or on the website.
• Welcome questions: The first time you open the app, you can answer a few optional questions (what you want to keep track of, who you share with, age group and where you heard about Storli). The answers are stored anonymously, without name, email, user ID or IP address, and are only used to understand who uses Storli and to improve the app. The first name you may enter stays on your device.

3.6 Device permissions

• Camera – to scan QR codes and take photos of boxes and items. Photos are processed on the device until you choose to save them.
• Face ID – to hide access codes. Face ID is handled entirely by iOS; we never get access to face data.
• Notifications – reminders about rent, notice deadlines and retrievals are created locally on the device.

You can turn these permissions off at any time in your device settings.

3.7 Waitlist

If you join the waitlist on our website, we store your email address and the time you signed up, to tell you when Storli launches. The waitlist is stored with Supabase, the same provider as for the database (see the list of providers).

4. Purposes and legal bases

We do not use your data for marketing, profiling or automated decisions with legal effects for you. AI answers are suggestions that you choose whether to use.

5. Who we share data with

We do not sell personal data. We only share it with:

People you give access. When you share a place, its members see the contents of that place and the name/email of other members.

Processors acting on our behalf under a data processing agreement:

According to Anthropic's commercial terms, data sent through the API is not used to train their models and is deleted after a limited period. Anthropic automatically deletes API inputs and outputs within 30 days. Exceptions: content flagged for violating Anthropic's usage policy may be kept for up to 2 years, and data may be kept longer where the law requires it.

Sign-in providers. If you sign in with Google (Google Ireland Ltd./Google LLC), Facebook (Meta Platforms Ireland Ltd.) or Apple (Apple Distribution International), they process the sign-in under their own privacy policies and know that you signed in to Storli.

Authorities, only where required by law.

Transfers outside the EU/EEA

Some providers are in the USA or have access from the USA. We then rely on the European Commission's Standard Contractual Clauses (SCC) and/or the provider's certification under the EU–US Data Privacy Framework. The basis per provider:

• Supabase: the European Commission's Standard Contractual Clauses (SCC), included in Supabase's data processing agreement. The data is stored in the EU.
• Anthropic: the European Commission's Standard Contractual Clauses (SCC), included in Anthropic's data processing agreement.
• GitHub (GitHub Pages): GitHub is certified under the EU–US Data Privacy Framework and also uses the European Commission's Standard Contractual Clauses (SCC).
• Resend: Resend is certified under the EU–US Data Privacy Framework, and its data processing agreement also uses the European Commission's Standard Contractual Clauses (SCC).
• Google (sign-in): Google LLC is certified under the EU–US Data Privacy Framework, and Google uses Standard Contractual Clauses (SCC) where needed.
• Meta (Facebook Login): Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework, and Meta relies on it for transfers of Facebook user data from the EU to the USA.

You can request a copy of the relevant safeguards by contacting us.

6. How long we keep data

• Account and content: as long as you have the account. When you delete your account, your account and the places where you are the only owner are deleted, with boxes, items and photos. Places that are also owned by others remain with them.
• Backups: deleted data may remain in the provider's backups for up to 7 days before being overwritten.
• Server logs: up to 7 days.
• AI requests: we do not store the photos or text you send to AI, except what you choose to save in the app. Anthropic keeps them for a limited period, see section 5.
• Waitlist: until launch or until you unsubscribe, and no longer than 24 months.
• Support requests: up to 12 months after the case is closed.
• Data without an account: stays on the device until you delete it in the app or delete the app.

7. Your rights

You have the right to:

• access the data we hold about you,
• rectify errors,
• erase data ("right to be forgotten"),
• restrict processing,
• receive your data in a machine-readable format (data portability),
• object to processing based on legitimate interest,
• withdraw consent at any time.

Much of this you can do yourself in the app:

• Download your data: Profile → Data and privacy → Backup (JSON). The insurance list can be downloaded as CSV.
• Delete your account: Profile → Data and privacy → Delete account and data.

How to delete your data

This also applies if you signed in with Apple, Google or Facebook:

1. Open Storli and sign in.
2. Go to Profile → Data and privacy → Delete account and data and confirm.
3. Your account, the places where you are the only owner, and all boxes, items and photos in them are deleted at once. We keep no data from your Google or Facebook account beyond your name and email.

Cannot sign in? Write to hei@storliapp.no from the email address on the account, and we will delete it for you within 30 days. You can also remove Storli from your Facebook account under Settings → Apps and websites.

For anything else: write to hei@storliapp.no. We reply within 30 days.

8. Complaints

If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or the supervisory authority where you live. We appreciate it if you contact us first so we can try to fix it.

9. Security

All traffic between the app and the servers is encrypted (HTTPS/TLS). Access to data is controlled per place in the database, so only members of a place can read it. Photos are kept in private storage and shown only to members of the place. The AI key exists only on the server. Data at Supabase is encrypted at rest (AES-256). No service is completely secure, so think twice before storing very sensitive information such as access codes.

10. Children

Storli is made for adults and is not directed at children under 13. If you are under 13, a parent or guardian must create the account. If we learn that we hold data about a child under 13 without parental consent, we delete it.

11. Changes

We update this policy when the app or our providers change. The date at the top shows the latest change. For significant changes we notify you in the app or by email before the change takes effect.

12. Contact

JMV Holding AS
C. Sundts gate 55, 5004 Bergen, Norway
hei@storliapp.no