Privacy Policy

Data controller

Tom Reino Haugstulen is the data controller for personal data processed through Handlelista.

Questions about privacy, access or deletion can be sent to handlelista.support@gmail.com.

Sign-in and account

Handlelista uses sign-in with Apple or Google. When you sign in, the app processes a technical user ID, sign-in provider, relevant authentication information and timestamps. Name and email address are processed when the sign-in provider makes them available.

Supabase Auth handles authentication and sessions. Handlelista does not use email and password as its own sign-in method.

Shopping list and partner features

For your private shopping list, the app processes list ID, item names, purchased status, ordering and timestamps for creation or changes.

When partner features are used, the app processes the partner relationship, time-limited invitation links, sender, recipient, content you choose to send, timestamps and the status needed for delivery and handling.

You can send one item or a copy of all active items on your shopping list to your partner. When you send the whole shopping list, a transfer is created with sender, recipient, item count and timestamp. Item names and ordering are stored as a temporary snapshot while the transfer waits for the recipient's choice.

If you block or report someone, the app processes user IDs, the selected report reason, any information you enter in the report and necessary timestamps to prevent reconnection and address misuse.

What your partner can see

Each user has a separate private shopping list. A partner cannot open, read or edit your list and does not receive list, online or read status.

Your partner can see your name in the partner connection and content you explicitly choose to send. If you send one item, your partner receives only that item. If you send the whole shopping list, your partner receives a copy of the active items that were on the list when you sent it, not access to your private list.

The recipient must choose to receive, add, replace or decline a sent shopping list, depending on whether the recipient already has items on their own list. Your email address is not shared with your partner through this feature.

Locally saved shopping lists and prices

When you use the saved shopping list feature, the list name, item names, checked status, any local price and save timestamp are stored locally on the device and associated with the account in the app's local storage. The saved shopping list itself is not synced to Supabase or your partner and is not automatically transferred between devices.

Prices are stored locally on the device and used to calculate the total. Price data is not sent to Supabase or your partner and is not included when you send the whole shopping list.

When a saved list is loaded, its items are created in the active shopping list with the saved checked status. Item names and checked status are then processed by Supabase as ordinary active-list data, while prices continue to be restored and stored locally on the device.

Push notifications and device data

If you enable phone notifications, the app processes an Expo push token linked to the user and device, platform and technical delivery information. Push receipts are used for delivery and to remove invalid tokens.

A notification about a received item may contain the item name. A notification about a sent shopping list may state that your partner sent you a shopping list. Notifications may appear on the lock screen according to your phone settings and can be disabled in the app or in the phone's settings.

Handlelista does not store face or fingerprint data. Biometric checks are performed by the operating system, and the app receives only the result of the check.

Support

When you contact support from the app, the app processes the account email address, any separate reply address you provide, selected category, message, app version and platform. The information is used to answer and resolve your request.

The support request is sent through Resend to Handlelista's support address and may be stored in the support email system for as long as necessary to handle and follow up the request.

Technical timestamps and rate-limit events are processed to limit misuse of the support feature.

Purposes and legal basis

Account, list, partner and ordinary support information is processed to provide and follow up the service you request, under GDPR Article 6(1)(b).

Optional push notifications are processed when you enable the feature and grant the necessary system permission, under Article 6(1)(a). You can withdraw consent at any time by turning notifications off.

Security logs, rate limiting, blocking and reporting are processed to protect users and the service against misuse, under Article 6(1)(f).

Personal data is not used for advertising, profiling, sale of personal data or marketing.

Service providers and recipients

Supabase provides authentication, database and server functions. Apple and Google are used as sign-in providers. Expo and the operating system's notification service are used when push notifications are enabled. Resend is used to send support requests from the app to Handlelista's support address.

These providers process information that is necessary for the functions they provide and are subject to their own security and privacy obligations.

Providers may process data outside the EEA. Where required, transfers must be protected by a valid transfer mechanism, such as Standard Contractual Clauses.

Information is otherwise disclosed only when required by law or necessary to protect users and the service.

Retention and deletion

Account and list data is kept while the account is active or until you delete the relevant content. Partner data is kept for as long as necessary for the partner feature. Expired invitations, old push receipts and invalid push tokens are removed when they are no longer needed.

For a sent shopping list, the temporary snapshot containing item names and ordering is deleted after the recipient has resolved the transfer. Limited transfer metadata, such as sender, recipient, item count, timestamps and the selected outcome, may be retained for as long as necessary for functionality, error handling, security and rate limiting.

When you disable phone notifications or sign out, the registered push token for the device is removed. On ordinary sign-out, account-scoped local data such as saved shopping lists, item prices, onboarding status and settings may remain on the device so they can be available again to the same account. They can be removed through app features, account deletion, clearing app data or uninstalling the app.

You can delete your account from Settings. Account deletion removes the authentication account and associated server data covered by the deletion process, and the app also attempts to remove Handlelista's local account data from the device. Limited security information may be retained if necessary to address misuse or comply with legal obligations.

Local storage and security

The sign-in session, onboarding status, Face ID setting, named saved shopping lists, local item prices and certain app preferences, including sound, animation, haptic and notification settings, are stored on the device. Local shopping lists and prices are separated per account in the app's local storage.

Access to server data is protected using Supabase Auth, Row Level Security and controlled database functions. Server secrets are not stored in the app client.

No technical system can guarantee absolute security, but Handlelista uses access controls, authenticated requests, data minimisation and cleanup measures to reduce risk.

Your rights and choices

You may request access, correction, deletion, restriction, data portability or object to processing where the requirements of applicable privacy law are met.

You can change local notification and effect settings, disconnect or block a partner and delete your account directly in the app. Consent to optional notifications can be withdrawn without affecting the lawfulness of processing carried out before withdrawal.

Requests can be sent to handlelista.support@gmail.com. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe your personal data is processed unlawfully.

Changes

This policy is updated when data use, providers or features change. The date at the top shows when the text was last updated.