Privacy Notice
Your data stays yours
HomLyst is built to need as little of your data as possible. You can use every core feature — building, organizing, and managing your shopping list — without ever creating an account.
1. What we collect, and why
| Data | Why we collect it | Where it's stored |
|---|---|---|
| Shopping list content (categories, items, quantities) | The core feature of the app | On your device only, unless you use a sharing feature |
| Display name (optional, you type it in) | Shown to people you share a list with | Our server, only if you use a sharing feature |
| Phone number (optional, you type it in) | Lets another HomLyst user send you a list by typing your number | Our server — never in readable form (see below) |
| Push notification token | Delivers “someone shared a list with you” notifications | Our server, and Google/Apple's push infrastructure |
| Device identifier (random, generated on install) | Lets the server recognize your device across sessions | Our server |
| Country, catalog, and language choice | Shows you the right categories and translations | On your device; sent to our server only to fetch matching catalog content |
| Advertising data (Google AdMob) | Shows ads that support free use of the app | Google, per Google's own ad privacy disclosures — HomLyst does not receive or store this data itself |
We do not collect: your contacts list, precise location, payment information, or anyone else's phone number besides one you explicitly type in to send them a list.
2. How your phone number is protected
If you enter your phone number, or send a list to someone else's number, it's sent to our server once, over an encrypted connection. The server immediately converts it into a one-way scrambled value before saving anything — the readable phone number itself is never written to our database and never appears in our logs.
- If our database were ever breached, an attacker would see meaningless scrambled values, not phone numbers.
- We can still recognize “this is the same phone number as before” so sharing works, without storing it in readable form.
- We cannot look up or recover your phone number from what's stored — the process only works one way.
3. Who else sees this data
A small number of service providers help run HomLyst's sharing and notification features:
| Service | Purpose |
|---|---|
| Google Firebase Cloud Messaging | Push notifications on Android |
| Apple Push Notification service | Push notifications on iOS |
| Supabase (PostgreSQL) | Database storage for sharing features |
| Railway | Backend server hosting |
| Google AdMob | Advertising |
| jsDelivr (GitHub-backed CDN) | Delivers grocery catalog content — no personal data |
4. How long we keep it
- Shared-list invitations: kept for 48 hours, then automatically deleted about a week later at the latest.
- Device registration: automatically deleted if the app hasn't been opened in 12 months.
- Shopping list content: stays on your device under your control until you delete it — we don't have a copy unless you actively share it.
5. Your rights
- Access — ask what we hold about your device, phone, or name by contacting us.
- Correction — change your name, phone, or language any time in Settings.
- Erasure — request deletion of your device's server-side record at any time by contacting us directly.
- Withdraw consent — simply don't fill in a phone number or name; the rest of the app works fully offline without it.
6. Children's privacy
HomLyst is not directed at children, and we don't knowingly collect data from users under 13 (or the minimum age in your country, if higher).
7. Contact
For any question about this notice or your data, contact: sathish4earn@gmail.com