Privacy Policy

The List by Lineage Technologies · Effective: 15 October 2026 · Last updated: 15 October 2026

The List is an app for a family's shared lists: the weekly shop, wishlists and places. It is published by Lineage Technologies, Opus Tower, Business Bay, Dubai, United Arab Emirates (DET Dubai Trader Licence no. 1639817). We are the controller of the personal data described here. Contact: [email protected].

The short version

Your lists stay on your phone until you share them with your family, join a family with a code, or share a wishlist by link.
Sharing uses an anonymous account. We never ask for a password, phone number or email.
No ads, ever. We do not sell or rent your data, and we do not track you across other apps or websites.
You can delete your data from inside the app at any time: Family and settings, then Delete my data.

On your phone only

Until you share, everything you put in The List is kept on your phone and is not sent to us: your name, the people you add, your lists and everything on them, photos you save, places, dates, gift ideas and reminders. Some things always stay on the phone, even after you share: the items you buy most often (used for suggestions), the order of aisles in your shop, and your reminder settings.

When you share with your family

When you tap to share with your family, join a family with its code, or share a wishlist by link, the app creates an anonymous account for your phone and copies the family's lists to our database, so everyone in the family sees the same thing. We store:

an anonymous account ID for each phone (no email, phone number or password);
the family's name and its invite code;
each person's name, colour and emoji, including profiles a parent adds for someone without a phone, such as a child;
lists and items: names, amounts, notes, aisles, links, prices and currency, shop names, dates, who added, ticked or was given an item, hearts, tags and ratings;
places you save: name, address and map position;
photos you save to an item, for example a picture shared in from another app;
gift claims ("I'll get this"). These are hidden from the person whose wishlist it is, unless they choose to see who gave what after the occasion;
a family activity feed ("Emel added eggs"), which we delete after 90 days. Items marked "Only me" never appear in anyone else's feed.

Anyone in your family can see the family's shared lists, except gift claims on their own wishlist (until they choose to see them after the occasion) and items another person has marked "Only me".

Photos. A saved photo is stored at a long, random web address that cannot be guessed. The app only shows it to your family, but anyone who is given that exact address can open it, and photos on a wishlist you share by link appear on that wishlist's web page.

Signing in with Apple or Google (optional)

The app may offer Sign in with Apple or Google so your lists survive a lost or replaced phone. It is optional and the app works fully without it. If you use it, we receive an account ID from Apple or Google and, depending on the provider and what you allow, your name and email address. We use them only to sign you back in and to suggest your name in the family. We never see your Apple or Google password.

Location

The app asks for your location only when you tap "Nearest to me" or the button that shows where you are on the map. It only needs a rough position: on Android it asks for approximate location only, and on iPhone it works with Precise Location turned off. It is used only while the app is open. Once you have allowed it, the app also uses it when you open your places, to sort them by distance. Your position is used on the phone to sort your places by distance and show you on the map. On iPhone, when you search for a place, the approximate area you are in is sent with the search to Apple Maps so nearby results come first. We never store your location and it is not shared with your family. A place's position is saved only when you save that place.

Voice add

If you tap the microphone, the app listens until you stop or pause and turns what you say into shopping items. Where your phone supports it, this happens on the phone itself. If it does not, your phone's own speech service (Apple on iPhone, Google on Android) processes the audio. The app does not record, keep or send the audio to us; it only keeps the words that become items.

Notifications

Reminders for birthdays, Eid and other occasions are set on your phone and do not go through us.

If you turn on family notifications, your phone gives us a notification token from Google (Firebase Cloud Messaging) on Android or Apple (Apple Push Notification service) on iPhone, and we store it with your account, the phone type and its time zone. When someone in your family changes a list, our server sends a short note such as "Emel added laban, eggs and bread", titled with the list's name, through Google or Apple. We never notify you about your own changes and send nothing between 22:00 and 07:00 in your time zone. Turn notifications off in Family and settings and the token is deleted from our servers (the phone needs a connection at that moment).

Wishlist links for relatives

You can share a wishlist by link so relatives can see it and claim gifts in a web browser without the app. A guest who claims a gift gives a first name and, if they want, an email address.

The first name is shown to your family so they know a gift is taken, but not to the person whose wishlist it is, unless they choose to see who gave what after the occasion.
The email address is visible to nobody in the family. It is stored in a part of our database the app and the website cannot read back. We do not send emails to it today and will not use it for marketing.
To stop the same gift being claimed over and over, we keep a scrambled (hashed) form of the guest's IP address with the claim, and a scrambled record of recent attempts for about a day.
The guest's browser remembers their name, email and the claims they made, so they can undo a claim. This stays in their browser.
Guest details are kept until the claim is removed, the wishlist is deleted or the family is deleted. A guest can ask us to delete theirs sooner by emailing us.

Shop links on a shared wishlist page carry the tag utm_source=thelist. It tells the shop only that the visit came from The List, and carries nothing about you.

Maps, links and pages the app opens for you

These requests go from your phone straight to the service named. We do not receive them.

