Privacy Policy

1. Who we are

Just List (mobile apps and justlistapp.com) is operated by Cluberr ("we", "us"). This policy explains what data we collect, why, who processes it for us, and the choices and rights you have. Contact us any time at friends@justlistapp.com.

2. Data we collect

• Account data — when you sign in with Google or Apple we receive your email address, display name, and profile picture URL from the sign-in provider (via Firebase Authentication).
• Content you create — your lists and items, photos you attach (covers, avatars), and event lists. Lists you share and event links you send are visible to the people you share them with.
• Scanned documents (Papers) — receipts, coupons, warranties, and other papers you scan into a PDF with the app. By default a scan stays on your device only; we learn a document exists only once you share the list it's attached to, choose Keep in cloud, or use auto-file (see "Document scanning (Papers)" below).
• Location — with your permission, the app uses your device's location to power location-based reminders (for example, alerting you when you arrive at a store) and "leave" reminders like Park Here. When you save a reminder location or a place (Home, Work, or a favorite), its coordinates and label are stored on our servers so the reminder survives a reinstall or works across your devices. You can revoke location permission at any time in your device settings, which turns off location-based reminders.
• Credits — your credits balance and how it changed (credits you received or used).
• Device and push data — a push-notification token (Firebase Cloud Messaging) if you enable notifications, and your approximate timezone offset so reminders and nudges arrive at sensible local times.
• Usage analytics — product analytics events (PostHog, EU-hosted; consent-gated on the web) and Firebase Analytics in the mobile apps, plus server logs.
• Measurement of our own ads (web campaign pages) — Meta Pixel and Meta Conversions API events on our campaign pages and their event guest pages, and Meta SDK app events plus the Apple Search Ads attribution token in the mobile apps; see "Ad measurement (Meta)" and "Ad measurement in the mobile apps" under Cookies below.
• Messages you send us — contact-form submissions are stored so we can respond.
• Event guest email (optional) — if you claim an item on someone's event list, you can optionally leave an email address so we can send you the event link and a reminder before the event. This is never required — you can claim items with no account and no email at all. We only store it if you explicitly opt in, and every email we send includes a one-click unsubscribe link.

3. List scanning

When you scan a photo, screenshot, or pasted text to create a list, it is uploaded over an encrypted connection to our servers, read to extract your list items — occasionally a second, more careful read of the same content when the first pass isn't confident about everything it saw — and deleted from our storage — typically within seconds, and in all cases within 24 hours by automatic cleanup. Extraction is performed by Google's Gemini API acting as our data processor; under Google's paid-services API terms, submitted content is not used to improve or train Google's products. We never keep your scanned photos, and nothing is saved to your account unless you review the extracted items and choose to create the list.

4. Document scanning (Papers)

When you scan a receipt, coupon, warranty, or other paper with the app's Papers feature, the scan is turned into a PDF and stored on your device by default — nothing is uploaded. A copy is uploaded to Google Cloud Storage only when you share the list the document is attached to, or choose Keep in cloud. Separately, a temporary copy is uploaded only when you tap File it for me; it is read by Google's Gemini API to suggest a title, date, and amount, and is deleted within 24 hours — the same paid-services terms described above apply, so that content is not used to improve or train Google's products. We never read a document without that tap.

Cloud copies of documents are removed 7 days after the last list that references them is deleted or unshared (90 days after a Plus subscription lapses, for copies beyond the free allowance) — always after at least one warning and a working Download all option to save them first. Deleting your account deletes them immediately.

5. Why we process it (purposes and legal bases)

• To provide and sync the service (your lists, sharing, realtime collaboration) — performance of our contract with you.
• Sharing and events (shared lists, event links, guests claiming items) — performance of contract.
• Notifications you control (reminders, activity on lists and events you share, nudges) — consent, revocable in your device or in-app settings.
• Location-based reminders (arrival/leave alerts, saved places) — consent, revocable via your device's location permission settings.
• Product improvement and safety (analytics, abuse prevention, debugging) — our legitimate interest in running a working, safe product; analytics cookies on the web additionally require your consent.
• Ad measurement (Meta Pixel / Conversions API on our campaign pages) — our legitimate interest in knowing which of our ads work; you can opt out as described under "Ad measurement (Meta)".
• Payments — performance of contract, handled by our payment processors (we never see full card details).

