Privacy Policy

Data controller

Tom Reino Haugstulen is the data controller for personal data processed through Handlelista.

Questions about privacy, access or deletion can be sent to handlelista.support@gmail.com.

Sign-in and account

Handlelista uses sign-in with Apple or Google. When you sign in, a technical user ID, sign-in provider, relevant authentication information and timestamps are processed. Your name and email address are processed when the sign-in provider makes this information available.

Supabase Auth handles authentication and sessions for the app. Handlelista does not use email and password as its own sign-in method.

Shopping list and partner feature

For the private shopping list, the app processes the list ID, item name, purchased status, sorting information and timestamps for creation or changes.

When the partner feature is used, the app processes the partner relationship, time-limited invitation links, sender, recipient, the short text that is sent, message timestamps, whether the message has been presented to the recipient and whether the recipient chooses to add it to the shopping list.

When a user is blocked or reported, user IDs, the selected report reason, any information you enter in the report and necessary timestamps are processed in order to prevent a new connection and follow up misuse.

What your partner can see

Each user has their own private shopping list. A partner cannot open, read or change your list and does not receive list, online or read status.

Your partner can see your name in the partner connection. When you send a short message, your partner receives only the text you chose to send. The message is not automatically added to the recipient's shopping list; the recipient decides whether to add it. Your email address is not shared with your partner through this feature.

Push notifications and device data

If you enable phone notifications, an Expo push token linked to the user and device, the platform and technical delivery information are processed. Push receipts are used for delivery and to remove invalid tokens.

A notification about a received message may contain the message text and may therefore be visible on the lock screen depending on the phone's notification settings. Notifications can be disabled in the app or in the phone's settings.

Handlelista does not store facial or fingerprint data. Biometric verification is performed by the operating system, and the app only receives the result of the verification.

Support

When you contact support from the app, the account email address, any separate reply address you provide, the selected category, your message, app version and platform are processed. This information is used to respond to and resolve your request.

The support request is sent via Resend to Handlelista's support address and may be stored in the support email system for as long as necessary to process and follow up the request.

Technical timestamps and rate-limit events are processed to limit misuse of the support feature.

Purposes and legal basis

Account, list, partner and ordinary support data are processed in order to provide and follow up the service you request, under Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Optional push notifications are processed when you enable the feature and grant the necessary system permission, under Article 6(1)(a) GDPR. Consent can be withdrawn at any time by disabling notifications.

Security logs, rate limiting, blocking and reporting are processed to protect users and the service against misuse, under Article 6(1)(f) GDPR.

Personal data is not used for advertising, profiling, sale of personal data or marketing.

Service providers and recipients

Supabase provides authentication, database and server functions. Apple and Google are used as sign-in providers. Expo and the operating system's notification service are used when push notifications are enabled. Resend is used to send support requests from the app to Handlelista's support address.

These providers process information that is necessary for the functions they provide and are subject to their own security and privacy obligations.

Providers may process data outside the EEA. Where required, such transfers must be protected by a valid transfer mechanism, such as Standard Contractual Clauses.

Information is otherwise disclosed only when required by law or when necessary to protect users and the service.

Retention and deletion

Account and shopping-list data are retained while the account is active or until you delete the content yourself. Partner data are retained for as long as necessary for the partner feature. Expired invitations, old push receipts and invalid push tokens are removed when they are no longer needed.

When you disable phone notifications or sign out, the device's registered push token is removed. Local app information may remain on the device until it is deleted by the app, you clear the app data or uninstall the app.

You can delete your account from Settings. Account deletion removes the authentication account and associated app data covered by the deletion process. Limited security information may be retained when necessary to handle misuse or comply with legal requirements.

Local storage and security

The sign-in session, onboarding status, Face ID setting and certain local app preferences, including settings for sound, animation, haptics and notifications, are stored on the device.

Access to server data is protected by Supabase Auth, Row Level Security and controlled database functions. Server secrets are not stored in the app client.

No technical solution can guarantee absolute security, but Handlelista uses access restrictions, authenticated requests, data minimisation and clean-up measures to reduce risk.

Your rights and choices

You may request access, rectification, deletion, restriction, data portability or object to processing where the conditions under applicable data protection law are met.

You can change local notification and effect settings, disconnect from or block a partner and delete your account directly in the app. Consent to optional notifications can be withdrawn without affecting the lawfulness of processing carried out before withdrawal.

Requests can be sent to handlelista.support@gmail.com. You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe your personal data is being processed in breach of applicable data protection law.

Changes

This policy is updated when data use, service providers or features change. The date at the top shows when the text was last updated.