Privacy Policy — Listitt

DRAFT. This text is a starting point and should be reviewed by a lawyer before it is published.

Fill in the placeholders in square brackets: Ori Steinberg, listitt.app@gmail.com, 2026-10-07.

Last updated: 2026-10-07

1. Who we are

Listitt (the "App", "we") is a Hebrew shopping-list app with shared lists and supermarket price comparison. It is operated by Ori Steinberg. For any privacy question contact listitt.app@gmail.com.

2. What we collect

• An anonymous user ID. When you first open the App a random ID is created for you, with no name and no password. It lets us keep your lists in the cloud and sync them.
• Your email address — only if you choose "Save my account". Used to send a sign-in code and to sign in on a new phone.
• A display name — if you set one. Shown to the members of lists you share.
• List contents — product names, quantities, notes, checked state, category, and an optional barcode of a product you picked. In a shared list each item also records which member added it, so members can see who added what.
• Recipes and folders — recipes you save and the names of folders you create to group your lists. They are private to you.
• Published recipes — a recipe you leave public is shown to all users in the recipe book with its text, photo and your display name (or no name if you have not set one). It is not linked to your email or your lists. Switch the recipe to private, or delete it, and it disappears from the book.
• Likes and comments — when you like a public recipe or write a comment, we store it with your anonymous ID; a comment is shown to all users with your display name. Delete the comment, or your account, and it is removed.
• Recipe photos — if you add a photo to a recipe, it is stored on our servers (in a folder that belongs to your anonymous ID, under a random file name) so it appears on all your phones. Anyone who has the link can open the photo, so do not add photos with people or personal details. A recipe imported from a web page only keeps a link to that page's picture. Deleting the recipe or your account deletes your photos.
• Sharing data — which lists are shared with whom, and invite codes (valid for 7 days).
• Costs in shared lists — if members choose to record what was bought and what it cost, the list stores who bought each item, the amounts, and each member's portion of the bill. Members of that list can see them.
• Reports and suggestions you send — if you press "report this price" or send a suggestion, we receive the text you write, the product and branch the report is about, the screen you were on, and your anonymous user ID. Do not put personal details in them.
• Basic technical data — like any cloud service, our servers temporarily log connection data (IP address, time, request type) for security and operation.
• Error reports — when the App hits an error, it sends the technical error text, the app version and the phone's operating system version, so we can fix the problem. They do not contain your lists, names or email.

• Your location stays on your phone. If you choose "use my location" to find nearby supermarket branches, the App reads your approximate position on your phone, compares it with a list of branches stored on your phone, and does not send it to us or to anyone else. You can instead choose a city from a list. The chosen city or position is saved only on your phone.

We do not collect: your location (it is used only on your phone, see above), contacts, phone number, advertising ID, payment details, photos or recordings.

3. How we use it

1. To run the App: store and sync lists, share them with people you invite, send sign-in codes.
2. To show price comparisons and offers relevant to your list.
3. To keep the service secure, prevent abuse and handle support requests.
4. To improve the App using aggregated, non-identifying data (see section 5).

4. Who we share it with

We do not sell personal data and we do not pass it to advertisers. We use service providers that process data on our behalf, only to provide the service:

• Supabase — data storage and sign-in (server region: Southeast Asia (Singapore)).
• Brevo — sending the emails with sign-in codes.
• Error reports go to our own Supabase storage; we do not use a separate crash-reporting company. If that changes, the provider will be named here first.

Please note: our hosting servers are located outside Israel (Southeast Asia (Singapore)), so your data is transferred to and stored outside Israel. We choose providers that are committed to protecting data and we take steps so that the transfer complies with applicable law.

Information about a shared list (its name, contents and the display names of its members) is visible to the members of that list — people you invited or who invited you. We may disclose information if required by law or a court order.

5. Aggregated and de-identified data

We reserve the right to use aggregated and de-identified data — data that cannot be linked to a specific person — to improve the service, analyse trends (for example which products are popular or which searches find nothing), and for statistics and research. We will not try to identify you from such data.

6. How long we keep it

We keep your data while your account exists. When you delete your account, your lists and data are deleted from our servers (see section 7). Our provider may keep backup copies for a short, limited period until they are overwritten in the normal cycle.

7. Deleting your account and data

• In the App: Account screen → "Delete my account and data". This permanently erases the account and the lists you own, from the server and from your phone. A shared list passes to another member.
• Without the App: email listitt.app@gmail.com from the address registered on the account (see the "Account deletion" page). We handle requests within 30 days.
• Signing out only removes the lists from this phone; they stay in your account.

8. Your rights

Under Israel's Privacy Protection Law (1981) you may view the information held about you, ask to correct it and ask to delete it. Contact us at the address above. If you are in the European Union, you also have rights under the GDPR (access, rectification, erasure, restriction, portability and objection).

9. Security

Data is transmitted over HTTPS and access is limited by row-level security: each user sees only lists they are a member of. No system is perfectly secure and we keep improving it.

10. Children

The App is not intended for children under 16. If we learn that we collected data from a child under that age, we will delete it.

11. Prices and offers

Prices and offers in the App are based on information supermarket chains publish to the public by law. They are estimates only and may differ in your branch or at the time of purchase. The App is not affiliated with the supermarket chains and does not sell products.

12. Changes

We may update this policy. For significant changes we will notify you in the App. Continuing to use the App after an update means you accept the updated policy.

13. Contact

Ori Steinberg — listitt.app@gmail.com