Skip to content
Listl

Privacy Policy

Last updated: 12 November 2026

In short

  • Listl works without an account. Then your lists stay on your iPhone and your Apple Watch.
  • You choose where your own lists live: only on this device, in your iCloud or on Listl's server in Frankfurt am Main, Germany. In iCloud and on the server they are end-to-end encrypted – only your devices can read them.
  • Households, shared lists and guests always go through Listl's server, also end-to-end encrypted. The server knows who belongs to a household and when something changes – not what is on your lists.
  • Listl reads receipts, handwritten lists and recipes on your iPhone. Where Apple Intelligence is available, it helps – also only on the device.
  • No ads, no tracking, no selling of your data. Anonymous crash reports and usage figures go to Atriya, our own service – never with your content, and you can turn them off at any time.
  • This website sets no cookies, doesn't count visits and loads nothing from other servers.

Controller

The controller under the General Data Protection Regulation (GDPR) for the Listl app and its website (listl-hq.github.io) is:

Luca Efinger
Friedrich-Ebert-Ring 16
97072 Würzburg
Germany
Email: contact@lacodea.com

The Listl app

On your device

Listl is built to work without an account and without a server. What you enter – lists and items, stores with their routes, templates, categories, folders, recipes, purchases with receipts, photos and customer cards – Listl keeps in a database on your iPhone. Widgets, Siri, Shortcuts and the share extension use the same database on the device. Your Apple Watch gets what it shows directly from your iPhone; it has no account and no database of its own.

So that Listl can make good suggestions while you type, it remembers what you add and check off – with the day of the purchase, so that “Listl thinks ahead” can suggest what's probably running low. Listl also works out the list total, your budget and “Probably still at home” on the device, from your purchases. You can see what Listl remembers and make it forget under Settings › Listl Thinks Ahead › By Item.

The names of your lists and open items are also in your iPhone's search index, so you can find them in iOS search. This index stays on the device.

Deleted lists and items stay in the trash for 30 days. Everything else Listl keeps until you delete it.

Where your own lists live

Under Settings › Data and Sync you choose where your own lists live:

  • Only on this device: None of it leaves your iPhone.
  • In your iCloud: Listl syncs your lists between your Apple devices with Apple's CloudKit – in the private database of your iCloud account. You don't need an account with us for this. Before anything leaves your device, Listl encrypts it itself (AES-256-GCM). Your iCloud Keychain brings the key to your other devices; in the database in your iCloud it is only stored sealed with your recovery key. Neither Apple nor we can read your lists there. Apple's privacy policy also applies to iCloud. When you switch where your lists live, your other Apple devices learn about it through iCloud's key-value storage.
  • On Listl's server: With your LaCodea ID, Listl syncs your lists through our server. Here, too, Listl encrypts everything on your device before it goes up (see “Listl's server”).

Before your lists move to another place, Listl makes an encrypted safety copy on this device.

Households, shared lists and guests

When you share lists with others – as a household with all its lists or as a single shared list – they always go through Listl's server, even if your own lists live only on the device or in iCloud. Every household has a key of its own that only its members have; the server only receives it sealed, for each member separately.

The members of a household see its lists, items, recipes, folders, photos, purchases and receipts, who added something, your name and – if you set one – your profile photo. When you let the others know you're shopping (“Anything else?”), they see that and where you're shopping. What Listl learns in a household about the rhythm of your purchases from checking things off is kept there as well. Your stores with their routes, your customer cards and your favorites stay personal.

You invite people with a link or QR code. The invitation's code comes after the “#” and never reaches our server; the server only knows a hash of it. Anyone who has the link can join while the invitation is valid – so share it only with the people you want to invite. An invitation is valid for seven days and only once, can be withdrawn and is deleted once it's accepted or has expired.

Anyone who accepts an invitation without a LaCodea ID joins as a guest. For this, Listl creates an anonymous guest account on our server – without an email address and without any name other than the one you show the others. The guest's sign-in is kept only in the keychain of this iPhone, and a guest's own lists stay on their iPhone. We delete guest accounts that haven't been used for twelve months, with everything that belongs to them. If a guest signs in with a LaCodea ID, the guest account is connected to it (“Secure Your Account”).

