Privacy Policy
Last updated 1 September 2026.
ListFlow is a shared shopping-list app. This policy explains what personal data it holds, why, who else ever sees it, and how you get a copy of it or have it erased.
What we collect
Your account: your display name, your email address, and the passkey credentials your device registers. There is no password — we never receive or store one.
Your content: the lists and items you create, their categories, whether an item is completed, and who you share a list with.
Product analytics: a record of in-app events such as creating a list or accepting an invite. These are written to our own database, not to any analytics provider, and carry no advertising or cross-site identifier.
Photos you import: a photo you take for photo-import is processed to extract its text and is not stored after the items are created.
Legal basis
We process your account and content data to perform the contract you enter into by using ListFlow (GDPR Art. 6(1)(b)) — without it there is no list to show you and no way to sign you in. Product analytics and security logging rest on our legitimate interest in keeping the service working and improving it (Art. 6(1)(f)); they are limited to our own database and are never used to profile you or to advertise to you.
Who else processes your data
ListFlow uses two external processors, and nothing else. Neither is permitted to use your data for their own purposes.
- Mistral AI (France) — categorizes items and reads text out of photos you import. It receives the item text you type, or the photo you take, at the moment you use those features. It does not receive your name, your email address, your account identifier, or the rest of your lists. You can turn AI categorization off per list, and then nothing from that list is sent.
- Resend (email delivery) — sends our sign-in links and address-verification messages. It receives your email address and the contents of that message. It is never sent your lists or items.
Where your data is stored
ListFlow is self-hosted on servers in the European Union, and its database and its backups stay in the EU. Both sub-processors above are configured to process in their EU regions, so your data is not routinely transferred outside the EU/EEA.
How long we keep it
Your account and content are kept for as long as your account exists. When you ask us to delete your account we erase it within 30 days, and in practice within a day: the erasure job runs daily. Lists you share with other people transfer to the longest-standing collaborator so their lists keep working; lists only you used are deleted with your account.
Sign-in links and verification tokens expire after 15 minutes and are then purged. After an erasure, all that remains is a one-way hash of your account identifier, kept so we can prove the deletion happened — it contains no name, email address, or content and cannot be reversed to recover them.
Your rights and how to use them
You have the right to access, correct, export, and erase your personal data, to restrict or object to processing, and to complain to your national data protection authority.
Two of those are built into the app. Open Account settings from the avatar at the top of the screen, then:
- Your data → Download my datagives you everything we hold about you as a single file. Other people's names and email addresses are not included.
- Delete account queues your account for permanent erasure. It signs you out immediately and cannot be undone.
For anything else — correction, restriction, objection, or a question about this policy — email us at the address below.
Cookies
ListFlow sets one cookie: the session cookie that keeps you signed in. It is strictly necessary to provide the service you asked for, so there is no cookie banner to click. We set no analytics, advertising, or tracking cookie, and there is no third-party tracker anywhere in the app — our analytics runs entirely on our own server and never touches your browser storage.
The app also stores a few things locally on your device — a dismissed banner, a hint you have already seen, and any list edits made while you were offline, which are sent to our own server when you reconnect. None of it is used for tracking.
Contact
Questions about this policy, or about how your data is handled, go to privacy@mylistflow.app. You also have the right to lodge a complaint with your national data protection authority.