Lista — Privacy Policy

Last updated: 2 September 2026

Lista is a shopping list app made by Ögrens Fantasifabrik AB, Malmö, Sweden ("we", "us"). We are the data controller for the personal data described here, within the meaning of the EU General Data Protection Regulation. This policy explains what we collect, why we are allowed to, how long we keep it, and how to get it deleted. The way to reach us about any of it is the contact form.

What we collect

When you sign in with your Apple ID, we receive and store:

• A Firebase user ID derived from your Apple ID. Used to sync your lists across your devices and to identify you to other people you share a list with.
• Your display name, if you chose to share it via Sign in with Apple. Shown to people you share the list with of any list you share, so they see a real name instead of a random ID.
• Your email address, kept by Firebase Authentication purely as the standard sign-in identifier. We never write the email into our shareable user profile, and other users cannot read it.

While you use the app, we store:

• The shopping lists you create, the items in them, and any custom items you add.
• Your category customisations (default categories you renamed, custom ones you added).
• Your app preferences that need to follow you between devices, such as the order your lists appear in.
• Invite tokens for lists you have shared, so an invite link can be opened and can be revoked.

What you check off stays on your phone. Lista keeps a history of it to work out which groceries you buy often, so those rise to the top when you are adding things. That history is never sent to us and never leaves the device, which also means it does not follow you to a new phone.

Your purchase of Lista Pro is handled by Apple. We never see your payment details; the app asks StoreKit whether the purchase exists, which is what makes it survive a reinstall or a new device.

What we do NOT collect

• No advertising identifiers. We do not track you across apps or websites.
• No analytics and no crash-reporting SDK. The app links Firebase Authentication and Firestore and nothing else from that family.
• No location, no contacts, no photos, no microphone, no camera.

Why we are allowed to (legal basis)

Everything above is processed to perform the contract you enter into by using Lista — Article 6(1)(b) of the GDPR. Your lists cannot sync between your devices without an account, and a shared list cannot show who is in it without a name. We do not rely on consent, because we do not do anything with your data beyond running the app, and we do not rely on legitimate interests to justify anything you would not expect.

Where it lives, and how long

Your data is stored in Google Cloud Firestore, in Google's eur3 multi-region, which means data centres in Belgium and the Netherlands. It does not leave the EU in normal operation. Google acts as our processor under Google's Data Processing Addendum, which incorporates the European Commission's standard contractual clauses to cover the cases where Google support staff outside the EEA can access data.

The app also keeps a local copy on your device (SwiftData) so it works offline. That copy is yours; deleting the app removes it.

We keep your data for as long as your account exists. We do not archive it and we have no separate backup that outlives a deletion. Delete your account and it is gone, subject only to Google's own short-lived infrastructure backups.

Sharing lists

When you share a list with someone via an invite link, only the people you invite can read and edit that list. Their addition is logged in the list's memberUids. You can revoke an unused invite link or stop sharing with anyone at any time from inside the share sheet.

Sharing a list means the other members can see the items in it and the name on your profile. It does not give them your email address.

Deleting your data

Inside the app, the gear menu has a "Delete Account" button. Tapping it permanently deletes:

• Every list you own (and removes them for the people you'd shared with).
• Your access to any list you'd been invited to.
• Your custom items, custom categories, purchase history, preferences, and profile.
• Your Firebase Authentication user.

After deletion, signing back in with the same Apple ID starts a brand-new account.

Your rights

Under the GDPR you have the right to ask us for a copy of your personal data, to have it corrected, to have it erased, to restrict or object to how we process it, and to receive it in a portable form. You also have the right not to be subject to automated decision-making; we do none.

Erasure you can do yourself, immediately, with Delete Account in the app — that is the fastest route and it needs no request. For anything else, use the contact form and we will answer within one month, as the GDPR requires.

If you think we have handled your data wrongly you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority in the EU country where you live.

Children

Lista is not directed at children under 13. We do not knowingly collect data from children.

Changes to this policy

If we change how we handle your data, we will change the date at the top and, where the change matters to you, say so in the app rather than only here.

Contact

Questions or requests: use the contact form.