1. Information We Collect

Depending on how you use ZuList, we collect:

• Account information: your name, email address, profile photo and a user ID when you sign in with Google, Apple or email. You can also use ZuList as a guest; guest lists stay on your device.
• Your content: lists, categories, items, notes, due dates and the photos you attach to items.
• List membership: who you share a list with, their role, and invitation details, including the email address of a person you invite.
• Purchase information: your Premium plan, its status and the receipt or purchase token from Apple or Google. We never receive your card or payment details.
• Device information: a push-notification token, device model, operating system, app version and language.
• Usage information: how features are used, such as lists created or items checked off, linked to your user ID.
• Diagnostics: crash reports and app performance information, which are not linked to your identity.
• Advertising data in the free version: see section 5.

2. How We Use Your Information

We use your information to:

We do not sell your personal information.

• Provide ZuList: sign you in, store your lists and keep them in sync across your devices and with the people you share them with.
• Send the notifications you allow, such as list changes, reminders and invitations.
• Send invitation emails that you ask ZuList to send.
• Verify purchases and unlock Premium.
• Find and fix crashes and improve the app.
• Show ads in the free version.

3. Who Can See Your Lists

A list you share is visible to its members. Members of a shared list can see each other's name, email address and profile photo, as well as the list's items and photos.

When you leave a list, or the owner removes you, you no longer have access to it.

4. Service Providers

We use these providers to run ZuList. They process data on our behalf under their own privacy policies, for example policies.google.com/privacy.

• Google Firebase (Authentication, Cloud Firestore, Realtime Database, Cloud Storage, Cloud Functions, Cloud Messaging, Analytics and Crashlytics): accounts, storage and sync, notifications, usage analytics and crash reports.
• Google AdMob and Google User Messaging Platform: ads and ad consent in the free version.
• Google Sign-In and Sign in with Apple: sign-in.
• Apple App Store and Google Play: purchases and subscription verification.
• Twilio SendGrid: delivery of the invitation emails you send.

5. Advertising

The free version shows ads from Google AdMob; Premium removes them. AdMob may collect your device's advertising identifier, an approximate location based on your IP address, and your interactions with ads, and may use them to personalize and measure ads across apps and websites owned by other companies.

On iOS, we ask for permission through Apple's App Tracking Transparency prompt. If you decline, your advertising identifier is not used for tracking. In the EEA, the UK and Switzerland, we ask for your consent before ads load, and you can change that choice at any time in ZuList's Settings. You can also reset or limit your advertising identifier in your device settings.

6. Camera, Photos, Notifications and Data on Your Device

ZuList uses the camera and photo library only when you choose to add a photo. Photos are uploaded to cloud storage and are visible to you and the members of the list. Notifications are sent only if you allow them, and you can mute them in the app at any time.

ZuList keeps a copy of your lists on your device so you can shop without a connection, and shares a short summary with the home-screen widget. This copy is removed when you delete the app.

7. Data Retention and Account Deletion

We keep your data for as long as your account exists. You can delete your account in the app (Profile → Delete account) or at zukiapps.com/zulist/delete-account. Deleting your account removes your profile, your profile photos and the lists only you belong to. Shared lists you own are transferred to another member, and you are removed from lists shared with you.

Crash reports are kept for up to 90 days. Usage analytics are kept according to Google Analytics retention settings.

8. Your Rights

Depending on where you live (for example under the GDPR or the CCPA), you have the right to access, correct, export or delete your personal information, to object to or restrict its processing, and to withdraw consent. To make a request, contact us using the details below. We respond within 30 days.

9. Children

ZuList is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

10. Security

Data is encrypted in transit, and access to lists is enforced by server-side security rules. No method of storage or transmission is completely secure.

11. Changes to This Policy

When we update this policy, we change the date at the top of this page. For significant changes, we will also tell you in the app.