List10 Privacy Policy

1. Data controller

Stråle & Co AB (www.straale.se) is the data controller for personal data processed in List10 (shoppinglist10.com).

2. Data we process

You can use List10 without an account; your list is then stored only on your device.

• Email address, for sign-in with a one-time code or via Google/Apple.
• An internal account ID linking your data to your account.
• Shopping lists and items (name, quantity, translation, checked state).
• Shared-list memberships and invite links you create.
• Custom products and product names you have saved.
• Settings: Min butik (store order) and appearance (light/dark/system).
• Technical sync data such as timestamps and versions, needed to sync across devices.
• Local data on your device (cache and queue of unsent changes).
• Search terms List10 does not recognise, to improve the dictionary. They are stored with the language and a one-way hashed (pseudonymised) identifier, never with your email or account ID in plain text.

3. Voice input

When you tap the microphone, your device or browser's speech recognition is used: Apple or Google speech services in the apps, and the browser's built-in speech recognition on the web. Depending on device and settings, audio may be processed by Apple, Google or your browser vendor under their terms.

List10 only receives the recognised text and uses it to add items. List10 does not store audio recordings. Voice input starts only when you tap the microphone and requires your permission.

4. Why we use data

• Sign-in and account management.
• Syncing lists and settings across your devices.
• Shared lists and invites.
• Keeping your preferences.
• Security, such as preventing abuse of invites and sign-in.
• Troubleshooting and technical operation.
• Improving the dictionary with unknown search terms.

5. Legal basis

• Contract: account, lists, sync and sharing – to provide the service you use.
• Legitimate interests: security, abuse prevention, reliability and dictionary improvement.
• Consent: microphone/speech permission, given in your device's prompt and revocable in device settings.

6. Service providers

We share data only with providers needed to run List10:

• Lovable (Lovable Cloud): hosting of the website, server, database, sign-in and sign-in emails. Processes account, list and settings data and email address.
• Cloudflare: hosting and network infrastructure used by Lovable. Processes technical traffic data such as IP address.
• Google and Apple: if you choose to sign in with them (email and account ID), and their speech services when you use voice input.
• Google AdMob: shows ads in the free version of the apps (see section 13).

7. Transfers outside the EU/EEA

Some providers may process data outside the EU/EEA, for example in the United States. Where this happens, transfers should rely on appropriate GDPR safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, where applicable to the provider.

8. Retention

• Account data is kept while your account exists.
• You can delete lists and items at any time.
• Deleting your account permanently removes account-linked private data.
• Local device data remains until you sign out or delete your account.
• Pseudonymised unknown search terms may be kept separately if they cannot reasonably be linked back to the deleted account.

9. Deleting your account

You can delete your account in List10 under Konto → Ta bort konto (Account → Delete account). This:

• deletes lists you own, with their items, members and invites,
• removes your membership in other people's lists,
• deletes your settings and custom products,
• clears local account data on the device,
• deletes the sign-in account itself.

Deletion cannot be undone

Lists owned by someone else are not deleted. Items you added to another person's list may remain in that list.

10. Shared lists

When you share or join a list, all members can see and edit its content. Anyone with a valid invite link can join until the link expires or is removed.

11. Local storage and offline

List10 stores data locally in the browser or app (localStorage or equivalent) to work offline, load faster and keep unsent changes. Account-linked local data (lists, items, unsent changes, custom products, Min butik and appearance) is cleared from the device when you sign out or delete your account, and a fresh guest state is created.

12. Cookies

List10 does not use advertising or analytics cookies. We use local storage for your sign-in session and app functionality; this is not cookies but serves a similar, necessary purpose.

13. Ads in the free version

The free version of the List10 iOS and Android apps shows an ad banner from Google AdMob. The website and PWA show no ads.

List10 Premium – including Premium via household or complimentary Premium – is ad-free: no ads are shown and no ad requests are sent.

Before ads are shown, you get a consent choice via Google's consent tool (Google UMP) where required, for example in the EU/EEA. You can change your choice at any time in the app under the ad privacy settings.

When ads are shown, Google may process technical data such as IP address, device identifiers, advertising and interaction data, and diagnostics, under Google's own privacy policy. List10 never shares your shopping lists, items or other account content with Google or advertisers.

List10 uses no third-party analytics tools. Technical server logs and error reports may exist for operation and troubleshooting.

14. Security

Data is sent encrypted over HTTPS/TLS. Access to lists is enforced by server-side permission checks so only owners and members can reach a list. No service can guarantee absolute security.

15. Children

List10 is not specifically directed at children. We do not knowingly collect children's data without appropriate consent where required.

16. Your rights

Under the GDPR you have the right to:

• access your data,
• have inaccurate data corrected,
• have data deleted,
• request restriction of processing,
• object to processing based on legitimate interests,
• data portability where applicable,
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

17. Changes

We update this policy when List10 changes, for example when new features or providers are added. The date above shows the latest change.

18. Contact

For privacy questions or to exercise your rights, contact Stråle & Co AB: