Your privacy matters to us. FridgeList is designed with a privacy-first approach — your lists stay on your device by default and are only shared with others when you choose to. This policy explains exactly what data we collect, why, and how we protect it.
1. Who We Are
FridgeList is developed and operated by Raluca Lupu, a self-employed developer based in the United Kingdom. If you have any questions about this policy, you can contact us at:
Email: ralucalupudev@gmail.com
2. What Data We Collect
We only collect data that is strictly necessary for the app to function.
If you use FridgeList without creating an account:
- No personal data is collected
- Your lists and items are stored locally on your device only
- We have no access to your data whatsoever
If you create a FridgeList account (required for sharing only):
- Username — displayed to people you share lists with
- Email address — used to log in and receive invitations
- Password — stored securely as an encrypted hash; we cannot see it
- Push notification token — used to send you notifications about shared list activity
- Notification preferences — your choices about which notifications to receive
- Last active timestamp — used to avoid sending push notifications when you are actively using the app
For shared lists:
- List names and item names are stored in our database so all invited members can access them
- Photos added to shared list items are stored in Firebase Storage so all invited members can view them. Photos on unshared local lists are stored on your device only and never uploaded to our servers.
- Activity log entries (who did what and when) are stored for up to 7 days
3. How We Use Your Data
- Authentication — your email and password allow you to log in securely
- Sharing — your username and email allow others to find and invite you to shared lists
- Notifications — your push token allows us to notify you of activity on shared lists, due dates and invitations
- Improving the app — we do not use your data for analytics or advertising
We do not sell your data. We do not use your data for advertising. We do not share your data with any third parties except those listed in Section 5.
4. Data Storage and Security
Local data: Lists you have not shared are stored exclusively on your device using AsyncStorage. This data never leaves your device unless you enable iCloud or Google Drive backup in Settings, in which case it is backed up to your own personal cloud account.
Cloud data: Shared list data is stored in Google Firebase Firestore, hosted in Europe (EU region). Firebase is certified to ISO 27001 and SOC 1/2/3 security standards.
Encryption: All data transmitted between your device and our servers is encrypted using HTTPS/TLS. Passwords are never stored in plain text — they are securely hashed by Firebase Authentication. Google Firebase also encrypts all stored data at rest on their servers. As the developer we have access to list content stored in Firestore for the purpose of maintaining and supporting the service — however we are committed to never reading, sharing or misusing your personal data. End-to-end encryption of list content is planned for a future update.
Access controls: Firebase security rules ensure that users can only access lists they are members of. You cannot access another user's private lists.
5. Third-Party Services
FridgeList uses the following third-party services:
- Google Firebase (Authentication, Firestore, Storage) — for user accounts, shared list storage and photo storage for shared lists. Firebase Privacy Policy →
- Expo Push Notifications — for delivering push notifications to your device. Expo Privacy Policy →
- Apple iCloud / Google Drive — optional backup only, using your own personal account. We do not have access to your iCloud or Google Drive.
- Apple App Store / Google Play — for subscription payments. We never see or handle your payment card details. Apple Privacy Policy →
6. Data Retention
- Account data — kept until you delete your account
- Shared list data — kept until the list owner deletes the list
- Activity log entries — automatically deleted after 7 days
- Push notification tokens — automatically cleaned up when they expire or become invalid
- Local data — stored on your device until you uninstall the app or delete the data manually
7. Your Rights (UK GDPR)
As a user based in the UK or EU you have the following rights regarding your personal data:
- Right of access — you can request a copy of the data we hold about you. Contact us by email and we will provide your data within 30 days.
- Right to rectification — you can update your username directly in the app at any time via Settings → Change Username. To change your email address contact us directly.
- Right to erasure — you can permanently delete your account at any time in Settings → Delete Account. This removes your profile, removes you from all shared lists and deletes any lists you own from our servers. Local data on your device is not affected.
- Right to data portability — you can request a copy of your data in a readable format by emailing us. We will provide your account information and list data within 30 days. Note that local lists stored only on your device are not held by us and cannot be exported by us — only you can access those.
- Right to object — you already have full control over how your data is processed. Sharing is entirely opt-in. Push notifications can be turned off at any time in Settings. If you wish to object to any other processing of your data contact us directly.
- Right to restrict processing — you can stop sharing lists at any time, turn off all notifications in Settings, or delete your account entirely. If you wish to restrict processing in any other way contact us directly.
To exercise any of these rights, contact us at ralucalupudev@gmail.com. We will respond within 30 days.
8. Children's Privacy
FridgeList is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
9. Cookies
The FridgeList mobile app does not use cookies. Our website may use essential cookies for basic functionality only. We do not use tracking or advertising cookies.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you through the app. Your continued use of FridgeList after changes are posted constitutes your acceptance of the updated policy.
11. Contact Us
If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact us:
Email: ralucalupudev@gmail.com
We aim to respond to all enquiries within 30 days.