This is a translation. The German version of this policy is the binding one.
This policy explains which personal data the Listig app and this website process, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Who is responsible
The controller is Florian Trimmel, Ludweis Aigen. For every question about your data, and to use your rights, write to listig-support@googlegroups.com.
In short
- Listig stores what it needs to run your shopping lists: your Google account details, your families, your items and your invitations.
- You sign in with Google. Listig never sees your Google password.
- The app uses a cookie to keep you signed in and keeps a copy of your lists on your device so it works offline. There are no advertising or analytics cookies, no tracking and no third-party scripts.
- The server is hosted by IONOS, a German provider, in an EU data centre.
- You can delete your account yourself in the app under Settings.
What Listig stores about you
Your account
When you sign in for the first time, Listig creates an account with these details from Google:
- the Google account ID (the identifier Google uses for your account),
- your email address,
- your name as shown in your Google account,
- the link to your Google profile picture, if you have one.
Listig updates these details from Google every time you sign in. It also stores the language and theme you choose, whether you have finished the tour, your role (user or administrator), when the account was created, when you last signed in, and whether the operator has disabled the account.
Sessions
Each device you sign in on gets a session. The server stores a fingerprint of the session key (not the key itself), when the session started, when it was last used, when it expires, and the browser's identification string (user agent), which names the browser and operating system. A session expires 180 days after you last used Listig on that device. Signing out deletes it at once.
Families and lists
For each family Listig stores its name, who created it and when, its members with their role (owner or member) and the date they joined, and the family's list. The name of a family created for you at sign-in contains your first name.
For each item on a list Listig stores the name, quantity, unit, category, an optional note, who added it, who checked it off and when, and when it was created and last changed. Items you delete or clear from the cart are deleted. To make suggestions, each family also keeps a history of the item names it has used, with the last unit, quantity and category and how often each was used. This history belongs to the family, not to a person.
Members of a family see each other's name, profile picture, role and joining date, and everything on the family's list. They do not see each other's email address.
Invitations
When someone invites a person to a family, Listig stores the family, who invited, the kind of invitation (link or email), the invitation's secret link, its status (open, accepted, declined, revoked or expired), when it was created, when it expires, and who answered and when. For an email invitation it also stores the invited email address. All members of the family see open invitations, including the invited address.
If you are invited by email, your address is therefore stored before you have ever used Listig. The invitation shows up in Listig when you sign in with that address. If the operator has set up email, Listig also sends you one email with the link (see "Email" below).
Access list and refused sign-ins
Listig can limit sign-in to a list of allowed accounts. That list holds the email address, the role, an optional note by the operator, who added it and when. When a sign-in is refused because an address is not on the list, Listig records the email address and the time so the operator can let that person in. If the refused sign-in started from an invitation link, Listig also creates an email invitation for the address from that link, so the family is waiting once the person is let in. The records of refused sign-ins are kept for 30 days. After that they are deleted the next time a sign-in is refused or the operator opens the list of people waiting for access.
Administration log
Listig keeps a log of administrative actions and family changes: accounts created, deleted, disabled or enabled, changes to the access list, families created, renamed or deleted, members removed or leaving, ownership changes, and invitations created, revoked, accepted or declined. An entry holds who did it, what, when, and details such as the email address of a created or deleted account, the invited email address, or a family's old and new name. The operator uses this log to trace problems and misuse. Entries are currently not deleted automatically; a retention period is not yet set.
Administrators see this log and, in the admin area, each account's name, email address, role, creation date, last sign-in and number of families. The admin area shows no list contents.
Storage on your device
The app stores the following on your device:
- The session cookie (
__Host-sid). It holds the random session key that keeps you signed in. It is sent only to Listig, only over an encrypted connection, and cannot be read by scripts. It lasts 180 days and is renewed when you use Listig. - A sign-in cookie (
__Host-oidc) for the ten minutes of a sign-in. It holds random values that tie Google's answer to your sign-in, the page to return to, and the language of the sign-in page. It is deleted when the sign-in finishes. - An offline copy in your browser's storage (IndexedDB): your profile, your families, their lists and recent suggestions, and the changes you made offline that are waiting to be sent. The copy is updated as you use the app, a copy older than 30 days is discarded, and everything is deleted when you sign out or delete your account.
- Settings in your browser's local storage: the language and theme you chose, whether the tour has run, and which of your families was open last. These stay after you sign out, so the sign-in page appears in your language.
- The app's files (program code, icons) in the browser's cache, so that Listig opens without a connection.
All of this is needed to provide the service you asked for: signing in, and a list that works without reception. None of it is used for tracking or advertising. Under § 165 (3) of the Austrian Telecommunications Act (TKG 2021) such storage needs no consent, so Listig shows no cookie banner.
Server logs and abuse protection
The Listig server writes a technical log. It records starts and stops, sign-ins and account deletions with the internal account number, sent or failed invitation emails with the invitation number, requests refused because of too many attempts with the address of the page, and errors. It contains no email addresses, no list contents and no IP addresses. If an invitation email fails, the log keeps the mail server's error message, which may name the recipient's address.
To protect sign-in and invitation links against automated guessing, the server counts requests per IP address (20 per minute). These counters exist only in the server's memory. They are not written to disk or to the log and are gone at the latest when the server restarts.
The server in front of the app (the TLS proxy that handles the encrypted connection) does not keep an access log. When it cannot pass a request on, for example while the app restarts during an update, it logs an error that includes that request: the IP address, the address of the page, and the browser's request headers, with cookies removed.
