Privacy Policy

What we process

ShoppingList.page stores list names, item names, quantities, completion state, and the synchronization history needed to share a list.

No account, email address, password, or personal profile is required for normal use. A random browser device ID helps synchronize changes and diagnose failures; it is not an account or authentication credential. Anyone with a valid sharing link may be able to access the list or household covered by that link, so only share links with people you trust.

Data kept on your device

Your browser may keep local copies of lists, recent-item autocomplete history, selected household and list state, sharing information, a random device identifier, preferences, and pending offline changes. These local records are separate from data that has already synchronized to the service, and clearing this site’s browser storage removes them.

Infrastructure and metadata

The service runs on Cloudflare Workers and Durable Objects. Cloudflare may process IP addresses, request metadata, and security signals to deliver and protect the service. Application logs use structured redaction and do not intentionally record full request URLs, sharing credentials, device IDs, item names, quantities, or operation payloads.

Households, recent-item autocomplete, and multilingual lists

A household groups shared lists and the access needed to switch between them. Household and list links, including QR codes, can provide access to the household or list they represent. People with access can make the changes supported by that scope. Names, list membership, list contents, completion state, and synchronization history are processed to provide the household and list features.

Cloudflare Turnstile checks the first household creation and further creations beyond the daily allowance for abuse. A hash of the IP address tracks successful creations over a rolling 24 hours. Verification tokens are used only for that check and are not stored by ShoppingList.page. Local lists remain usable while verification is pending or unavailable.

Autocomplete suggestions use recent item history stored in the browser. People can add items in different languages to the same list at the same time; browser language does not limit the words that can be added.

Contact messages

If you use the contact form, we store the message, the name and email address you choose to provide, the submission time, and its delivery status in the service database.

Cloudflare Turnstile checks the submission for abuse. Its verification token is used only for that check and is not stored by ShoppingList.page. Please do not include passwords, payment details, or other sensitive information in a contact message.

Product analytics

When enabled, Umami measures public page visits, app activity, and feature outcomes using the random browser device ID. Metadata includes browser language, screen size, app version, timestamps, and aggregate action properties. Referrers contain only an external hostname, and campaign attribution accepts only bounded source, medium, and campaign identifiers. Private app routes are grouped under one app path.

Analytics excludes list and item names, quantities, sharing credentials, arbitrary URL parameters, fragments, and error messages. Pending events are kept locally for retry. Browser Do Not Track disables collection. Clearing site storage removes the local analytics queue and device identifier.

Retention and deletion

Shared list data is automatically expired after 365 days without a change being saved to the shared service. Viewing a list does not reset this period; a successful edit does. After expiration, the shared list becomes read-only and its old link cannot be reactivated. Pending offline changes may remain on the device so they can be copied into a new list.

Security

We use reasonable technical measures to protect data handled by the service. No online service can guarantee absolute security.

Your choices

You can remove autocomplete history and other local data by clearing this site’s browser storage. Do not share a list or household link with anyone who should not have access. No account is required, but the service and its infrastructure may still process device identifiers, IP addresses, request metadata, list content, analytics events, and operational logs. Do not put sensitive personal information in a list.