Privacy policy
1. Controller
Antonio Parenti · CodeBits · Egnach, Switzerland
Email: support@getlistification.app
2. Principle: no accounts, no data collection
Listification works without registration and without a user account. Your shopping lists, favourites, photos and settings are stored locally on your device. We operate no servers holding your lists, and in the app we use no third-party analytics, statistics or crash-tracking services. We do not sell data. Advertising is the one area in which data goes to a third party — section 5 explains how, and on what consent it is based. If your device is signed in to iCloud, the app also syncs your lists through your own iCloud so that they reach your other devices; they are then held in your Apple Account, not with us. Sharing a list adds the people you invite — see the next two sections. There is one exception: the optional cloud AI described in section 10, which – for Pro users only, and only once you switch it on – sends individual item names to our server, and for a scanned receipt the lines your device could not match.
If you back up your device with iCloud Backup, the local app data is included in your Apple backup; that process is handled by Apple and governed by your iOS settings.
What you send us yourself through the forms on this website is described in section 12; what the website itself measures, in section 13.
From version 1.4, the app also keeps a record of what you have ticked off: the item, aisle, quantity, time, who ticked it off and on which list — a shopping history, stored in the same way as your lists, on your device and in your iCloud. If you undo the tick on an item, the entry is removed. On a shared list, the history belongs to the list: the people on it receive it as well, and it stays with the list's owner even if someone leaves. The history is included in the data export. Templates are kept only on your own devices and in your iCloud; they are never shared.
From version 1.6, the app also uses this history to suggest what is probably due again, and shows an item's last purchase in its details. Both are worked out on your device; nothing about them is sent to us. Whether suggestions are switched on, and the items you no longer want suggested, are kept in sync with your other devices through your own iCloud (Apple's iCloud key-value storage) – an item only as a code computed from its name (a hash), never the name itself.
3. Shared lists (iCloud)
The app syncs your lists between your own devices through your own iCloud (section 2); as long as you do not share a list, nobody but you can see it. Once you share it, it is synchronised with the people you invited via Apple iCloud (CloudKit). The data is held in the iCloud account of the list's owner. We run no server of our own for this and have no access to the contents.
- Only the people you invite have access — by link or by name. You can end the share again at any time in the app.
- So that the app can show who changed something, it stores the Apple-issued identifier of the iCloud users involved alongside items and lists. The name displayed comes from the share itself (supplied by Apple) and from a small name card that each participant's app writes into the shared list: the name of your Apple Account, or the one you enter in Settings under “Your name on shared lists”. Everyone on the list can see it.
- Processing and storage in iCloud are governed by Apple's privacy policy.
- Lists you do not share are unaffected by any of this.
4. Notifications
Notifications for shared lists are switched on in the app, but nothing is delivered until you have given iOS permission. The app asks for it exactly when you share a list or accept an invitation — never at launch. In the settings you can switch them off again, choose individually what you are notified about, or mute individual lists.
The text of each notification is composed on your device — from your lists and, for a shared list, from data fetched directly from your iCloud when needed. We send no push messages, run no push server, and do not learn whether or when a notification was shown.
So that your device learns of changes at all, Listification uses two Apple mechanisms: the silent background notifications of iCloud sync, which carry no text and are never displayed, and — for shared lists — a visible iCloud notification containing a general sentence without names or content, which an app extension replaces on your device with the actual sentence. Both are sent by Apple, not by us. You can switch notifications off again at any time in the app, mute individual lists, or withdraw permission entirely in the iOS settings. Your notification settings and the lists you have muted are kept in sync with your other devices through your own iCloud (Apple's iCloud key-value storage) — only on/off values, times and list identifiers, never list names or contents.
5. Advertising (free version only)
The free version shows an advertising banner via Google AdMob (Google Ireland Ltd. / Google LLC). The following applies:
- Whether the advertising is personalised is up to you. If you agree in the consent dialogue, personalised advertising is shown; if you decline or do not respond, only non-personalised advertising is shown.
- In addition, iOS asks via App Tracking Transparency for permission to use your device's advertising identifier (IDFA). Without that permission the identifier is not used and the advertising remains non-personalised. You can change this at any time under “Settings ▸ Privacy & Security ▸ Tracking”.
- To deliver the ad and to prevent fraud, Google processes technical data such as the IP address and general device information. Details: Google privacy policy.
- In the EU/EEA and Switzerland, consent is obtained at first launch through Google's consent dialogue (UMP). You can change your choice at any time in the app's settings under “Ad privacy options”, provided your country offers such a choice.
- Listification Pro removes advertising entirely; in that case no advertising-related data processing takes place at all.