Listl's server

Our server is operated on our behalf by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, in a data center in Frankfurt am Main, Germany. We have a data processing agreement with Supabase (Art. 28 GDPR). As Supabase is based in Singapore and uses sub-processors in the USA, among other countries, access from these countries cannot be ruled out; the EU Standard Contractual Clauses apply to this (Art. 46(2)(c) GDPR).

Whatever Listl uploads to the server, your device encrypts and signs first – with AES-256-GCM and a key of its own for your lists and for each household, sealed for each member with HPKE. The server can only read what it needs for syncing, permissions and limits:

  • your account ID and your public keys; your data key only sealed with your recovery key, which only you know
  • which spaces exist – your own lists, your households and shared lists –, who has which role in them (owner, admin, member, guest), how many people fit in and how much room there is for photos and receipts; the owner's iPhone sets these two limits according to their subscription, and the server checks them
  • your Listl Pro or Listl Max subscription, when the app shows it (see “Purchases”)
  • for each encrypted record: its type (content, settings or check-off), who wrote it and when, a sequence number, its size and whether it's deleted
  • the encrypted member log of each household
  • open invitations: a hash of the code, the encrypted invitation package, the role and when it expires
  • for notifications, your iPhone's push address and which notifications you've muted (see “Notifications”)
  • counters that limit abuse – only for the current hour or day

The server cannot read the names of your lists, your items, amounts, notes, stores, recipes, prices, receipts, photos or customer cards, your name or your profile photo.

With every connection, the server necessarily processes your device's IP address. Supabase logs requests for operation and security (including the IP address, the time and the function called) and deletes these logs after seven days.

The legal basis is Art. 6(1)(b) GDPR: we provide the syncing and sharing you use. For logs and counters against abuse, Art. 6(1)(f) GDPR applies; our legitimate interest is secure operation. We keep what's on the server until you delete it or your account ends (see “Deleting”).

LaCodea ID

To sync through our server and to share, you sign in with the LaCodea ID – the account for all of LaCodea's apps, for example with Apple, with a code by email or with a passkey. What the LaCodea ID stores for this, such as your email address and your sign-in methods, is described in LaCodea's privacy policy. With every request, Listl's server receives a sign-in token from the LaCodea ID and only keeps your account ID from it – no email address and no name.

Listl puts your data key and your recovery key in your iCloud Keychain so your other devices can open your lists. They stay there when you sign out.

Notifications

Listl sends notifications when you share with others – for example when someone goes shopping (“Anything else?”) or when something is added while you shop. The sending iPhone seals what a notification says end to end; only your iPhone opens it. Our server only learns who it's from and who it goes to – everyone in a household or one person in it. Notifications are delivered through the Apple Push Notification service; Apple only receives the sealed content and the general text “Something new in Listl.”.

For this, our server stores your iPhone's push address with your account, a hash of a random identifier of this installation and the time it last checked in – at most ten devices per person. We delete addresses that haven't checked in for 60 days or that Apple declares invalid. The server also stores which notifications you mute under Settings › Notifications, so that it doesn't send them to you. The legal basis is Art. 6(1)(b) GDPR.

Permissions

Listl only asks for access when you use a feature that needs it. You can take back any access in the iOS Settings.

