Privacy policy

The short version

You don't have to give us any personal data to use the app: you can create and share lists with no email, no name and no password.

If you choose to create an account, we store your email address to identify you. That's it.

We don't sell data, we don't build advertising profiles, and we don't use tracking cookies.

You can delete your account and everything attached to it from inside the app, yourself, without emailing anyone.

Who is responsible

ListaSupermercado is a personal project by Antonio. There is no company behind it: one person maintains it.

For anything related to your data — access, correction, deletion, portability or objection — get in touch on LinkedIn, at linkedin.com/in/farmaiant. Everything gets answered.

Who is behind this app and why it exists is explained on the About page.

What we process and why

Only what the app needs to work:

• Guest identifier: created when you make your first list. It's a random identifier with none of your details in it, and it exists so your lists are yours and nobody else can edit them. Legal basis: performance of the service you requested.
• Email address: only if you create an account. Used to identify you and to send the sign-in or password-reset link. Legal basis: performance of contract.
• Password: only if you choose that method. We don't store it: it's hashed irreversibly, and nobody — including us — can read it.
• Display name: optional. If you set one, people who share a list with you will see it, so they know who added or checked each item.
• Your list content: the items, quantities and notes you write. They're yours, and only people with the link you shared can see them.
• Aggregate technical data: page visits and performance, with no cookies and no identification. Only if you said yes — see the next section.

What gets stored on your device

Almost nothing, and almost all of it essential. This is the complete list:

• Your session: a cookie that is, literally, your account. Without it no list is yours.
• Your language: so the site shows up in the language you were reading it in.
• Your lists, in a database inside the browser: it's what keeps the list working inside the shop when there's no signal, and syncs what you tick when you come out.
• A visit counter: used to offer installing the app on your second visit, and to stop asking if you say no. It never leaves your phone.

Why only one thing is put to you

None of those four identify you to anyone else or serve advertising, and all four are needed to give you the service you asked for. That's why they aren't put to a vote: the law doesn't require consent for what's strictly necessary, and asking anyway only trains people to click «accept» without reading.

The one thing we do ask about is site measurement, which is why there's a notice on your first visit. It uses no cookies and stores nothing on your device, but it can genuinely be turned off: say no and its scripts never load and not a single data point is sent.

You can change your mind whenever you like from the «Site measurement» link at the bottom of any page. Withdrawing costs exactly what giving it costs: one click.

Who we share it with

Nobody, commercially. Only the providers the service needs to exist, acting as processors on our instructions:

• Supabase: database and authentication. Stores your lists, and your email if you have an account.
• Vercel: web hosting and aggregate usage and performance metrics, with no cookies and no individual identification.

How long we keep it

Your lists and account are kept while you keep using them. If you delete your account, they're removed immediately, along with the lists you own.

Lists made without an account have a deadline: the next day they are wrapped up — archived, not deleted — and if a week goes by without anyone opening them or adding to them, they are deleted along with their items. You are warned in the list itself before it happens, and creating an account, opening the list again, or having someone with an account in it removes the deadline.

Guest identities with no lists attached are purged periodically — they serve no purpose and still take up space.

Your rights

You can access, correct, delete and port your data, and object to or restrict its processing. For the common cases you don't even need to write to us:

• Access and correction: from your account and your lists, any time.
• Deletion: there's a delete-account button on your account page. Immediate and permanent.
• Portability: from your account you can download your data, your lists and your product history as a JSON file.
• For anything else, reach out on LinkedIn (linkedin.com/in/farmaiant).

Complaints

If you think we're mishandling your data, tell us first — that usually settles it. You also have the right to complain to your national data protection authority; in Spain that's the Agencia Española de Protección de Datos (aepd.es).

Changes to this policy

If something material changes we'll update this page and its revision date. If the change genuinely affects you and you have an account, we'll email you rather than wait for you to notice.