Listry logoLISTRY

Privacy Policy

Last updated: August 7, 2026

This Privacy Policy explains how Listry ("we", "us", "our") collects, uses, and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller responsible for your personal data is:

  • Listry
  • listry.me
  • contact@listry.me
  • privacy@listry.me

2. Data We Collect

Account Data

  • Email address
  • Display name
  • Password (stored as a secure hash, never in plain text)
  • Profile image, if you upload one

User Content

  • Lists and list items you create
  • Item details (names, descriptions, prices, URLs, images)
  • Collaboration data (shared list memberships, invitation records)
  • Reviews you write (rating, notes and any photos you attach)
  • Details of places you save (address, coordinates and map links)

Location Data

  • Approximate device location, only if you use the nearby-lists search and grant permission. That feature is not available in every version of the app
  • We never access your location in the background and we do not keep a history of your movements
  • The coordinates of the places you save to your lists do not come from your device: they are derived from the address you pick, which OpenStreetMap (Nominatim) turns into coordinates

Technical Data

  • IP address
  • Device type and browser information
  • Push notification tokens (if you enable notifications)

Diagnostic Data

  • Crash reports and error traces
  • Device model, operating system version and app version
  • Collected through Sentry to find and fix failures. It is not used to track you or to build an advertising profile

3. Purposes & Legal Basis

Contract Performance (Art. 6(1)(b) GDPR)

  • Creating and managing your account
  • Providing list creation, editing, and sharing features
  • Processing collaboration invitations
  • Sending transactional emails (e.g., password resets, invitation notifications)

Legitimate Interest (Art. 6(1)(f) GDPR)

  • Maintaining security logs to protect against unauthorized access
  • Analyzing aggregated usage patterns to improve the service
  • Collecting crash and error reports to diagnose and fix failures

Consent (Art. 6(1)(a) GDPR)

  • Sending push notifications (you can opt out at any time via your device settings)
  • Using your approximate location to show nearby public lists (you can revoke the permission at any time in your device settings)

4. Data Recipients

We may share your data with the following categories of recipients:

  • Neon — database hosting, in the European Union
  • Render — application hosting, in the European Union
  • Cloudflare R2 — storage for the images you upload, in Western Europe
  • Resend — delivery of transactional email, such as password resets
  • Sentry — crash and error reporting
  • Expo — delivery of push notifications to your device
  • OpenStreetMap (Nominatim) — turning coordinates into place names, only when you use location features
  • ScraperAPI and Browserless — reading public page details when you paste a product or place link
  • Google and Apple — only if you choose to sign in with one of those accounts

Each of these providers processes data on our behalf under agreements that require protection equivalent to the one described in this policy.

We do not sell your personal data to third parties.

5. Data Retention

Your personal data is retained for as long as your account is active. If you request account deletion, all your data — including lists, items, memberships, and invitations — will be permanently deleted within 30 days.

6. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access — obtain a copy of your personal data
  • Right to rectification — correct inaccurate or incomplete data
  • Right to erasure — request deletion of your data
  • Right to restriction — limit how we process your data
  • Right to data portability — receive your data in a structured, machine-readable format
  • Right to object — object to processing based on legitimate interests
  • Right to withdraw consent — withdraw consent at any time (e.g., for push notifications)
  • Right to lodge a complaint — file a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@listry.me. We will respond within 30 days.

7. Cookies

Listry uses only strictly necessary cookies, for keeping you signed in. We do not use advertising or cross-site tracking cookies and we do not build advertising profiles. The only automated collection beyond that is the crash and error reporting described above.

8. Age Requirement

Listry is intended for users aged 14 and over, the age of digital consent under Spanish law. We do not knowingly collect personal data from children under 14. If you believe a child under 14 has provided us with personal data, contact us at privacy@listry.me so we can delete it.

9. Account Deletion

You can delete your account at any time from your profile settings. Deleting your account permanently removes your personal data, your reviews and the lists nobody else belongs to. A list you share with other people is not destroyed: its ownership passes to the member who joined it first, so their work is not lost with your account. Deletion is immediate and cannot be undone.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.