Privacy Policy

This Privacy Policy explains how Listy (the “app”, “we”, “us”, “our”) collects, uses, discloses, and safeguards information when you use Listy on iOS, Android, and the web. Listy is offered worldwide; this policy is designed to comply with applicable data protection and privacy laws in the jurisdictions where we operate, including the EU/EEA GDPR, the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (collectively the “CCPA”), other US state privacy laws, Canada’s PIPEDA, Brazil’s LGPD, Australia’s Privacy Act, and similar laws.

By installing, accessing, or using Listy you confirm that you have read this policy. If you do not agree, please do not use the app.

The data controller (or equivalent role under your local law) for personal information processed through Listy is the publisher of the app. For privacy questions, requests, or to reach our privacy contact, see Section 17.

The shopping lists and items you create, and the email addresses you enter to invite other people to a list. Listy has no password of its own — you sign in with Google.

When you sign in with Google we receive the basic profile fields Google returns: your email address, display name, and profile photo. We use these to identify your account and to show who a list is shared with.

Listy stores your data in Google Firebase, which processes technical information necessary to deliver the service, such as your IP address and basic device and app version details. Listy does not include an analytics SDK, does not build advertising profiles, and does not collect an advertising identifier — the Android app does not request the AD_ID permission at all.

We do not collect special categories of data (such as health, biometric, racial, religious, political, or sexual orientation data), precise location, contacts, photos, microphone, or camera input. Listy requests no runtime device permissions.

Listy can sort your shopping list by category. To do that, the name of an item — for example “milk” — is sent to Google’s Gemini model through Firebase AI Logic, which returns a category such as “dairy”. Only the item name is sent. Your account identity, your list names, and the other items on the list are not.

Each distinct word is sent at most once: the answer is cached against your account and reused afterwards, so a word you use every week is only ever classified once. Corrections you make by hand are stored in the same place and are never overwritten by the model.

This feature is on by default and can be switched off at any time under Smart categories on the Profile screen. When it is off, no item name ever leaves your device for this purpose. No decision made by this feature has any legal or similarly significant effect on you.

Listy requests no runtime device permissions — no camera, photo library, location, contacts, or microphone access. The app declares only the permissions needed to reach the network and to sign you in with Google.

Listy does not track you across apps or websites, does not show advertising, and does not access your device’s advertising identifier. There is no Apple App Tracking Transparency prompt because there is nothing to ask for. We honor recognized opt-out signals (such as Global Privacy Control) where applicable.

We use information to provide and maintain the app; authenticate your account; store and sync the lists you create; share a list with the people you invite; categorize item names if you leave Smart categories enabled; keep the service secure and prevent abuse; and comply with legal obligations.

We do not sell personal information, and we do not engage in cross-context behavioral advertising as defined by US state privacy laws.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to deliver the service you request); legitimate interests (to keep the app secure and prevent abuse, balanced against your rights); consent (for optional features such as Smart categories); and compliance with a legal obligation. You may withdraw consent at any time without affecting the lawfulness of processing performed beforehand.

We share information only as described below:

• A list is visible to the account that created it and to any account explicitly invited to it by email address. • Google, as our infrastructure provider — Firebase Authentication, Realtime Database, and Storage host your account and list data, and Firebase AI Logic processes item names if Smart categories is enabled. • Compliance with law, valid legal process, or to protect rights, safety, or property. • Corporate transactions such as a merger, acquisition, or sale of assets, subject to standard confidentiality safeguards. • With your consent, or at your direction.

Listy is offered worldwide, and your information may be processed in countries other than the one where you live, including the United States and the European Economic Area. When we transfer personal data out of the EU/EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or recognized adequacy decisions.

We retain personal information only for as long as necessary to provide the app, comply with our legal obligations, resolve disputes, and enforce our agreements. Lists and items are kept until you delete them or ask us to delete your account. Cached category answers are kept against your account and are deleted with it.

We use industry-standard technical and organizational measures to protect your information, including encryption in transit and access controls. No system is perfectly secure, and we cannot guarantee absolute security. Because Listy uses Google Sign-In, the security of your account also depends on the security of your Google account.

You have rights to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

California residents have the right to know what personal information we collect and how it is used and shared, to request deletion or correction, to opt out of any “sale” or “sharing” for cross-context behavioral advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA.

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana — have rights which may include the right to access, correct, delete, obtain a portable copy of, and opt out of certain processing of their personal data.

You have rights to confirmation, access, correction, anonymization, blocking or deletion, portability, information about sharing, and revocation of consent.

You may request access to and correction of your personal information and may withdraw consent subject to legal or contractual restrictions.

Residents of jurisdictions including Australia, New Zealand, Japan, South Korea, Singapore, South Africa, and India have rights granted by their local data protection laws, including access, correction, and complaint rights.

Submit a request to the contact in Section 17. We will verify your identity before responding and reply within the time required by applicable law. We will not discriminate or retaliate against you for exercising your rights.

Listy is not directed to children. We do not knowingly collect personal information from children under 13 in the United States, under 16 in the EU/EEA (or the lower age set by your member state, which may be as low as 13), or under the equivalent minimum age in other jurisdictions. If you believe a child has provided us with personal information, please contact us and we will delete it.

Listy is built with Expo and uses Google Firebase for authentication, data storage, and — when Smart categories is enabled — model-based classification of item names. These services process data under Google’s own privacy policy in addition to this one.

The information we collect, how it is used, and whether it is linked to your identity is summarized in the “App Privacy” details on the Apple App Store and the “Data safety” section on Google Play. Those summaries are provided in addition to, and consistent with, this policy.

For privacy questions, requests, or to exercise any right described above, use the contact details on our support page. If you are in the EU/EEA or UK and feel we have not adequately addressed your concern, you may also contact your local data protection authority.

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date and, where required by law, notify you in the app or by other reasonable means before the changes take effect. Your continued use of Listy after the effective date of an updated policy constitutes acceptance of the changes.