6. Purchases (Listification Pro)
Subscriptions and one-off purchases are handled entirely by Apple (App Store / StoreKit). We receive no payment data and no billing addresses – only Apple's anonymous confirmation that a purchase is active. Apple's privacy terms apply.
7. Barcode scanner
When you scan a product barcode, only the barcode number is sent to the Open Food Facts database (world.openfoodfacts.org) to look up the product name and category. No personal data or device identifiers are sent with it (apart from the IP address that every internet request carries, and the app's name in the request header). The camera is also used to photograph an item: the picture stays on your device, and the text in it is likewise read on the device, using Apple's Vision framework. Camera access is optional in both cases. Scanning a receipt is described in section 10.
8. Shops nearby
The “Nearby stores” feature uses your location on the device only to search for grocery shops via Apple Maps (MapKit). The search query is processed by Apple under Apple's privacy terms. We neither receive nor store your location. Sharing your location is optional and can be withdrawn at any time in the iOS settings.
9. Siri and Shortcuts
If you add items using Siri, Apple processes your voice input under Apple's privacy terms. The app receives only the resulting item text and, when Siri asks, the list you name; in order to ask, Siri reads out the names of your lists. On iOS 27, Siri can also tick off, rename and delete items; to do so, the app looks up the item you name on your device.
10. Categorisation and receipts
Automatic aisle assignment starts on the device (a dictionary and – on newer devices – Apple's own on-device AI). No data leaves your device in the process. In the free version, and whenever the switch below is off, that is all that ever happens.
In addition, a cloud AI categorisation is in operation. It is part of Listification Pro, is switched off by default, and becomes active only once you turn it on yourself under “Settings ▸ AI categorization”. It is also only ever used on devices without Apple's own on-device AI: where that is available, only that is consulted and nothing is sent over the network.
When it does run, only the item name you typed is transmitted – one separate request per item to our server api.codebits.ch, which forwards it to the AI provider Anthropic (Claude, USA) for classification. Not transmitted: the name of the list or the fact that the item belongs to it, the other items, quantities, notes and photos, your iCloud identifier, an account, your location or an advertising ID. Every request carries a signature proving that it comes from the app; it is identical in every installation and identifies neither you nor your device. Processing at Anthropic is governed by Anthropic's own terms.
On our server, the pair item name → category is stored so that the same word is never sent to Anthropic twice. This cache is the same for all users, contains no reference to any person or device, and is kept with no fixed deletion date; an individual entry therefore cannot be traced back to you or to a device. If you switch the feature off again, nothing further is sent from that moment on.
From version 1.6, Listification Pro can also read a shopping receipt and add its prices to the items you ticked off. The photo is read on your device with Apple's Vision framework and is not kept, and the lines are matched to your items on the device as well. The prices are then stored like your lists: on your device and in your iCloud. So that it recognises a receipt scanned a second time, the app keeps a short fingerprint of each scanned receipt – the printed date and time, the total, the currency and the amount of each line, plus when and by whom it was scanned – and each purchase notes which receipt it belongs to, and the receipt which of its line amounts went to each purchase. The fingerprint holds no photo and no text from the receipt. Lines you add to Spending yourself with “Add them to Spending” are kept as purchases under the name the receipt prints, like your other purchases. The fingerprint is stored with its list, in the same places, shared only with the people on a shared list, and deleted with the list.
Only if the cloud AI above is switched on, and so is its second switch “Receipts” (under “Settings ▸ Cloud AI”), does the app ask our server about the lines the device could not match – on any device, including those with Apple's on-device AI. It sends only the text of those receipt lines and the names of the items that have not found a line yet, in one request per scan, to api.codebits.ch, which forwards them to Anthropic and returns only which line belongs to which item. Not transmitted: the photo, prices, the total, the date and time, the shop, the name of the list, who did the shopping, your iCloud identifier or any other identifier. Our server keeps nothing of it, neither in a cache nor in a log. Anthropic deletes requests to its service within 30 days under its own terms (later only if its safety systems flag one). If you switched the cloud AI on before version 1.6, the app asks you once, at your first scan, before anything is sent. With “Receipts” switched off, nothing from a receipt leaves your device.
11. Widget
The home screen widget displays local app data and can tick items off. The widget itself sends nothing over the network; a ticked-off item is synced through your iCloud like any other change — and, on a shared list, to the people on it as well.
12. Problem reports and ideas
The form for reporting a problem stores what you write — what happened and the steps to see it — and the area of the app and the device you choose. If you opened the form from the app, the link filled in the app version, the system version, the device model and the app's language; they are in the form, where you can change or delete them before sending — the link itself sends nothing. Your email address is optional and only used to answer you. The form for suggesting an idea stores the title and the text you write.
