Pancake privacy policy
Last updated 21 October 2026.
In short
Pancake is a shared list for a household. An individual developer publishes the app and operates the relay, which is the server the app uses. This page says what happens to your information.
The app stores your lists on the phone. A private card stays on that phone. The app does not upload it. The relay drops a card that is not shared.
When you share a list, the relay receives the display name and colour you choose, the shared cards, a push address if you allow notifications, and a join code, which expires after 10 minutes. The app does not ask for an account, a password, or an email address.
The app talks to the relay over HTTPS. The shared card text is not encrypted a second time. The developer who operates the relay can read a shared card while the relay holds it. The other people in the household can read it once their phone has it. A notification that carries a card is also processed by Google or Apple, or by the browser's push service.
The relay does not keep a lasting archive of your lists. Pancake does not sell personal information. It does not use advertising or analytics services.
To ask about this data, use the developer email shown on the Pancake listing in Google Play or the App Store.
Who is responsible
The controller is that developer, the person who decides why this information is used. The contact is the developer email shown on the Pancake listing in Google Play or the App Store. There is no data-protection officer.
The people in a household are users of the relay. They do not operate it. This notice covers the Pancake apps and the relay. Apple, Google, and a browser vendor describe their own processing in their own notices. A shared card that has reached someone else's phone stays on that phone.
On the phone
The app stores your lists on the phone. A private card stays on that phone. The app does not upload it. Removing the app deletes the copy stored on the phone. Removing the app does not delete the relay's record of the household.
The camera is used to read a join code. The picture is not saved or uploaded. The app sends the code it read.
The phone apps do not use cookies. The relay does not set one. The app does not ask for your contacts, your location, or an advertising identifier.
What is sent
When you share a list, the app sends:
- the display name and colour you choose
- each shared card: its title, notes, due date, repeat rule, whether it is done, who added it, whether a phone asked to be notified, and the times recorded on the card
- a push address for this phone, if you allow notifications, so the other phones can be woken
- a join code, which expires after 10 minutes
The relay drops a card that is not shared.
A shared card contains whatever you type. While the relay holds it, the household, the developer who operates the relay, and the service that delivers a notification can read it.
The relay keeps short operational notes, such as a failed delivery. Those notes do not include the text of a card.
Why
Where the UK GDPR or the EU GDPR applies, the reason the law accepts is:
- Contract, to provide the shared list you asked for. If you do not share a card, the other phones do not receive it. Private cards stay on your phone.
- Consent, to wake another phone when you allow notifications. Turn notifications off to withdraw that consent. The list on the phone still opens.
- Operational notes, to keep the relay reliable and to limit abuse. The basis is legitimate interests. You can object. An objection does not stop a shared card you still choose to send.
- Legal obligation, where a legal duty applies.
Pancake does not make a decision about you by automated means that produces a legal effect, or a similarly significant effect.
Who else receives it
The other people in the household receive the shared cards, the display names, and the colours. That is what the relay is for. Their phones keep what they have already received.
To wake a phone, the relay sends the update through Google Firebase Cloud Messaging on Android, through Apple Push Notification service on iPhone, and, on the website, through that browser's push service. When an alert is shown on Android or iPhone, the title is "Board updated". The update can include the shared card so the other phone can show it. Google, Apple, and the browser's push service process that delivery. Their processing can take place in the United States and in other countries where they operate.
The developer may disclose information held on the relay if the law requires it, or if it is necessary to protect the relay or a person's safety. Where the law allows it, the developer will tell the household.
Pancake does not sell personal information, and it does not share personal information for cross-context behavioural advertising. Under California law, "sell" and "share" have those specific meanings. Pancake does not use advertising or analytics services.
Who can read a shared card
The app talks to the relay over HTTPS. The shared card text is not encrypted a second time. The person who operates the relay can read the shared lists, the display names, the colours, and the push addresses stored there.
No method of transmission or storage is completely secure.
How long it is kept
A join code expires after 10 minutes.
The relay keeps a shared card until the other phones have it, or for up to 30 days if a phone does not confirm. It does not keep a lasting archive of your lists. Your name, colour, and push address are kept while you are in the household. Leaving removes you from the household on the relay. A push address can remain after you leave. Working copies used to run and update the relay can persist for a while after a card has been delivered.
Operational notes are kept for a limited time.
Removing the app deletes the copy stored on the phone. There is no separate account to delete. Removing the app does not delete the relay's record. Delete a card in the app, or leave the household, to clear what the relay is holding for you.
Your rights
Where the law gives you these rights, you use the app. The lists are on the phone, so you can see them, correct them, and delete a card there. Leaving the household removes you from the relay.
You can object to the operational notes by writing to the developer email and describing the household. The developer then stops that processing unless the law allows it to continue for a compelling reason. You withdraw consent for notifications by turning them off. That does not recall a shared card already sent.
You can complain to a data protection authority in the place where you live, where you work, or where you believe the problem happened.
Children
Pancake is not directed at children under 13. The developer does not knowingly collect personal information from a child under 13. There is no age check in the app. If a parent or guardian believes a child under 13 has used Pancake and cannot leave from that phone, they can write to the developer email on the store listing.
California
If the California Consumer Privacy Act applies, the relay receives the name, the shared cards, and the push address described above, from the phone, for the purposes above. The developer does not sell or share that information as the Act defines those words, and does not use it to infer characteristics about you. You will not be treated worse for asking a question about this notice.
Changes
Changes are posted on this page. The date at the top is the date they take effect.
Contact
To ask about this data, or to object to the operational notes, use the developer email shown on the Pancake listing in Google Play or the App Store.