In short: Common Story collects nothing about you. There are no accounts, no analytics, no advertising, and no server that receives your data. Everything the app records stays on your own phone unless you deliberately send it somewhere.
No personal data is collected
The app never asks for your name, email address, telephone number or location, and it has no way to identify you. A wallet is created from a secret phrase that you choose and that never leaves your device. Nothing is registered with anyone.
What is stored on your phone
| What | Why |
|---|---|
| Your record of exchanges — amounts, the short description you type, timestamps, and the public keys of the people you traded with | So the app can show your balance and history |
| Names of the communities you belong to and what they call their units | To label your wallets correctly |
| Your secret phrase | Held in the phone's protected key storage so payments can be signed |
| Automatic backups of the above | Written to the app's own private storage and encrypted with your secret phrase |
All of this is removable from within the app, under Settings.
What leaves your phone, and only when you choose
The app has no server to send anything to. Data leaves your device in exactly three situations, all of which you start yourself:
- Exchanging with someone in person. A payment record passes between two phones directly — by showing a QR code, or over your local Wi-Fi network between devices in the same place. It goes to that person's phone and nowhere else. Only records of exchanges between the two of you are passed: your phone does not keep, or hand on, that person's dealings with anybody else.
- Sending a link. When you tap "share", your phone's own sharing menu passes the text to whichever app you pick — a messaging app, email, and so on. From that point the message is handled by that service under its own privacy terms, and the details inside the link are visible to it.
- Sending yourself a backup. If you choose to keep a copy in cloud storage or email, you are sending it there. The file is encrypted with your secret phrase, which is not included in it.
The website
Links the app produces point at commonstory.app so that phones recognise them and open the app. The details of a payment or invitation are carried in the part of the address after the # symbol, which web browsers never send to a server. This site therefore does not receive the amounts, descriptions, wallet identifiers or network addresses inside those links.
The site is a set of static pages. It sets no cookies, loads nothing from other companies, and runs no analytics or tracking of any kind. As with any website, the hosting provider keeps ordinary server logs of requests.
Permissions the app asks for
| Permission | What it is for |
|---|---|
| Camera | Reading QR codes. Images are processed on the device as you point it and are never stored or sent. |
| Nearby devices | Only if you switch on local sync, which is off by default. It finds, on the same Wi-Fi network, the phones of people you have already traded with, so the two of you can fill in any record one of you is missing. Only records of exchanges between you and that person are exchanged. Leave it off and the permission is never requested. |
| Network access | Used only for that direct connection between devices on your local network. The app contacts no online service. |
The app deliberately does not request location access, and asks for nothing at all until you use the feature that needs it.
Other people's records
When you trade with someone, both phones keep a copy of the signed record of that exchange, because a mutual record is what makes it verifiable. Removing your own copy does not remove theirs, in the same way that tearing up your receipt does not erase the shop's. This is how the system is meant to work.
Children
The app is intended for members of a community who have agreed to keep records together. It collects no data from anyone, of any age.
Changes
If this notice changes, the date at the top will change with it. Since there is no account and no mailing list, the current version will always be here.
Contact
Questions about this notice can be sent to contact@commonstory.app.