Please don't paste links or passwords. Before anything is stored, the forms try to remove them, and the thank-you page says how many items were removed. No filter catches everything, though.
Reports are never public — only the developer reads them. An idea is published only after the developer has read it, and then only with a title and a text he writes himself, in English; for an idea in another language with a note “suggested in …”. What you wrote stays private. Votes carry no name or email address, and the board shows only how many an idea has.
To keep bots and floods out, the server counts how many forms and votes arrive from an address in an hour and in a day. For this it stores a keyed hash of the address instead of the address itself (of its first part, for an IPv6 address); the hash is different every day, and the counts are deleted the next day. A vote also keeps a keyed hash of the connection it came from, a different one for each idea, so that an idea counts one vote per connection.
Voting sets one cookie, __Secure-cpvote: a random number that lets this browser remember your votes, for 12 months. It is set only when you vote — the forms set no other, and the visitor statistics set theirs only with your consent (section 13) — and the server stores only a keyed hash of it. If you don't want it, don't vote, or delete it in your browser's settings.
What you send is stored in a database on this website's server in Switzerland (Metanet), outside the website's folders. When something arrives, the developer gets a short email with its reference and topic — never with what you wrote or your email address. It is kept only as long as needed:
- the hash of your address: until the next day; the one stored with a vote: until the idea closes, 12 months at most;
- items the filters set aside as likely spam: 30 days;
- ideas that are not published: 30 days after they were declined, and 12 months at the latest;
- reports: 12 months after they are closed, and 18 months at the latest;
- your email address on a report: 30 days after the report is closed, and 90 days at the latest;
- published ideas: as long as they are on the board; their votes until the idea closes — then only the number is kept.
The cleanup runs every day. The server also keeps a copy of the database from each of the last 7 days, in case it breaks; if one is ever restored, the deletions you asked for are applied again. The thank-you page shows a report's reference (like LI-7K3Q-9XDM): send it to support@getlistification.app to see, correct or delete the report; for an idea, tell us its title. This is processed on the basis of our legitimate interest in fixing problems, improving the app, answering you and keeping the forms free of abuse (Art. 6(1)(f) GDPR); you may object to it at any time.
13. This website and visitor statistics
This website loads its fonts and pictures from its own server. If you pick the light or dark theme, or answer the cookie banner, that choice is kept in your browser's local storage, on your device, and is never sent to us. The pages for reporting a problem and for ideas load nothing from Google.
To see how many people visit, which pages help and — later — whether a campaign of ours brought someone here, the other pages load Google Tag Manager, which runs Google Analytics; both are services of Google Ireland Limited. On your first visit a notice asks whether you allow this; you can change your answer any time here:
If you accept, Google Analytics sets its cookies (_ga and _ga_…, kept for up to two years) to recognise your browser on later visits, and records the pages you open, where you came from (a search, a link, an ad), the time, your browser, device type and screen, and an approximate location that Google derives from your IP address. Google does not store the IP address itself. We see this only as totals and anonymous trends; the data is kept for two months, Google Signals and ad personalisation are off, and nothing is used to show you ads elsewhere. The same answer lets Google tell us whether a visit came from one of our ads, once we run any.
If you decline, or don't answer, no cookie is set and nothing is stored on your device. Google Tag Manager still loads and sends Google brief signals without cookies or identifiers (that a page was opened, roughly when, and which browser), which Google uses to estimate the number of visits; like every request, they reach Google with your IP address.
Google may process this data in the United States; Google is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. More in the Google Privacy Policy.
Like every web server, the server of this website (Metanet, Switzerland) logs each request: the IP address, the time, the page requested and the browser's self-description. The log is used only to run the server and keep it secure, and the host deletes it automatically through its log rotation.
14. Your rights
Under the Swiss Data Protection Act (revDSG) and – where applicable – the GDPR, you have, among other things, the right to information, rectification and erasure. Deleting the app removes the data on the device. If your device is signed in to iCloud, the copy in your own iCloud is not affected by this; you remove it in the iOS Settings under your Apple Account → “iCloud”, where app data stored in iCloud can be deleted. For any questions, simply email support@getlistification.app.
Where the GDPR applies, this website's visitor statistics rest on your consent (Art. 6(1)(a)), which you can withdraw any time under “Your current setting” above; only the cookieless signals sent before or without your consent rest on our legitimate interest in knowing roughly how many people visit (Art. 6(1)(f)).
15. Children
The app is intended for a general audience. We do not knowingly collect data from children; the app itself generally collects no personal data.
16. Changes
If features change, we will update this policy and the date above. The current version is always available at this address.