Privacy policy
Effective 1 October 2026.
ShopLister is a shopping list app. This policy explains what it stores, what leaves your phone, and what never does.
The short version
You can use ShopLister without an account, and if you do, your shopping never leaves your phone — the one exception being a barcode number when you scan one, described below.
Signing in is optional. It exists so your lists can appear on more than one device and so you can share a list with somebody.
What stays on your phone
All of it, always. Your lists, the items on them, what you have ticked off, your shopping history, the products ShopLister has learned you buy, the stores you shop at and the order it has learned you walk round them, your settings, and any barcodes it has recognised.
This is the working copy. The app is built to keep working with no connection and no account.
What is sent, and only if you sign in
Signing in creates an account, and your email address is stored with it: it is how the account is identified. Once your phone synchronises — which needs ShopLister Plus, or a list shared with you by somebody who has it — the following is stored too, so that your other devices and the people you share a list with can see it:
- your shopping lists and their items, including what has been ticked off and archived;
- your shopping history — which shops you made and what was bought on them;
- the products you use, and the stores and aisle orders ShopLister has learned;
- groups you are in and who else is in them, for shared lists;
- an installation identifier for each device, so changes made on one are not applied twice on another.
Synchronisation is encrypted in transit (TLS). Nothing else about your shopping is stored on our servers.
If you subscribe
ShopLister Plus is sold through the App Store or Google Play. Apple or Google takes the payment; neither we nor RevenueCat, the service that handles subscriptions for us, ever see your card or bank details.
When you sign in, the app tells RevenueCat your account's identifier — a random code, not your email address — so that anything you buy is filed under your account. When you subscribe or restore a subscription, Apple or Google gives RevenueCat the record of the purchase: which plan, when it started, and when it renews or ends. RevenueCat keeps that record, and our servers keep only whether your account has ShopLister Plus and until when.
Nothing about your shopping goes to RevenueCat.
What is sent even without an account
Barcode lookups, and a subscription check. If you scan a barcode, the barcode number is sent to Open Food Facts, a public product database, to get the product's name. The request also says it comes from ShopLister and which version, as any app's does, and if Open Food Facts has a photo of the product your phone downloads it from them. Nothing else accompanies it — not your list, not your history, not your account, not your location. Once a barcode is recognised it is remembered on your phone and looked up no further.
Open Food Facts has its own privacy policy, at world.openfoodfacts.org/privacy.
The subscription check. When the app opens, it asks RevenueCat which subscription options to offer. That request carries a random identifier RevenueCat makes for this installation, and the technical details any app's request carries, such as its version and your phone's platform. It carries nothing about you or your shopping.
Signing in
Three ways, all optional: Sign in with Apple, Sign in with Google, and an email link.
Apple gives us your email address and an identifier Apple uses for you. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us, and that is what your account is identified by. Apple may also offer your name to the app the first time; it is not sent to our servers or kept.
Google gives us your email address, your name, a link to your Google profile picture and an identifier Google uses for you. We use only the email address, to identify your account. The rest is kept with your account record by our sign-in provider, is never shown or used by ShopLister, and is deleted when you close your account. We do not ask Google for access to anything else in your Google account.
Sign-in tokens are stored in the iOS keychain or the Android keystore, not in ordinary app storage.
What we do not do
- We do not send your shopping to advertisers. Not your lists, not your history, not what you buy or when.
- There is no analytics of how you use the app. No analytics library is included in it. The one report we see is RevenueCat's summary of subscriptions: how many people subscribe and renew.
- We do not log your shopping. Diagnostic logging deliberately excludes product names, list contents, access tokens and sign-in links.
- We do not sell your data, and we do not share it with anyone except as described here: the people you choose to share a list with, and the service providers below.
Who processes data for us
- Supabase, which hosts the database and handles sign-in;
- IONOS, which sends sign-in emails and hosts this website;
- RevenueCat, which handles subscriptions;
- Apple and Google, if you choose to sign in with them, and as the stores that sell the subscription and take the payment;
- Open Food Facts, for barcode lookups.
Sharing a list
If you share a list with somebody, they can see that list and everything on it, and anyone else you have added to the same group can too. Your other lists, your shopping history and what ShopLister has learned about how you shop stay private to you.
If you stop sharing, their access ends. What they have already seen cannot be un-seen, and any shopping they did on that list remains part of their history rather than yours.
Deleting your account
You can close your account from inside the app, in Settings. It is permanent and nobody can undo it, including us. If you no longer have the app, email support@shoplister.app from the address you signed in with.
Closing an account deletes everything listed under what is sent above, and withdraws the app's Sign in with Apple authorisation if you used it.
Closing your account does not cancel a subscription. Cancel it with Apple or Google — on an iPhone, in Settings, then your name, then Subscriptions — or you will go on being charged. RevenueCat keeps its record of past purchases, as Apple and Google keep theirs; to have RevenueCat's copy deleted too, email support@shoplister.app.
Your own shopping on your phone is not deleted. It stays, and the app keeps working without an account. Lists other people shared with you are removed from the phone, with the groups, because your access to them ends with the account. If you want the rest gone as well, delete the app.
Keeping it
Your data is kept while your account exists. Close the account and it is deleted; we keep no archival copy afterwards. The exception is RevenueCat's record of past purchases, described above, which it keeps until you ask us to have it deleted.
Your rights
If you are in the UK or the EU you have the right to ask for a copy of your data, to have it corrected, to have it deleted, and to object to how it is handled. Deletion you can do yourself, at any time, from inside the app. For anything else, write to support@shoplister.app.
The data controller is Paul Rodgers, who can be contacted at support@shoplister.app.
You also have the right to complain to the Information Commissioner's Office, at ico.org.uk.
Children
ShopLister is not directed at children and does not knowingly collect anything from them.
Changes
If this policy changes in a way that affects what happens to your data, the change will be described here and the effective date above updated.