CommonShare Mobile Apps Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how Common Share Inc. ("CommonShare," "we," "us," or "our") handles personal information in connection with the following mobile applications for Android and iOS (each an "App," together the "Apps"):

• WhatCo.de, a public ethical shopping companion that has no accounts (Google Play package de.whatcode.app); and

• CommonShare, the app through which CommonShare users sign in and use CommonShare services (Google Play package and Apple bundle identifier com.commonshare.mobile).

Common Share Inc. is a Delaware corporation with an address at 1065 SW 8th Street, Miami, Florida 33130, United States. Our public websites are covered by the CommonShare Privacy Policy at https://www.commonshare.com/policies/privacy.

WhatCo.de has no accounts and sends us no information that identifies you. In the CommonShare app, an account is required only for features that use your CommonShare account; scanning and ratings work without one. Both Apps keep personal data on your device wherever they can. Product ratings are computed on your device from published product data. The optional assistant runs on your device; your conversations with it are not sent to us or to any AI provider.

1 Summary

The Apps contain no advertising, no advertising identifiers, no analytics or crash-reporting software development kits, and no tracking across other companies' apps or websites. We do not sell personal information or share it for cross-context behavioral advertising.

2 Information Processed on Your Device

The following information is created and kept in the App's private storage on your device and is not transmitted to us:

• Scan history and recently viewed products.

• Preferences and settings.

• Cached product information, kept for up to 7 days so repeat lookups work offline.

• Conversations with the on-device assistant and explanations of ratings.

• The optional on-device AI model, if you choose to download it.

You can remove this information at any time by clearing the App's data in your device settings or by uninstalling the App. The AI model can also be deleted from the App's Settings screen.

3 Camera

The Apps request access to your camera only to read barcodes when you open the scanner. Barcode recognition happens on your device. Camera images are not saved and are not sent to us or to anyone else. You can deny or revoke camera access in your device settings and still search for products by text.

4 Product Lookups

To show information about a product, the App sends the product's barcode number to Open Food Facts (world.openfoodfacts.org), an open product database operated by the Open Food Facts association, a French nonprofit organization. The request identifies the App by name and version but contains no account information or other identifier of you. Open Food Facts receives your IP address as part of the connection and processes it under its own privacy policy, available at https://world.openfoodfacts.org/privacy.

When the assistant looks up product data, the App sends barcodes and product or brand search terms to CommonShare's product service. In the CommonShare app, if you are signed in, the request also carries your sign-in token. We use these requests only to answer them; we do not store the barcodes or search terms you send, and we do not build a profile of the products you look up. The content of your conversation with the assistant is not sent.

5 On-Device AI Model

The App can use an optional AI model that runs entirely on your device to explain ratings and power the assistant. The model is never used to compute ratings. If you choose to install it, the App downloads the model file (about 2.6 GB) from Hugging Face (huggingface.co) over Wi-Fi only. Hugging Face receives your IP address and standard download request information as part of the connection and processes it under its own privacy policy. No information about you, the products you scan, or your conversations is sent during the download or when the model is used.

6 CommonShare Account (CommonShare App Only)

WhatCo.de does not offer accounts, and nothing in this section applies to it. In the CommonShare app, you sign in through your device's web browser with your email address and a one-time sign-in link or code that we send by email.

When you have an account, we collect and store:

• your email address;

• an account identifier we assign; and

• records of sign-in codes and sign-in sessions, including when they were issued, used, and revoked.

We use this information to create and secure your account, send sign-in emails, and recognize your account when the CommonShare app connects to CommonShare services. We do not use it for marketing unless you separately agree.

On your device, sign-in tokens are stored in the operating system's secure storage (Android Keystore or iOS Keychain), not in ordinary app storage. Signing out deletes the tokens from your device and revokes them on our servers.

7 Information Collected Automatically

When the App connects to CommonShare services, our servers and hosting providers receive your IP address, the time of the request, and the App's name and version. We use this information to deliver the request, apply rate limits, keep the services compatible with the App version, and protect against abuse. Request logs are retained for a limited period for security and troubleshooting and are not used to identify you or to track your activity.

8 How We Disclose Information

We disclose personal information collected through the Apps only to:

• Service providers that host and operate our services and send sign-in emails on our behalf, under contracts that limit their use of the information.

• Authorities and other parties where required by law or reasonably necessary to protect rights, safety, or security.

• Parties to a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

Open Food Facts and Hugging Face receive requests directly from your device as described in Sections 4 and 5. We do not sell personal information, and we do not share it with data brokers or advertisers.

9 Legal Bases

Where the GDPR or UK GDPR applies, we process account information to perform our agreement with you to provide the account, and we process request and security information on the basis of our legitimate interests in operating, securing, and improving the Apps. Processing that happens only on your device is under your control and does not involve us.

10 Retention

• Account information is kept while your account exists and deleted when you delete your account, as described in Section 11.

• Sign-in codes expire after 10 minutes. Records of expired or revoked sign-in sessions are kept only as long as needed to secure the account.

• Request logs are kept for a limited period for security and troubleshooting.

• Information we must keep to comply with law, resolve disputes, or enforce our agreements may be kept for the applicable legal period.

11 Deleting Your Account and Data

You can request deletion of your CommonShare account and its associated data at any time, from the CommonShare app or by email:

• In the CommonShare app, open Settings, then Account, and choose to delete your account.

• By email, write to legal@commonshare.com from the email address of your account with the subject line "Delete my account."

We delete your email address, account identifier, and sign-in records within 30 days of verifying the request, and revoke all of your sign-in sessions immediately. We may keep information we are legally required to retain, for the period the law requires. Deleting your account does not delete the information stored on your device; clear the App's data or uninstall the App to remove it. WhatCo.de holds no account; its data exists only on your device and is removed the same way.

12 Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict its processing, to withdraw consent, and to lodge a complaint with a data protection authority. To exercise a right, email legal@commonshare.com. Section 9 of the CommonShare Privacy Policy for our websites describes how we verify and respond to requests, and Section 7 of that policy describes our safeguards for international data transfers; both apply to the Apps as well.

13 Children

The Apps are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13 (or under 16 where the GDPR applies). A CommonShare account requires an email address and is intended for users of that age or older. If you believe a child has created an account, contact legal@commonshare.com and we will delete it.

14 Security

Communication between the Apps and the services they contact is encrypted with TLS. Sign-in tokens are kept in your device's secure storage, and only digests of sign-in codes and tokens are stored on our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15 Changes to This Privacy Policy

We may update this Privacy Policy when the Apps or our practices change. We will post the revised version here and update the date above. Where a change materially affects how we use personal information, we will provide notice in the App or request consent where required.

16 Contact Us

For privacy questions or requests about the Apps, contact:

Common Share Inc.
1065 SW 8th Street
Miami, Florida 33130
United States
Email: legal@commonshare.com