Privacy Policy

1. Who is responsible

The controller responsible for RushList is:

Sebastian Ottow
Appventurer
Aushofener Straße 7
84571 Reischach
Germany

For privacy questions, access requests, or deletion requests, email info@rushlistapp.com.

This policy covers the RushList app, this website, shared-list invitations, and support communications.

2. Information used by RushList

• List content: task titles, categories, dates, expiration settings, completion status, history, progress statistics, and app preferences.
• Shared-list information: list names, items, membership roles, account identifiers, invitation codes, and creation or update timestamps. Members can see content in a list they have joined.
• Account information: identifiers and authentication tokens needed for Sign in with Apple and the shared-list service. Apple may also provide a name or email address, including a private relay address, depending on what you choose to share. RushList does not receive your Apple password.
• Subscription information: product, transaction, and entitlement information supplied through Apple's purchase systems. Your payment-card details are handled by Apple, not entered into RushList.
• Support and feedback: the messages and optional name or rating you send, your email address if you contact us by email, and any app or device details included in your message. The current app feedback flow opens your mail app. If a version uses an in-app submission service, the submitted fields and technical request details are processed by that service.
• Technical requests: website and service providers process request details such as IP address, browser or device information, request time, and requested resource to deliver and protect their services. An invitation URL includes the invitation code.
• Shopping recognition: shopping item text (including notes within the title), language/locale, normalized hashed lookup keys, generic product names, store sections, personal category corrections, and classification-job status. Supabase authenticates catalog requests using your account. A hash is a lookup identifier, not a guarantee of anonymity.

Shared history and analytics. For shared lists, we keep completed and expired item history, category, event time, and the member account associated with the action. Current list members can view the history and compare their own completion counts with counts from other members. Counts are calculated from recorded events; this feature does not send activity history to an AI provider.

Anonymous app usage analytics. RushList uses TelemetryDeck to count sessions, onboarding steps, screen visits and broad time-on-screen ranges, item actions by category, private/shared feature use, sorting and filter choices, settings changes, purchase/restore outcomes, and observed subscription revenue. Revenue events include the monthly/annual plan, original currency and verified transaction amount, UTC event day, and observed free trials, renewals, refunds and refund reversals. Events include app/build version and technical device, operating-system and language information. A randomly generated installation identifier is hashed by the SDK and further processed by TelemetryDeck; it is not your Apple or Supabase account identifier. We do not send item or list text, notes, search queries, names, emails, account/list/invitation identifiers, purchase receipts, transaction identifiers, or raw error messages to TelemetryDeck. These usage measurements are separate from the History and Analytics features within your shared lists.

3. Why information is processed

We process information to provide the features you request: keeping lists, authenticating shared-list members, delivering invitations and synchronization, checking subscription access, responding to support, and maintaining a reliable service.

Where the GDPR applies, processing necessary to provide requested app and account services is based on performance of our contract with you (Article 6(1)(b)). Necessary service security and ordinary support administration rely on legitimate interests (Article 6(1)(f)); those interests are operating, protecting, and improving the service. Records required by law are processed to meet a legal obligation (Article 6(1)(c)). Where a separate activity requires consent, we ask for it and you may withdraw it for future processing. Device notification permissions can be changed in iOS settings.

We do not use your task content for advertising or make decisions with legal or similarly significant effects about you through automated profiling.

Optional cloud shopping recognition. We ask for your permission before sending unfamiliar shopping text for cloud recognition. Where the GDPR applies, this optional transfer and recognition, including reuse of generic classification results, rely on your consent (Article 6(1)(a)). You can withdraw it for future requests in your profile without affecting earlier lawful processing. Downloading existing catalog entries does not send your shopping titles; ordinary authenticated catalog delivery is part of the service. Sorting does not make decisions with legal or similarly significant effects about you.

Improving RushList. Anonymous usage measurements help us find onboarding drop-off, understand feature adoption and purchase flow problems, and improve usability and reliability. We do not use them for advertising, cross-company tracking, or linking usage to your account. Usage sharing is enabled by default and can be switched off in Profile independently of AI shopping recognition. We use data that is anonymous in the hands of the analytics provider; where limited processing of personal data is involved in delivering this service, our purpose and legitimate interest are improving app usability (Article 6(1)(f) GDPR). You may object by turning usage sharing off or contacting us.