  • Camera: to photograph a handwritten shopping list (Listl reads it on the iPhone and doesn't keep the photo), to take a photo of an item, to scan a receipt or to add a customer card.
  • Photos: you choose photos and receipts with the iOS photo picker – Listl only sees what you pick. To save a receipt to your photo library, Listl asks whether it may add photos; that doesn't let it see your library.
  • Location: while you shop, Listl recognizes which of your branches you're in and finds branches nearby with Apple Maps. Listl doesn't save your location – only where your stores are, and with a purchase the store. If you turn on the reminder for arriving at a store, Listl sets up notifications for your branches that iOS shows when you arrive; iOS checks the location, and Listl doesn't learn where you are. For this, location while using the app is enough.
  • Location “Always”, only if you turn it on: with “Recognize Automatically” (Settings › Notifications), Listl watches the places of your stores itself, even when the app isn't open. iOS then tells Listl when you arrive at one of your stores or leave it: when you arrive, Listl shows the reminder with your lists as they are; when you leave, the Live Activity ends, and if something is in your cart, Listl asks whether you're done shopping. To cover all your stores, Listl also checks roughly where you are when you move to another area. Listl doesn't save your location; it only remembers on your iPhone, for a few hours, which of your stores you're at. None of this leaves your device. You can turn it off any time in Listl or in iOS Settings.
  • Reminders: only if you want to bring lists over from Apple Reminders. Listl then reads the open items of the lists you choose and changes nothing there.
  • Notifications: see above.
  • Face ID: for the app lock. iOS checks your face or your device passcode; Listl only learns whether the check succeeded. If you set a code of your own, Listl doesn't store it – only a hash of it, in this device's keychain.

Receipts, handwritten lists and recipes

  • Receipts: Listl reads paper and electronic receipts on your iPhone – as a photo, scan or PDF, shared, through a shortcut such as the Mail automation, or as a file, for example e-receipts and order lists from retailers: the writing with iOS text recognition, PDFs through their text, plus the QR code some registers print on the receipt. Listl skips addresses and payment details in order lists. On iPhones with Apple Intelligence, the language model on the device helps where Listl can't get any further on its own; more in the AI notice. A photo is stored scaled down in grayscale, a PDF as a PDF.
  • Handwritten lists: if you photograph a shopping list, Listl reads the writing on the iPhone; the photo isn't kept.
  • Recipes from websites: if you enter the address of a recipe or share a page to Listl, Listl loads only this page, directly from your iPhone – without cookies or sign-ins from your browser – and reads the recipe details the page provides for search engines. As with any visit, the website learns your IP address. If you share from Safari, Listl reads the details from the open page.

Apple Maps

To find branches and show stores or purchases on a map, Listl uses Apple Maps. Apple receives the search terms, such as the name of a chain or an address, and the area searched in; Apple's privacy policy applies. Listl only looks up where a store from a purchase is when you want to see it on the map.

Siri, widgets, Apple Watch and app lock

When you use Siri, Apple processes your request; Listl only receives the recognized action, such as the item and the list. Widgets, controls, the Live Activity and the share extension work with the data on your iPhone, and the Apple Watch with what your iPhone sends it.

When the app lock is on, widgets, Siri, Shortcuts, iOS search and notifications show no content from Listl. The Live Activity of a shopping trip in progress on the Lock Screen and the Apple Watch stay usable.

Backups

Under Settings › Backup you set up backups – in your iCloud Drive, in a folder of the Files app (for example with a cloud provider), on your own server via WebDAV or only on this device. These providers' privacy policies apply; your backups never reach us. If you set a password, Listl encrypts every backup on your device (AES-GCM, with the key derived using PBKDF2); without the password nobody can open it, not even us. Without a password, anyone with access to the place can read it. Credentials for WebDAV are kept in your device's keychain.

Crash reports and usage statistics

So that we can find bugs quickly and know which features are used, Listl sends anonymous crash reports and usage statistics to Atriya, our own analytics service. It sends the crash and hang reports iOS gives the app through MetricKit – with the place in the code, the app and system version and the device model –, when the app is opened and how long it's in the foreground, and which screens are viewed. The Apple Watch only sends which screens are viewed there and how long Listl is open there. Your lists, items, recipes, purchases, photos and names are never sent.

Listl stores nothing on your device for this, not even an identifier. Sending necessarily transmits your IP address. Our server only derives the country from it and, together with the device model and the system identifier (user agent), forms an identifier that is only valid for one day: a hash with a random daily key, which the server deletes after two days at the latest. We don't store the IP address itself. This way we see how many devices use Listl on a day – we can't recognize you or follow you across days.