6. Who processes data for us

7. Cookies

The complete inventory of browser storage we use on justlistapp.com:

The cookie banner is your control: choose "Essentials only" and no analytics storage is ever set. You can change your choice any time via "Cookie preferences" in the footer. Strictly-necessary cookies are exempt from consent under ePrivacy rules — without them you cannot stay signed in.

Ad measurement (Meta)

There are no ads in Just List. The tools below only measure how our own ads, shown on other platforms such as Facebook, Instagram and the App Store, perform.

On our campaign pages (justlistapp.com/he/justy and /en/justy) and the guest pages of events made there, we use the Meta Pixel and the Meta Conversions API to measure how our ads on Facebook and Instagram perform. When you open one of these pages, make a list, share its link, or claim an item, your browser and our server tell Meta that this happened, together with your IP address, browser user agent, Meta's _fbp / _fbc cookies and the ad click id (fbclid) if you arrived from an ad, plus the page language, the kind of action and the campaign name. We never send your name, email or phone number, and we never send the items on your list; the page address Meta receives can include a guest-page link, which opens that list for anyone who has it. These pages load the Pixel without a cookie-banner choice; the rest of justlistapp.com does not load it. Meta processes this data as an independent controller under its own Privacy Policy and may link it to your Facebook or Instagram account.

Opting out: in Meta's Accounts Center go to Ad preferences → Ad settings → Activity information from ad partners and turn it off; or use a browser setting or extension that blocks tracking; or email friends@justlistapp.com and we will help.

Ad measurement in the mobile apps (Meta, Apple)

The iOS and Android apps include the Meta SDK (app events only). It tells Meta when the app is installed and opened, and when you make your first list, create an event or share a list, together with basic device details (model, OS version, app version, language) and an app-scoped identifier the SDK creates. The apps do not collect your device's advertising identifier (IDFA / Android advertising ID), do not ask for tracking permission, and never send your name, email, phone number or list items to Meta. Meta uses these events to measure how our ads perform, as an independent controller under its own Privacy Policy.

On iPhone, if you installed the app from an Apple Search Ads ad, the app reads Apple's anonymous attribution token once and our server asks Apple which ad campaign it came from. We store only the campaign, ad group, keyword and country, to know which ads bring people who keep using the app.

8. Retention

Account data and content are kept for as long as your account exists. Backups and server logs are retained for bounded periods and then deleted or anonymized. When you delete your account, associated personal data is removed as described below.

Scanned documents follow the schedule in "Document scanning (Papers)" above: cloud copies are removed 7 days after the list that references them is deleted or unshared, and 90 days after a Plus subscription lapses for documents beyond the free allowance — always after at least one warning and a chance to download them first.

9. Deleting your account

You can delete your account in-app (Settings → Delete My Account). This removes your account, your owned lists, and your sign-in identity — signing in again with the same credential afterward creates a brand-new, empty account. You can also email us at friends@justlistapp.com to request deletion.

10. Your rights

Depending on where you live (including the EU/EEA under GDPR and Israel under the Protection of Privacy Law), you may have the right to access, correct, delete, or receive a portable copy of your personal data, and to object to or restrict certain processing. Contact us to exercise any of these; you also have the right to lodge a complaint with your local supervisory authority.

11. Children

Just List is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has an account, contact us and we will remove it.

12. International transfers

Our analytics are EU-hosted; other processors (listed above) may process data in the US or EU under standard contractual safeguards recognized by applicable law.

13. Security

Data is encrypted in transit; access to production systems is scoped and credentialed. No system is perfectly secure — if we learn of a breach affecting your personal data we will notify you as required by law.

14. Changes

We may update this policy from time to time. For material changes we will give notice (for example in-app or by email) before they take effect. The "Last updated" date at the top reflects the latest revision.

15. Contact

Privacy questions or requests: friends@justlistapp.com