Observed subscription revenue. We use transaction amounts and lifecycle events from Apple StoreKit to estimate customer-price revenue and understand trial conversion. This uses TelemetryDeck directly, without RevenueCat. It is controlled by the same usage-sharing setting. These app-observed figures are not authoritative financial reports and can miss events while sharing is off or the app is not reopened; App Store Connect remains the financial source of truth.

4. Where information goes

Your device and Apple. Private-list content, history, preferences, and statistics use Apple's local storage systems. Where iCloud synchronization is available and enabled, Apple also processes the synchronized information under your Apple Account settings and its own terms. We do not have access to your personal iCloud account.

Supabase. Optional shared-list and account services process shared content, membership and invitation records, authentication information, and related technical requests. Sharing is not end-to-end encrypted between list members; do not treat a shared list as a confidential vault.

Shopping catalog and OpenAI. Signed-in installations download the shared Supabase catalog and retain entries locally for offline use. New installations download it in pages; later sessions request changes. Local and cached matches are used first. If you enable cloud recognition, an uncached shopping title, language/locale, and hashed lookup key are sent to Supabase. Supabase checks the shared catalog again and sends unresolved inputs to the OpenAI API for store-section classification. OpenAI receives the item text, language/locale, and lookup key, without your account ID, list ID, or authentication token. This can include shopping items in your private list, even if you do not share that list. Do not put sensitive information or unnecessary personal details in shopping titles.

The reusable catalog contains generic product names, language/locale, store sections, hashed lookup keys, and cache metadata. Catalog downloads do not include the original job input field, requesting account, or list membership. Generic results are reused across RushList installations to reduce repeated AI calls. Personal category corrections are stored separately for your account; an explicit section on a shared-list item is visible to that list's members.

OpenAI API inputs are not used for model training by default. We send classification requests with response storage disabled (store: false); this does not disable OpenAI's abuse-monitoring retention, which is normally up to 30 days, subject to legal and safety exceptions. See OpenAI API data controls and OpenAI Privacy.

Other list members. People who join a shared list can see and, according to their role, change its content. Someone who receives a valid invite may be able to join. Share invitations only with intended recipients. Members can retain content they have already seen or copied.

Vercel. This website and its invitation landing pages are delivered through Vercel, which processes the technical requests needed for hosting and security.

Email and required disclosures. Contacting us by email involves your and our email providers. Information may also be disclosed when required by applicable law or necessary to handle legal claims. We do not sell personal data.

The Supabase database for this feature is hosted in Frankfurt, Germany. OpenAI and other provider processing is not necessarily confined to that region. Apple, Supabase, OpenAI, Vercel, and email providers operate internationally, so processing can take place outside your country. Their applicable privacy and data-processing terms describe the locations and transfer safeguards they use. You can contact us for information about the providers and safeguards relevant to your request. See Apple Privacy, Supabase Privacy, and Vercel Privacy.

TelemetryDeck. Anonymous app usage events are sent to TelemetryDeck GmbH, Germany. TelemetryDeck documents its anonymization of identifiers and states that it does not retain IP addresses. Its analytics infrastructure is hosted in Germany. We use an installation-only random identifier, not an email or account identifier. See TelemetryDeck privacy information and TelemetryDeck Privacy.

5. Retention and deletion

Local tasks, history, and settings remain until you remove them or clear the app's data. Expiring a task moves it out of the active list; it is not a promise that every history entry, server record, or backup is erased at that moment. iCloud data and device backups are also subject to your Apple settings and Apple's retention processes.

Shared-list and account records are kept while needed to provide your shared lists and access, then deleted or de-identified when no longer needed, subject to applicable recordkeeping obligations and the handling of deletion requests. Security records are retained only for the period needed to operate and investigate the service. Support correspondence is retained as needed to resolve the request and meet relevant obligations. Provider backup and log copies can follow separate retention cycles.

The app's current Delete Account control clears local app records and saved sign-in information. It does not itself guarantee deletion of the Supabase account, shared lists, all cloud records, or other members' copies. Email info@rushlistapp.com to request server-side account or content deletion. Tell us enough to identify the account, but do not send passwords or invitation codes. We may need to verify your identity and explain any records that must be retained.

