Bonnee privacy policy
Effective date: 1 November 2026
Bonnee is a shared grocery list for families. This policy explains what data Bonnee handles, where it is kept, and how to remove it.
Who we are. Bonnee is made by D10 (Scotland) Limited, a company registered in Scotland (company number SC783696), registered office 29 South Harbour Street, Ayr, KA7 1JA, Scotland. Contact: support@bonnee.io. In this policy "we" means D10 (Scotland) Limited. For the purposes of UK and EU data protection law we are the controller of the data in "Extensions" and "Crash reports" below. This policy is governed by the law of Scotland.
Your list stays in your iCloud
Your list, its items, aisles, learned sorting, store layout, and who added or cleared what are stored in your own iCloud account using Apple's CloudKit: in your iCloud private database, and, when you share the list, in the shared database of the people you invite. Apple's documentation says these databases are not visible to app developers. We cannot see, read or copy your list. Apple's handling of iCloud data is covered by Apple's privacy policy (https://www.apple.com/legal/privacy/).
Bonnee does not ask for an account, an email address or a phone number. It uses the iCloud account already on your iPhone.
Siri and the Shortcuts actions ("Add to Bonnee", "Clear ticked items") run on your iPhone and write to your list directly. They do not go through our servers. Apple's handling of Siri requests is covered by Apple's privacy policy.
Kept only on your iPhone
- Settings such as the name you give this iPhone, and a cached copy of your iCloud user ID, are kept in the app's own storage on your iPhone. (The iPhone's name also goes to the inbox when Extensions are on; see below.)
- The diagnostics log (Family > Diagnostics) records app events such as sync and sharing errors, with error codes and never your item names. It stays on your iPhone, keeps at most 500 events, and is deleted with the app. If you choose to share it (for example by email to support), you send it yourself, and we receive only what you send.
- Crash and hang reports from Apple's MetricKit are reduced to a short summary and kept in the same on-device log.
Extensions (the Bonnee inbox)
Extensions let other apps and scripts, such as a meal planner, add items to your list. They are off until the list's owner turns them on (Family > Extensions > Turn on extensions). To make them work, we run a small service, the Bonnee inbox, at inbox.bonnee.io, hosted by Cloudflare.
When Extensions are on, the inbox stores:
| Data | Why | How long |
|---|---|---|
| The text of items that a connected app or script sends, and the connection's name | So a phone in your family can pick them up and add them to your list | Deleted as soon as a phone adds them to your list, and in any case after 7 days |
| Connection names (for example "Meal planner") and the last 4 characters of each key | To show your connections and who added them | Until the connection is removed, then 30 more days, then deleted |
| The name of each family phone (the name you type, or "iPhone") | To show your family's devices | Until the phone is removed, then 30 more days, then deleted |
| Each phone's Apple push notification token | To wake your phones with a silent notification when items arrive. Bonnee never shows you a notification from this | Until the phone is removed, Extensions are turned off, or Apple reports the token is no longer valid |
| A per-family code for each person, made by scrambling (hashing, with your family's ID as the key) your iCloud user ID, never the ID itself | So that when someone leaves the family, the keys they created stop working | As long as the phone, family or connection it belongs to |
| Random IDs for your family, phones and connections, and one-way hashes of their keys | To recognise your phones and keys | As above |
When the owner turns Extensions on, every phone that uses the shared list joins the inbox automatically, under the name "iPhone" unless someone renames it.
The inbox does not store your list. It never reads your list and never receives the items you type in the app. Item text from a connected app passes through the inbox and is held there, readable by the service, only until a phone collects it (at most 7 days).
The inbox does not store your IP address. Cloudflare processes it to deliver the request, and the inbox uses it briefly to limit how often new families can be created. Our request logs contain no item text, no names, no keys or tokens and no IP addresses; they record the route, the result, timing, a shortened code for the family and the phone's or connection's random ID. Cloudflare keeps these logs for at most 7 days.
Unused data is removed automatically:
- a phone not seen for 90 days is removed;
- a family with no phone seen for 60 days, or a family with only one phone and no connections after 7 days, is deleted;
- removed phones, connections and families are deleted for good 30 days later.
Where it is stored: Cloudflare's network. The queue of items is placed in Western Europe; the registry of families, phones and connections is held in Cloudflare D1, created with a Western Europe location hint (a preference for where the data is placed, not a guarantee).
Crash reports (Sentry)
To fix problems, Bonnee sends crash reports, freeze (hang) reports and error codes from your iPhone to Sentry, a crash-reporting service, using its EU data region. A report contains the type of error, the code location where it happened (a stack trace), the app version and build, and the iPhone model and iOS version. It never contains your list, item names, your name, your iCloud ID or your device's name: everything else is removed on your iPhone before sending. Like any internet request, a report reaches Sentry from your iPhone's IP address; Bonnee's Sentry project is set not to store IP addresses. Each crash or freeze is reported; an error code for the same error is sent at most once a day per phone, and no more than 10 error reports are sent a day per phone.
This is on by default. You can turn it off on each iPhone in Family > Diagnostics; when it is off, nothing is sent from that iPhone. Sentry keeps error reports for 30 days.
Who else handles data
| Company | What | Their policy |
|---|---|---|
| Apple | iCloud storage and sharing of your list (CloudKit), push notifications, Siri | https://www.apple.com/legal/privacy/ |
| Cloudflare | Hosts the Bonnee inbox (Extensions only) | https://www.cloudflare.com/privacypolicy/ |
| Sentry (Functional Software, Inc.) | Crash reports (EU region), unless turned off | https://sentry.io/privacy/ |
We do not sell data, show ads, or use data for tracking or advertising. We share data with no one else.
Legal basis (UK and EU)
The inbox data is processed to provide the Extensions feature you turned on (performance of a contract); crash reports are processed for our legitimate interest in keeping the app working, with a per-phone switch to object.
Removing your data
- Your list: delete items or the list in the app, or stop sharing (Family > Manage sharing). To delete what Bonnee stores in your iCloud, open Settings > [your name] > iCloud > Storage (or Manage Account Storage), tap Bonnee and delete its data. If you need help, email support@bonnee.io.
- Extensions data: the list's owner can tap Family > Extensions > Turn off extensions. That deletes every waiting item at once, removes all push tokens at once, and stops all phones and keys; the remaining records are deleted for good after 30 days. You can also remove a single connection or phone there. A family member who leaves a shared list ("Remove Me") has their phone and the keys they created removed.
- Diagnostics on your iPhone: deleted when you delete the app.
- Crash reports: turn the switch off in Family > Diagnostics. To ask us to delete reports already sent, email support@bonnee.io; reports do not identify you, so tell us roughly when the crash happened and on which app version.
- Anything else: email support@bonnee.io. You can also ask us what data we hold about you, or to correct it. You have the right to complain to the UK Information Commissioner's Office (https://ico.org.uk) or your local data protection authority.
Children
Bonnee is a family list, and a family may include children. Bonnee asks no one for their age, email or contact details (only a name for each iPhone, if Extensions are used), and holds no list contents on our servers. The only data on our servers is described in "Extensions" and "Crash reports" above. We set no minimum age. If a parent asks us to delete a child's data, the steps in "Removing your data" apply, and you can email support@bonnee.io.
Security
All connections to the inbox use HTTPS. Keys are stored only as one-way hashes, apart from their last 4 characters, which are shown so you can tell keys apart. Each phone's inbox credential is kept in that iPhone's Keychain and is never synced to your other devices.
Changes
If we change this policy, we will publish the new version here with a new effective date. We will also note material changes in the app's release notes.