Privacy Policy

1. Overview

Cilantro is a shared shopping-list app operated by Coriander Ltd ("we", "us", "our"). We are committed to handling as little personal data as technically possible. This policy explains what we collect, why, and how.

2. Information We Collect

2.1 Information you provide

Cilantro does not ask for your name, email address, phone number, or any other personally identifying information. There is no account registration form.

2.2 Cryptographic identity

On first launch, Cilantro generates an Ed25519 key pair on your device. Your identity within the app is your Cilantro ID — a short identifier derived from the SHA-256 hash of your public key. Your private key never leaves your device and is stored exclusively in your device's secure hardware (Android Keystore / iOS Secure Enclave – Keychain).

We store on our servers:

• Your public key and its SHA-256 hash (your Cilantro ID). These are cryptographic identifiers, not personal data in the conventional sense.
• The timestamp of your first registration and the timestamp of your last authenticated session.

2.3 Encrypted list data

Your shopping lists, item names, quantities, and store tags are serialised, encrypted with a symmetric key unique to each list, and uploaded to our servers as opaque encrypted bytes. We store the ciphertext and sync metadata (list ID, version counter, last-updated timestamp). We cannot decrypt this data and do not attempt to.

2.4 Sharing and invites

When you share a list, the list key is cryptographically wrapped for the recipient using their public key (X25519 key exchange). The wrapped key is stored on our servers as opaque bytes. Invite links expire after 48 hours and can be used only once.

2.5 Technical and diagnostic data

Our servers log standard HTTP access logs, which may include:

• IP address and approximate request timestamp
• HTTP method and response code
• The size of data transferred (no content)

Server-side logs are retained for up to 30 days for security and abuse-prevention purposes, then deleted.

2.6 Crash and error reports

Cilantro includes a built-in crash-reporting feature that sends error information directly to our own servers (not to any third party). This feature is enabled by default and can be turned off at any time in the app's Settings screen.

When crash reporting is enabled and an error occurs, we collect:

• Platform (Android or iOS) and app build number
• OS version
• Exception type, error message, and stack trace
• Timestamp of the error

Crash reports do not include your Cilantro ID, public key, IP address, list content, or any other identifying information. We use this data only to diagnose and fix bugs. We do not use third-party analytics SDKs or advertising SDKs within the app.

3. How We Use Your Information

We use the information described above solely to:

• Authenticate your device using a challenge/response protocol (your private key signs a server-issued nonce; no password is transmitted or stored).
• Store and relay encrypted list blobs so your lists are available across your devices and to collaborators you invite.
• Facilitate list sharing by storing single-use, time-limited invite payloads.
• Detect and prevent abuse (e.g. rate-limiting, spam invite creation) using server-side request logs.
• Diagnose and fix software bugs using crash and error reports (Section 2.6), when you have not disabled crash reporting in Settings.

We do not use your data for advertising, profiling, or any purpose other than operating the service.

4. Sharing of Information

We do not sell, rent, or trade your data. We may share information only in these narrow circumstances:

• Infrastructure providers: our servers run on Hetzner Cloud (Germany). Hetzner processes infrastructure-level data (e.g., IP traffic) subject to their own privacy policy and GDPR compliance obligations. They do not have access to decrypted list content.
• Legal obligations: we may disclose data if required by law, court order, or governmental authority. Because we cannot decrypt list content, any disclosure would be limited to the encrypted blobs, cryptographic identifiers, and access logs described in Section 2.
• Business transfers: in the event of a merger, acquisition, or sale of assets, user data would be transferred only under equivalent privacy protections.

5. Data Retention

We retain your data for as long as your account is active. Specifically:

• Encrypted list blobs and your public key are retained until you delete the list or delete your account.
• Invite payloads are deleted automatically 48 hours after creation, or immediately upon acceptance, whichever comes first.
• Server access logs are retained for up to 30 days, then automatically purged.

When you delete a list, the encrypted blob and all associated member records are deleted from our servers. Because the data is encrypted and we hold no key, deletion is permanent and irrecoverable.

6. Security

Cilantro is designed so that a compromise of our servers does not expose your list content. The technical safeguards include:

• All list content is encrypted client-side using XSalsa20-Poly1305 (libsodium secretbox) before transmission.
• List keys are wrapped with X25519 + Poly1305 (libsodium sealbox) for each member individually. The server never sees a list key in plaintext.
• Authentication is passwordless: your Ed25519 private key signs a server-issued random nonce. No credential is transmitted.
• Private keys are stored in hardware-backed secure storage (Android Keystore; iOS Secure Enclave / Keychain) and never leave the device.
• All client–server communication is over TLS (HTTPS and WSS).

No security system is infallible. If you discover a security vulnerability, please contact us at the address in Section 10.

7. Your Rights

Depending on your location, you may have rights under applicable data protection law (including the GDPR for users in the European Economic Area). These may include the right to:

• Access the data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (right to erasure).
• Object to or restrict certain processing.
• Data portability.

Because Cilantro stores no plaintext content, a data export would consist of your public key, Cilantro ID, and encrypted blobs (which you can already decrypt using your device). To exercise any of these rights, contact us using the details in Section 10. We will respond within 30 days.

8. Children

Cilantro is not directed at children under the age of 13 (or 16 in the EU / EEA). We do not knowingly collect information from children. If you believe a child has used Cilantro and you would like us to delete the associated data, please contact us.

9. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the effective date at the top. For material changes, we will provide notice within the app. Continued use of Cilantro after a policy update constitutes acceptance of the revised policy.

10. Contact

If you have questions about this policy or would like to exercise your data rights, please contact:

We aim to respond to all privacy-related enquiries within 30 days.