Maps. Apple Maps on iPhone and Google Maps on Android. If Google Maps is not available, the map is drawn from OpenStreetMap. The map provider sees your phone's IP address and the area being shown.
Finding a place by name uses your phone's own place search (Apple on iPhone, Google on Android).
Reading a link. When you paste or share a link, the app loads that page on your phone to read its title, picture and price. The website sees a request from your phone's internet address.
Opening a link shows the page in your phone's browser. Directions open in your maps app.

Crash reports

If the app crashes or hits an error, it sends a report to Sentry (Functional Software Inc.), stored in the European Union: the error, the app version and basic device details such as model and operating system version. Sentry also counts app sessions, so we can see how often the app crashes, and records how long screens take to load for one session in ten. Reports are set not to include personal data, and we use them only to fix bugs and slow screens. We keep them for up to 90 days.

Our website

thelistapp.ai hosts wishlist pages for guests (above) and pages about the app. It also has a waitlist form: if you join it, we store your email address and, if you give it, your name, to tell you about The List. Ask us and we will remove you. The site still runs an earlier web version of The List at thelistapp.ai/login. If you sign in there, we store your email address to sign you in, and its place search sends what you type to Anthropic and Foursquare to find places. The website uses no cookies for tracking and no analytics.

What we do not do

No ads and no advertising ID.
No analytics or tracking tools, in the app or on thelistapp.ai, beyond the crash reports described above.
No selling, renting or trading of data.
No tracking across other companies' apps or websites.
We do not look at your lists except to fix a problem you report or to meet a legal obligation.

Who processes data for us

Supabase Inc.: database, anonymous accounts, sign-in and photo storage. Data is stored in Singapore (AWS ap-southeast-1).
Functional Software Inc. (Sentry): crash reports, stored in the European Union.
Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering family notifications.
Vercel Inc.: hosting thelistapp.ai, including wishlist pages for guests.
Anthropic PBC and Foursquare Labs Inc.: place search in the earlier web version at thelistapp.ai/login, only if you use it.
Google Fonts and unpkg: thelistapp.ai loads its fonts and a style sheet from them, so they see a visitor's IP address.
Apple and Google: app distribution, and maps, place search and speech on the phone as described above, under their own privacy policies.

Data may be processed outside the UAE. Where it is, we rely on our providers' contractual safeguards (including standard contractual clauses) as permitted by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the GDPR.

Legal basis

Family sharing, sign-in, photos, notifications and wishlist links: to provide the service you asked for.
Crash reports and abuse limits on wishlist links: our legitimate interest in keeping the app working and safe.
Location and microphone: your permission, which you can withdraw in your phone's settings.
The website waitlist: your consent, which you can withdraw by emailing us.

How long we keep it

On your phone: until you delete it, use Delete my data, or remove the app.
Shared family data: for as long as the family uses it. Items and lists you delete are removed from our database straight away, apart from their mention in the activity feed, which goes after 90 days. A photo on a deleted item can stay in storage, at its random address, until the whole family is deleted; email us to have it removed sooner.
Activity feed: 90 days.
Notification tokens: until you turn notifications off, delete your data, or the token stops working.
Guest details on wishlist links: as described above.
Crash reports: up to 90 days.
Our provider's database backups expire on their own cycle, within 30 days.

Deleting your data

In the app: open Family and settings and tap Delete my data. It works straight away, even offline; anything left on our servers is removed the next time you open the app with a connection. It deletes your account (including any Apple or Google sign-in), your profile, your own wishlists, your private items, your gift claims, your devices and everything on the phone. If nobody else in your family uses The List, all of the family's lists are deleted too, and so are its photos when you delete with a connection (otherwise email us and we will remove them). Lists you shared with family who still use the app stay with them, without your name on them.
Without the app: see https://thelistapp.ai/delete, or email [email protected] with your family's name. We delete your data within 30 days. Because accounts are anonymous, we may ask you to show the family code so we know the request is genuine.

Children

The List is rated 4+ and is made for families, run by the adults in them. A parent can add a profile for a child with a name, colour and emoji, so the child can have a wishlist or be given a job; the child does not need a phone or an account. Parents decide what goes on the family's lists and can remove a child's profile or delete everything at any time. We do not sell children's data, show them ads, or use their data for anything other than the family's lists. If you think a child has given us personal data without a parent, email us and we will delete it.

Your rights

Under the UAE PDPL and, where it applies, the GDPR, you can ask us to tell you what data we hold about you and give you a copy, correct it, delete it, restrict or object to how we use it, and move it to another service. You can withdraw a permission at any time in your phone's settings. Email [email protected] and we will reply within 30 days. If you are unhappy with our reply, you can complain to the UAE Data Office or, in the EU or UK, to your local data protection authority.

Security

All traffic between the app, the website and our servers is encrypted (HTTPS). Database rules let a phone read only the family it belongs to, hide gift claims from the wishlist owner, and keep guests' email addresses out of reach of the app and the website.

Changes

If we change this policy, we will update the date at the top and, for significant changes, tell you in the app before they take effect.

Contact

Lineage Technologies, Opus Tower, Business Bay, Dubai, United Arab Emirates. [email protected]