Deleting app data or requesting account deletion does not cancel an Apple subscription. Cancel it separately through your Apple Account.

Shopping recognition records. The local catalog, queued requests, and recognition preference persist across app restarts until removed with the app's stored data. Supabase clears the original classification-job input after successful classification. Finished and failed job records older than seven days are removed by scheduled maintenance; unsuccessful input can remain until that cleanup. Operational failures can delay maintenance. Confirmed generic shared catalog categories have no routine expiry and are retained for reuse; newer corrections can replace them. Unresolved classifications can be retried after one day. These retry rules are not a promise that database entries are erased at that time. Personal corrections remain associated with your account until reset or removed through a data-deletion request. Turning cloud recognition off stops new classification submissions from that installation; requests already submitted can finish. Provider logs and backups follow their applicable retention processes.

Completing a shared item removes it from the active list but retains its shared history and contribution record for the list's History and Analytics features. Shared activity is retained while needed for the list service, subject to deletion requests and applicable obligations. Deleting private device history does not erase shared-list activity or other members' copies. The app can keep account-separated copies of downloaded shared history and counts locally for offline viewing; those copies persist across restarts until removed with app data or refreshed. Contact us about removal of shared activity using the deletion process above.

Usage analytics. The app can queue a limited number of usage events on-device during a lost connection and retry later. The usage preference and installation identifier persist locally. Turning sharing off stops new analytics events and cancels uploads from the installation; previously sent anonymous events cannot be recalled or reliably identified by account. Previously queued events may be retried if you turn sharing back on. Anonymous analytics are retained while useful for measuring and improving RushList, subject to TelemetryDeck's retention and service terms. No analytics events include the content of your lists.

Revenue deduplication. The app retains installation-local hashes of transaction/subscription identifiers, original amounts/currencies, and reporting/refund state to reduce duplicate revenue events. These hashes and transaction identifiers are not sent to TelemetryDeck. The local ledger persists until app data is removed. Re-enabling usage sharing does not backfill transactions that occurred while it was off. Revenue measurements already sent follow the anonymous analytics retention described above.

6. Your choices and rights

You can decide whether to use shared lists, choose what to put in them, change notification permissions, manage Apple/iCloud settings, and manage subscriptions in your Apple Account. Information needed for shared-list authentication and synchronization is required to provide those features; you can use your separate private list without joining a shared list.

Where applicable, you may request access, correction, deletion, restriction, or a portable copy of your personal information. You may object to processing based on legitimate interests and withdraw consent for an activity based on consent. These rights depend on the circumstances. Contact info@rushlistapp.com; GDPR requests are generally answered within one month, with permitted extensions explained when relevant. You may also complain to your local data-protection authority.

Your cloud recognition choice. AI recognition is off until you enable “AI shopping recognition” in your profile and confirm the short explanation. Choose “Not now” to leave it off, or turn it off again in your profile to stop new AI recognition submissions from that installation. Local recognition, manual section choices, downloaded categories, A–Z/Z–A sorting, and ordinary shared-list synchronization remain available. Permission is stored on the installation and is not automatically granted on a new device. Shared-list synchronization still sends shared-list content to Supabase as explained above.

Usage sharing. Open Profile → Help improve RushList → Share anonymous usage data to stop or resume analytics. This does not change AI shopping recognition, notifications, subscriptions, shared-list synchronization, or your in-app progress statistics.

7. Website cookies and external links

This version of the website does not set marketing or analytics cookies and does not include advertising pixels, embedded social feeds, or third-party font requests. Hosting providers still process the technical requests needed to serve the site. Following an App Store or other external link brings you to that provider's service and privacy practices.

App screens on this website use fictional demonstration content. They do not display a customer's private lists.

8. Children and sensitive information

RushList is a general-purpose productivity tool, not a service directed at children. Where a child cannot lawfully consent to account or data processing, a parent or guardian should contact us before account-backed use. If you believe a child has supplied personal information that should not be processed, contact us. Do not use shared lists to store passwords, financial credentials, or sensitive information you do not intend to make available to other members.

9. Policy changes and contact

We update this policy when the app's data handling or service providers change. The date at the top identifies this version. Material changes will be communicated through appropriate app or website notices where required. For questions or requests, contact Sebastian Ottow at info@rushlistapp.com.