HomLyst Privacy Notice

See also: HomLyst Terms of Service

Status: pending formal legal review. This describes what the app actually does as of this writing. It has not yet been reviewed by counsel familiar with India's Digital Personal Data Protection (DPDP) Act 2023 (HomLyst's primary market) or, if the app has or will have EU/UK/California users, GDPR/UK GDPR/CCPA. This document does not itself make HomLyst compliant with any of those laws — it's the factual starting point a lawyer needs to assess compliance, published here as an accurate good-faith description in the meantime.

1. What we collect, and why

Data	Why we collect it	Where it's stored
Shopping list content (categories, items, quantities)	The core feature of the app	On your device only, unless you use "Share with HomLyst User," QR/link sharing, or Family Space
Display name (optional, you type it in)	Shown to people you share a list with or collaborate with in a Family Space, e.g. "Sathish sent you a shopping list" or "Added by Sathish"	Our server, if you use a sharing or collaboration feature
Phone number (optional, you type it in)	Lets another HomLyst user send you a list, or invite you to a Family Space, by typing your number	Our server — never in readable form (see §2)
Family Space photo (optional, you pick it)	Lets your household recognize a shared Family Space at a glance	Our server, resized and compressed, only if you choose to add one
Family Space / Trip Chat messages and item activity	Lets household members coordinate a shared list in real time	Our server, visible to other members of that Family Space
Approximate location (only when you use "Nearby Shops," permission requested each time)	Finds nearby stores for the categories in your list	Sent to our server for that search and to Google Places/Routes to look up stores; not stored linked to your device or identity — only a coarse, rounded location bucket is cached to speed up repeat searches near the same area
Push notification token (FCM for Android, APNs for iOS)	Delivers "someone shared a list with you" and Family Space notifications	Our server, and Google/Apple's push infrastructure
Device identifier (a random ID generated on install, not your phone's hardware ID)	Lets the server recognize your device across app sessions	Our server
Country/catalog and language choice	Shows you the right grocery categories and translations	On your device; sent to our server only to fetch the matching catalog
Advertising data (Google AdMob)	Shows ads that support free use of the app	Google, per Google's own ad privacy disclosures — HomLyst does not receive or store this data itself

We do not collect: your contacts list (only the single contact you explicitly pick to invite is read, never uploaded in bulk), precise/background location (only an approximate, one-time location when you actively use "Nearby Shops"), payment information, or anyone else's phone number besides the one you explicitly type in or pick to invite.

2. How your phone number is protected

If you enter your phone number (Settings → Profile) or send a list to someone else's number, that number is sent to our server once, over an encrypted connection. The server immediately converts it into a one-way scrambled value (a keyed cryptographic hash) before saving anything — the readable phone number itself is never written to our database and never appears in our logs.

This means:

If our database were ever breached, the attacker would see meaningless scrambled values, not phone numbers.
We can still recognize "this is the same phone number as before" (so sharing works), without ever storing it in readable form.
We cannot look up or recover your phone number from what's stored — the process only works one way.

This is a real technical safeguard (a form of pseudonymization), but your phone number is still legally "personal data" as long as it's collected at all — this notice, your consent, and your rights below still apply.

3. Who else sees this data (sub-processors)

Service	Purpose	Data involved
Google Firebase Cloud Messaging	Push notifications on Android	Push token
Apple Push Notification service	Push notifications on iOS	Push token
Supabase (PostgreSQL, hosted in the ap-south-1/Mumbai region)	Database storage	Scrambled phone number, display name, device ID, push token, shared list content
Railway	Backend server hosting	Same as above, in transit
Google AdMob	Advertising	Advertising identifiers, per Google's own policies
Google Places API / Google Routes API	Looks up nearby stores and routes when you use "Nearby Shops"	Approximate location (sent per search, not linked to your device or stored by Google on our behalf)
jsDelivr (GitHub-backed CDN)	Delivers grocery catalog content (no personal data)	None (public, non-personal catalog files only)

(This list should be verified against actual Data Processing Agreements with each provider as part of the pending legal review.)

4. How long we keep it

Shared-list invitations: kept for 48 hours (their normal lifetime), then automatically deleted about a week later at the latest.
Device registration (push token, scrambled phone, display name): automatically deleted if the app hasn't been opened in 12 months. Reopening the app afterward simply re-registers it.
Shopping list content: stays on your device under your control (History screen) until you delete it yourself; we don't have a copy unless you actively share it.

5. Your rights

Access — ask what we hold about your device/phone/name (contact us; no automated export tool yet).
Correction — change your name/phone/language any time in Settings.
Erasure — request deletion of your device's server-side record at any time via Settings → "Delete my data" in the app, or by contacting us directly. This erases your name, phone number, and push registration from our servers, and clears your cart and history on that device; content you've already shared in a Family Space, Event, or Trip Chat may still be visible to other members there.
Withdraw consent — simply don't fill in a phone number/name if you don't want to use the sharing feature; the rest of the app works fully offline without it.

6. Children's privacy

HomLyst is not directed at children and we don't knowingly collect data from users under 13 (or the minimum age in your country, if higher). "Family Space" is a household-coordination feature for the adults managing a shared shopping list, not a product for children to use directly. (An explicit policy decision + possibly an age gate is part of the pending legal review.)

7. Contact

For any question about this notice or your data, contact: homlyst@gmail.com