Privacy Policy

Last updated: 6 October 2026 · applies to the iPhone app “Listify” and this website

1. Controller

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

Marcus Kailbach
Burgstr. 32
50181 Bedburg
Germany
Email: mk.devapp@proton.me

No data protection officer has been appointed, and none is legally required.

2. Storage on your device

Everything you create in Listify is stored locally on your iPhone, for example lists, tasks, ideas, shopping items, notes, subtasks, reminders, saved places, photos, file attachments and your settings. So that the shopping list can assign items to categories automatically and make suggestions, the app also remembers your previous entries and category choices. This happens only on your device as well.

This data is not transmitted to us. It remains stored until you delete it, delete your account in the app or remove the app.

Legal basis: Art. 6(1)(b) GDPR (providing the app features you use).

3. Sign in with Apple

For certain features, in particular sharing lists and editing them together, you can use “Sign in with Apple”. Apple handles the sign-in. Listify receives a user identifier issued by Apple and, if you choose to share them during sign-in, your name and email address. The email address may be an anonymous relay address from Apple (“Hide My Email”).

This information is stored on your device and, if sync is turned on, backed up in your private iCloud space (see section 4). It is not transmitted to us. You can change your display name in the app.

Legal basis: Art. 6(1)(b) GDPR. Apple’s privacy policy also applies to the sign-in: apple.com/legal/privacy.

4. iCloud sync

If you turn on iCloud sync, your Listify content is stored via Apple’s CloudKit service in the private database of your own iCloud account. This lets you transfer your data to other devices and restore it. To notify the app about changes, CloudKit uses silent push notifications via the Apple Push Notification service.

iCloud is provided by Apple (for users in the EU: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). As the developer, we have no access to the content of your private iCloud database. You can turn off sync at any time in the app or in iOS Settings.

Legal basis: Art. 6(1)(b) GDPR. Apple’s iCloud terms and privacy policy apply.

5. Sharing and collaboration

When you share a list or task with others, the shared content is stored via CloudKit in your iCloud account and made available to the people you invite. Participants can see the shared content and your display name or the identifier stored with Apple (such as name or email address), so it is clear who changed what. Likewise, you can see the corresponding details of the other participants.

You alone decide whom to invite. You can stop sharing or leave a shared list at any time.

Legal basis: Art. 6(1)(b) GDPR.

6. Photos, camera and attachments

You can add photos and files to entries. Listify only accesses the camera when you choose to take a photo and have allowed access in iOS. When you pick from your photo library, the app only receives the images you select. Like all content, photos and attachments are stored on your device and, if enabled, in your iCloud, or shared with the people you share the list with.

Legal basis: Art. 6(1)(b) GDPR.

7. Places and map search

Listify does not read your device’s location. You can, however, add a place to an entry. To do so, the app uses Apple Maps place search (MapKit), which sends your search term to Apple in order to find matching places. Listify saves the selected place as part of your entry. When you open a place, Apple Maps is launched with that place.

Legal basis: Art. 6(1)(b) GDPR. Information on privacy in Apple Maps can be found in Apple’s privacy policy.

8. Reminders and notifications

Task reminders are scheduled as local notifications on your iPhone. No server of ours is involved. You only receive notifications if you have allowed them in iOS. You can change this at any time in iOS Settings.

9. Listify Plus (in-app subscriptions)

You can subscribe to Listify Plus through the App Store. Apple alone handles purchase, payment, renewal, cancellation and refunds. We do not receive any payment data. The app only uses Apple’s StoreKit to check whether a valid subscription exists in order to unlock the Plus features.

Legal basis: Art. 6(1)(b) GDPR. Apple’s terms and privacy policy apply to the purchase.

10. Contact & feedback

Contact form in the app

When you submit the “Contact & feedback” form in the app, the following information is transmitted: name, reply email address, category, subject, message, app version, build number, app language and platform (iOS).

Diagnostic report (optional): Only if you turn on the “Diagnostics” switch is a technical report sent as well. It contains: timestamp, app version, iOS version, region/locale, time zone, whether you use Listify Plus, the status of iCloud sync and collaboration, the time of the last sync, the number of pending or failed sync records and the number of your entries, lists, active shares and attachments. The report contains no titles, notes, places or attachment contents. You can view the report in the app before sending.

To transmit the form we use the form service Formspree (Formspree, Inc., USA), which receives the request and forwards it to us by email. Formspree processes the data on our behalf under a data processing agreement. Because Formspree is based in the USA, the data is transferred to the USA. This transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Formspree’s privacy policy: formspree.io/legal/privacy-policy.

Formspree is only contacted when you actively submit the form. No Formspree SDK is included in the app.

Contact by email

You can also write to us directly at mk.devapp@proton.me. We then process your email address and the content of your message. Our mailbox is provided by Proton AG (Switzerland). Switzerland is covered by an adequacy decision of the European Commission.

Legal basis and retention

The legal basis is Art. 6(1)(b) GDPR where your request concerns use of the app or a contract, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). The diagnostic report is only transmitted with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

We delete requests once they have been resolved, and no later than 12 months after the matter is closed, unless statutory retention obligations apply.

11. Backups (export)

You can create a backup file (.listifybackup) in Listify and import it again. The file is created on your device and stored only where you save it yourself (for example in the Files app or iCloud Drive). We do not receive a copy.

12. Deleting your account and data

You can delete your Listify account yourself at any time under Profile → Account → “Delete account & cloud data”. This deletes:

• all Listify data and attachments stored locally on the device,
• your Listify data in your private iCloud database,
• the lists you have shared. They will no longer be available to the other participants.

You will also leave any lists you were invited to.

You can additionally remove the “Sign in with Apple” connection in iOS Settings under [your name] → Sign in with Apple. To cancel an active subscription, use your Apple ID’s subscription settings. Deleting your account does not cancel a subscription automatically.

13. App Store statistics from Apple

If you have agreed to “Share with App Developers” in iOS Settings, Apple provides us with aggregated, non-personal statistics such as crash reports and usage figures. Apple collects this data, not Listify. We cannot identify individual people from it. You control this under Settings → Privacy & Security → Analytics & Improvements.

14. This website

This website is operated by a web hosting provider with registered office and servers in the European Union, with whom a data processing agreement is in place. When you visit the site, the server processes technically necessary data in log files (server logs): IP address, date and time, page requested, amount of data transferred, referrer URL, and browser and operating system. This is required to deliver the site and keep it secure. The logs are deleted or anonymised after a short period, no later than 30 days.

This website uses no cookies, no analytics or tracking tools and no embedded third-party content (including no externally loaded fonts). Email links simply open your own email program.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).

15. International transfers

Data is transferred to countries outside the EU/EEA

• to Formspree (USA) when you use the contact form, safeguarded by EU Standard Contractual Clauses (see section 10),
• to Proton AG (Switzerland) for emails, covered by an adequacy decision,
• where applicable, to Apple Inc. in the USA as part of Apple’s services (iCloud, Sign in with Apple, App Store, Apple Maps). Apple Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

16. Your rights

Under the GDPR you have the right to

• access the data stored about you (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to mk.devapp@proton.me is all it takes. Because your app content is stored only on your device and in your iCloud account, you can also view, export and delete it there yourself at any time.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the supervisory authority in your country of residence.

17. Other information and changes

You are not legally or contractually required to provide us with personal data. Without an email address, however, we cannot reply to your request. No automated decision-making or profiling takes place.

We will update this privacy policy if the app, the website or the legal situation changes. The version published here and in the app applies. In case of doubt, the German version prevails.