The legal basis is our legitimate interest in a stable app and in knowing which features are used (Art. 6(1)(f) GDPR). You can object at any time: turn off the usage statistics under Settings › Privacy; Listl then sends nothing more, not from the Apple Watch either.

We run Atriya ourselves. The server is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data center in the European Union; IONOS processes the data on our behalf. We only evaluate it in aggregate and don't pass it on. Once the daily key is deleted, the data is anonymous; we keep it without a fixed time limit.

Independently of this, Apple provides us with crash reports and statistics that don't identify you, if you have allowed sharing analytics with app developers (iOS Settings › Privacy & Security › Analytics & Improvements).

Purchases

You buy Listl Pro and Listl Max through the App Store. Apple handles payment and subscriptions; we receive no payment details.

When you're signed in with your LaCodea ID, the app shows our server the receipts of your current subscription, signed by Apple, so that it can check the limits of your households and shared lists – how many people fit in and how much room there is for photos and receipts. The server checks Apple's signature and stores with your account: the ID of the purchase at Apple, which subscription it is, when it was bought or last renewed, until when it applies, whether it was refunded, whether it comes through Family Sharing and whether it is a test purchase. Apple also tells our server about renewals, changes and refunds of this purchase (App Store Server Notifications); these messages only name the purchase ID, not you. The legal basis is Art. 6(1)(b) GDPR. We delete this information together with your data on the server or your account.

Apple also gives us sales reports without personal data.

Deleting

When you delete your data on the server, our server removes everything belonging to your account: your own lists, your sealed key, your public keys, your invitations, your devices' push addresses, your notification settings and the details of your subscription. You leave households and shared lists in the process; they remain for the others, including what you contributed there. If you own a household, it passes to the admin who has been in it longest, otherwise to the member who has been in it longest; if only guests are left, it is deleted. This is how you delete:

  • Everything at once: under Settings › Privacy › Delete All Data, Listl removes your data on the server (as long as you're signed in), in iCloud (if your lists live there) and on this iPhone, including the search index and delivered notifications. Backups stay where you put them; delete them there.
  • Only on the server: under Settings › Account › Advanced › Delete Data on Server. Your lists stay on this iPhone.
  • With your account: if you disconnect Listl from your LaCodea ID or delete your LaCodea ID (under Settings › Account or at account.lacodea.com), our server also deletes everything belonging to your account.
  • As a guest: in Settings under Account (“Delete My Data”).
  • Deleting the app removes its data from this device. What's in iCloud or on the server stays until you delete it there.

This website

Hosting and delivery

The website is at listl-hq.github.io, where it is delivered by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (GitHub Pages). When you open a page, GitHub necessarily receives technical data – in particular your IP address, the page requested, the time and your browser's identifier (user agent) – and stores your IP address in log files to protect against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). GitHub is certified under the EU-U.S. Data Privacy Framework. More: GitHub Privacy Statement

No cookies, no statistics, no third parties

This website sets no cookies, stores nothing in your browser and doesn't count visits. It shows no ads, uses no social media plugins and loads no fonts or scripts from other servers. Links to the App Store lead to Apple; Apple's privacy policy applies there.

If you open an invitation link (listl-hq.github.io/i/#…) in a browser, the invitation and its code come after the “#” – your browser sends them neither to GitHub nor to our server. The page only shows you how to open the invitation in Listl.

Email

When you write to us, we use your email address and your message to reply (Art. 6(1)(b) and (f) GDPR). Our email runs through IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; we add requests to LaCodea's ticket system as described in LaCodea's privacy policy. We delete messages once they're no longer needed, unless we are legally required to keep them.

Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16) and erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, just write to us. Because your content is end-to-end encrypted, we can't see it or hand it over ourselves – in the app you can view it, back it up and delete it yourself at any time.

You also have the right to lodge a complaint with a data protection supervisory authority – for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Changes

We update this privacy policy when the app, the website or the law change. The date at the top shows the version in force.