Both logs go to the server's system journal, which keeps entries for 30 days and deletes older ones automatically.
Sign-in with Google and profile pictures
You sign in with your Google account. Your browser goes to Google, you sign in there, and Google tells Listig your account ID, email address, whether the address is verified, your name and the link to your profile picture. Listig asks for nothing else and receives no access to your Google data. Google learns that you signed in to Listig. For this step Google is an independent controller; its privacy policy applies: policies.google.com/privacy.
Profile pictures are shown from Google's servers: when the app shows your picture or another member's, your browser loads it directly from Google. Google then receives your device's IP address and the usual browser information, but not which page of Listig you are on.
Email is optional and only works when the operator has set up a mail server. Listig then sends exactly two kinds of email: invitations, sent to the invited address with the family's name, the inviter's name and the join link, and test emails, which administrators send to themselves. Listig sends no newsletters and no notifications. If a mail server is configured, the operator's email provider processes the recipient's address and the message on the operator's behalf.
This website
This website sets no cookies, runs no scripts and loads nothing from other servers. It is served by the same TLS proxy as the app; what that proxy logs is described above.
If you write to the support address, your message and email address are used to answer you. The support address is a Google Group: your message is stored on Google's servers, where Google processes it on the operator's behalf. Messages are kept until the operator deletes them; there is no automatic deletion.
Purposes and legal bases
- Running the service (your account, sign-in, sessions, families, lists, invitations you send, the offline copy, email invitations): to provide the service you signed up for, Art. 6 (1) (b) GDPR.
- Email invitations to people who don't use Listig yet: the legitimate interest of the inviting member and the family in inviting someone, Art. 6 (1) (f) GDPR.
- The access list and refused sign-ins: the operator's legitimate interest in deciding who can use the service, Art. 6 (1) (f) GDPR.
- Server logs, request limits and the administration log: the legitimate interest in running the service reliably, finding errors and preventing misuse, Art. 6 (1) (f) GDPR.
Listig makes no automated decisions about you and creates no profiles. Without your Google account details Listig cannot create an account for you.
Who receives data
- Hosting: the server runs at IONOS SE (Montabaur, Germany) in an ISO 27001 certified data centre in the European Union; IONOS processes the data on the operator's behalf under a data processing agreement (Art. 28 GDPR), which is in place.
- Google: for sign-in and profile pictures, as described above, as an independent controller.
- Email provider: only when email is switched on, for invitation emails, as a processor.
- Other members of your families: they see what is described under "Families and lists".
Nobody else receives your data. Listig does not sell data and shares none for advertising.
Transfers outside the EU
Listig's own server is in the EU. Google may process data in countries outside the EU, including the USA, when you sign in and when profile pictures load. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing adequate protection; Google additionally offers the EU standard contractual clauses.
How long data is kept
- Your account and what belongs to it: until you delete it, or until the operator deletes it.
- Sessions: until you sign out, or until 180 days after you last used Listig on that device. Expired sessions are deleted the next time anyone signs in.
- Items: until someone deletes them or clears them from the cart, or the family is deleted.
- A family, its list, its item history and its invitations: until the family is deleted.
- Invitations: open invitations end when they are accepted, declined or revoked, or after 7 days (links) or 30 days (email). The record of an invitation, including an invited email address, stays with the family until the family is deleted. Open invitations sent by you or to your address are deleted when you delete your account.
- Refused sign-ins: 30 days, as described above.
- The access list: until the operator removes the entry. Deleting your account does not remove it; write to the support address for that.
- Server logs: 30 days, as described above.
- Database snapshots: before each update that changes the database structure, the server writes a copy of the database. The last three copies are kept on the server. The operator keeps no copies outside the server.
What deleting your account does
In the app, go to Settings and tap "Delete my account". This:
- deletes your account with your Google account ID, email address, name, profile picture link and settings,
- deletes all your sessions and signs you out on every device,
- deletes the open invitations you sent and the open invitations addressed to your email,
- removes you from all families; families you own pass to the member who has been there the longest,
- deletes families where you are the only member, with their lists, items and invitations.
What stays:
- items you added or checked off in families that continue stay on their lists, no longer linked to you,
- families you created stay, if other members remain, no longer linked to you,
- answered or expired invitations that were addressed to your email stay in the records of those families,
- the administration log keeps an entry that the account was deleted, with its email address, as described above,
- your entry on the access list, if there is one,
- server logs for 30 days and database snapshots until they are replaced, as described above.
The operator can also delete accounts in the admin area, with the same effect.
Your rights
You have the right to:
- access the data Listig stores about you (Art. 15 GDPR),
- rectification of incorrect data (Art. 16 GDPR); your name, email address and picture come from Google and are updated from there each time you sign in,
- erasure (Art. 17 GDPR); the quickest way is deleting your account in the app,
- restriction of processing (Art. 18 GDPR),
- data portability, a copy of the data you provided in a common machine-readable format (Art. 20 GDPR),
- object to processing based on legitimate interest (Art. 21 GDPR).
To use these rights, write to listig-support@googlegroups.com from the email address of your account.
You can also complain to a data protection authority. In Austria that is the Datenschutzbehörde (Austrian Data Protection Authority).
Children
Listig is not directed at children under 14. If you believe a child under 14 has given Listig personal data, write to the support address and the data will be deleted.
Changes to this policy
When Listig changes what it stores or how, this policy is updated and the date at the top changes. Last updated: October 11, 2026.