Privacy policy

Last updated: 30 October 2026

In short. We only process the data needed to make the list work: your account and what you write in your lists. Only the people you choose to share them with can see them. We don't sell your data. The app shows a Google AdMob banner: personalised ads only if you consent. The servers are in the European Union.

1. Data controller

Email: support@listaspesafacile.com

2. What data we process

Account

name, email address and password (stored only in encrypted, non-reversible form);
app language, to send you notifications and emails in your language;
profile photo, if you choose to upload one;
the date and time you accepted this policy and the terms of use and, if you gave it, your consent to the newsletter.

Sign-in with Google or Amazon

If you sign in with one of these services we receive from them your name, your email and an account identifier. We don't receive your password and we don't access any other data in your account.

List content

list names, items, quantities, aisles, reminders and the photos you attach;
messages and photos in each list's chat, with the time they were received;
who you share lists with and with which permissions;
the prices you note down for products ("My prices"): only you can see them.

Device and notifications

an access token for each phone you use the app on, with the model name, to keep you signed in;
the token Firebase Cloud Messaging assigns to your phone, to send you notifications;
the notifications we sent you, until you delete them.

Technical data

Like any online service, the servers log the IP address, date and time and requested address of every access. This is used to protect the service from abuse and to fix faults.

Voice dictation

When you dictate an item, speech recognition is done by the Google service installed on your phone. We only receive the recognised text, never the audio.

If you tick the newsletter box when signing up, we use your name, email and language to send you, from time to time, emails about what's new in Lista Spesa Facile. Consent is optional: without it the app works just the same. We record the date and time you gave it.

Advertising

At the bottom of the “My lists” screen the app shows a Google AdMob advertising banner. To choose ads and measure their results, the AdMob library included in the app collects directly from your phone the advertising ID, the IP address (from which an approximate location is derived), the device model and system, interactions with ads and diagnostic data. AdMob receives nothing you write in your lists or in the chat, nor your name or email.

On first launch, in the European Economic Area, the United Kingdom and Switzerland, we ask for your consent with Google's form: you can accept, refuse or choose individual options. If you refuse you may still see ads, but not personalised ones. You can change your choice at any time from the profile menu → “Ad privacy”, and reset or delete the advertising ID in the Android settings.

3. Why we process it

To provide the service you asked for by registering: account, lists, sharing, chat, reminders, notifications, password recovery (art. 6.1.b GDPR).
To send you the newsletter, only if you asked for it when signing up (consent, art. 6.1.a GDPR). You can withdraw your consent at any time by writing to support@listaspesafacile.com: we stop sending it right away. Withdrawal does not affect the lawfulness of emails already sent.
To show you advertising, which keeps the app free: personalised ads only with your consent (art. 6.1.a GDPR), which you can withdraw from the profile menu → “Ad privacy”; non-personalised ads and the prevention of advertising fraud are based on legitimate interest (art. 6.1.f GDPR).
To remind you about your shopping if you haven't used the app for more than a week: a single notification ("Need to go shopping?"), based on the date you last used the app, with no advertising (legitimate interest, art. 6.1.f GDPR). You can turn it off from the profile menu → "Reminder if I don't use the app" or from your phone's notification settings ("Reminders" category).
For the security of the service: limiting sign-in attempts, blocking abuse, fixing faults (legitimate interest, art. 6.1.f GDPR).

We don't sell your data to anyone and we don't use the content of your lists and chat, nor your name or email, for advertising.

4. Where it is and who sees it

The data is stored on servers in the European Union, with netcup GmbH (Germany), which acts as our data processor.

A list's content is only seen by its creator and the people it is shared with. Your name, email and profile photo are seen by the people you share a list with.

Some external services only receive what they need for their job:

Firebase Cloud Messaging (Google): delivers notifications to your phone. It receives the device token and the notification text. Google may process this data in the United States, under the EU-US Data Privacy Framework.
Google AdMob (Google Ireland Ltd.): shows the advertising banner. It receives the data described under “Advertising” directly from your phone and processes it according to Google's policy on the use of data from partner apps. Google may also process it in the United States, under the EU-US Data Privacy Framework.
Google, Amazon: only if you use them to sign in, according to their privacy policies.
The email service provider: delivers the password recovery codes.
Open Food Facts: branded product suggestions, their photos and information (ingredients, allergens, nutrition facts) are requested by our server, sending only the product name or barcode, never data about you.

5. How long

Account and list data are kept as long as you have the account. You can delete it at any time from the Delete account page: the data is erased immediately (within 30 days if you ask by email).
Your newsletter consent and the data used to send it are kept until you withdraw it or delete your account.
A deleted list disappears immediately for everyone, with its items, photos and messages.
Password recovery codes expire after 30 minutes.
Technical access data is kept as long as needed for security, normally no more than 30 days.

6. Your rights

You can ask at any time to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format, or object to its processing. Write to support@listaspesafacile.com: we reply within 30 days.

If you believe your data is not processed lawfully you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of your country.

7. This website

The listaspesafacile.com website uses no cookies, has no visit counters and loads nothing from other domains: no third-party fonts, scripts or images. The language of the page is chosen from your browser settings or from the link you click.

8. Minors

The service is not intended for people under 14.

9. Changes

If this policy changes significantly we'll tell you in the app. The date at the top shows the latest version. In case of doubt, the Italian version prevails.