Privacy Policy
Last updated: 2026-07-09
This document is provided in English; the English version governs.
1. Who we are
Just List (mobile apps and justlistapp.com) is operated by Cluberr ("we", "us"). This policy explains what data we collect, why, who processes it for us, and the choices and rights you have. Contact us any time at friends@justlistapp.com.
2. Data we collect
- Account data — when you sign in with Google or Apple we receive your email address, display name, and profile picture URL from the sign-in provider (via Firebase Authentication).
- Content you create — your lists and items, photos you attach (covers, avatars), takes, suggestions, and event lists. Public lists you publish to the Feed are visible to everyone.
- Social activity — follows, hearts, clones, reactions, and takes, used to power the social features and your For-You feed.
- Gamification state — XP, level, coins, badges, streaks, and cosmetic items you own or equip.
- Device and push data — a push-notification token (Firebase Cloud Messaging) if you enable notifications, and your approximate timezone offset so reminders and nudges arrive at sensible local times.
- Usage analytics — product analytics events (PostHog, EU-hosted; consent-gated on the web) and Firebase Analytics in the mobile apps, plus server logs.
- Messages you send us — contact-form submissions are stored so we can respond.
- Event guest email (optional) — if you claim an item on someone's event list, you can optionally leave an email address so we can send you the event link and a reminder before the event. This is never required — you can claim items with no account and no email at all. We only store it if you explicitly opt in, and every email we send includes a one-click unsubscribe link.
3. Why we process it (purposes and legal bases)
- To provide and sync the service (your lists, sharing, realtime collaboration) — performance of our contract with you.
- Social features (the Feed, follows, parties) — performance of contract.
- Notifications you control (reminders, social notifications, nudges) — consent, revocable in your device or in-app settings.
- Product improvement and safety (analytics, abuse prevention, debugging) — our legitimate interest in running a working, safe product; analytics cookies on the web additionally require your consent.
- Payments — performance of contract, handled by our payment processors (we never see full card details).
4. Who processes data for us
| Processor | What it does |
|---|---|
| Google Firebase | Sign-in (authentication), push notifications, mobile app analytics |
| Google Cloud | Database and media storage (covers, avatars) |
| Render | Server hosting |
| Pusher | Realtime list sync (transport only) |
| Paddle | Web payments — merchant of record; we never see full card data |
| Apple / Google | Mobile subscription billing (managed in your store account) |
| Google AdMob | Ads shown in the free mobile app, with its own consent management flow |
| PostHog | Product analytics, hosted in the EU; consent-gated on the web |
| Resend | Delivery of transactional emails you've opted into (event links, event reminders) — never marketing or bulk email |
| Cloudflare | CDN / reverse proxy that protects and accelerates traffic to justlistapp.com |
5. Cookies
The complete inventory of browser storage we use on justlistapp.com:
| Name | Purpose | Type |
|---|---|---|
| session | Keeps you signed in | Strictly necessary |
| loggedIn | Remembers UI state for signed-in visitors | Strictly necessary |
| PostHog analytics storage | Product analytics (event tracking) | Consent-gated — only set if you choose "Accept all" |
The cookie banner is your control: choose "Essentials only" and no analytics storage is ever set. You can change your choice any time via "Cookie preferences" in the footer. Strictly-necessary cookies are exempt from consent under ePrivacy rules — without them you cannot stay signed in.
6. Retention
Account data and content are kept for as long as your account exists. Backups and server logs are retained for bounded periods and then deleted or anonymized. When you delete your account, associated personal data is removed as described below.
7. Deleting your account
You can delete your account in-app (Settings → Delete My Account). This removes your account, your owned lists, and your sign-in identity — signing in again with the same credential afterward creates a brand-new, empty account. You can also email us at friends@justlistapp.com to request deletion.
8. Your rights
Depending on where you live (including the EU/EEA under GDPR and Israel under the Protection of Privacy Law), you may have the right to access, correct, delete, or receive a portable copy of your personal data, and to object to or restrict certain processing. Contact us to exercise any of these; you also have the right to lodge a complaint with your local supervisory authority.
9. Children
Just List is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has an account, contact us and we will remove it.
10. International transfers
Our analytics are EU-hosted; other processors (listed above) may process data in the US or EU under standard contractual safeguards recognized by applicable law.
11. Security
Data is encrypted in transit; access to production systems is scoped and credentialed. No system is perfectly secure — if we learn of a breach affecting your personal data we will notify you as required by law.
12. Changes
We may update this policy from time to time. For material changes we will give notice (for example in-app or by email) before they take effect. The "Last updated" date at the top reflects the latest revision.
13. Contact
Privacy questions or requests: friends@justlistapp.com