Privacy notice

Last updated: 11.10.2026

This notice explains what personal data delelisten.com handles when you use it, why, and what your rights are. We keep it to the minimum that shared shopping lists need.

Who is responsible

delelisten.com is responsible for your personal data (the "controller"). You can reach us at privacy@delelisten.com.

What we store

• Your lists: list names, items, quantities, notes, categories and messages added by you or by the people you share a list with.
• The name you choose, shown next to items and messages. It doesn't have to be your real name.
• PINs, stored only as one-way hashes, never in readable form.
• If you sign in with Google, X or Amazon: an ID from that service, your name, and your email address and profile picture link if the service shares them.
• If you put a product on a list with a web shop's or app's "Add to delelisten" button: the product, the shop's name and the link to the product, saved with the item.
• Shops and app makers with a developer account: name, email address, company, website and a password stored only as a one-way hash.
• If you write to us with the contact form: your name, email address and message, and our answer.
• If you sign up for the newsletter: your email address, your language, and when you signed up, confirmed or unsubscribed.
• Technical data: your IP address is used for a short time to slow down abuse, and our hosting provider's server logs record IP addresses, the pages requested and the time, for security and troubleshooting.

Why, and on what legal basis

• To provide the shared lists you ask for (GDPR Art. 6(1)(b): performance of a contract).
• To keep the service secure and prevent abuse, for example PIN lockouts and rate limits (GDPR Art. 6(1)(f): legitimate interest).
• To answer when you contact us, and to send account holders important news about the service (GDPR Art. 6(1)(f): legitimate interest). The newsletter is only sent after you confirm your sign-up (GDPR Art. 6(1)(a): consent), and you can withdraw it any time with the unsubscribe link in every newsletter.

We do not use your data for advertising, profiling or tracking, and we do not sell or share personal information.

Who can see your data

• Everyone who has a list's link and PIN sees that list, including the names and messages on it.
• Our hosting provider stores the data on our behalf, under a data processing agreement.
• Our e-mail provider sends and stores e-mails for us (the newsletter and our answers to your messages), under a data processing agreement.
• Google, X or Amazon, only if you choose to sign in with them. Their own privacy policies apply on their sites.
• A shop whose "Add to delelisten" button you use only learns whether something was added, and how many products. It never sees your lists, your name or your PIN.
• If you use the microphone button: your browser or phone turns your speech into text with its own speech service (for example Google's or Apple's), under that company's privacy terms. Only the text reaches us, and no recordings are kept by delelisten.com.
• Nobody else. The site loads no external scripts, fonts or trackers, and QR codes are drawn in your browser.

How long we keep it

• Lists, items and messages: until someone with access deletes them, or until the list is removed after a long time without use.
• My Lists and sign-in accounts: until you delete them (on My Lists: Your account, Delete account), or after a long time without any lists.
• Abuse-protection data: about an hour. Server logs: as long as the hosting provider keeps them, normally a few weeks.
• Contact messages: until the matter is settled, at most two years. Newsletter: until you unsubscribe. Unconfirmed sign-ups are deleted after 7 days, and the log of sent newsletters after a year.

Your rights

You have the right to access, correct, delete or receive a copy of your data, to restrict or object to its processing, and to withdraw any consent you gave. You can do most of this yourself in the app; for anything else, contact us at privacy@delelisten.com.

You can also complain to a data protection authority, for example in the country where you live or work.

The same rights apply under the UK GDPR, the Swiss Data Protection Act and similar laws elsewhere, such as the CCPA/CPRA (California), PIPEDA (Canada) and LGPD (Brazil). We do not sell or share personal information as those laws define it.

Security

Connections are encrypted (HTTPS), PINs are hashed, cookies are signed and can't be read by other sites, and repeated wrong PINs lock a list for a while. Keep your links and PINs private: anyone with both can open the list.

Children

delelisten.com is not aimed at children under 16. A parent or guardian should set up lists for younger children.

Changes

If we change this notice, the date at the top changes. Important changes are announced on the site.

The label checker uses product data from Open Food Facts, a free and open food database made by volunteers, available under the Open Database License (ODbL). When you look up a barcode, only the barcode number is sent.