This policy explains what data the Liste de courses app (called Shopping List in English) and the listedecourse.devolim.fr website process, why, and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978 as amended.
In short. Your lists are stored on servers in Europe so they can be shared between your devices and your people. A profile (Google or Apple account, first name, username, avatar) is only required for sharing. When you talk to Sacha, the text of your request and the relevant content of your lists are sent to an artificial intelligence service, without your name or email address. No ads, no data sales, and usage statistics can be turned off in the settings. Payments go through Apple or Google.
1. Data controller
BAUGEY MATHEO, trading as DEVOLIM
248 rue de Bègles, 33800 Bordeaux, France
Company number (SIREN): 948 000 757
Email: contact.listedecourse@devolim.fr
Given the nature and scale of the processing carried out, appointing a data protection officer is not required under Article 37 GDPR. Any request relating to personal data may be sent to the address above.
2. Principles
- No advertising, no ad tracking, no advertising identifier requested.
- No sale, rental or transfer of data.
- The minimum: no postal address, phone number, location, phone contacts or photos.
- Temporary lists, erased automatically when they expire.
- Artificial intelligence behind our servers: the app never calls the AI service directly, no key is embedded in it, and your name, username and email address are not sent to it.
- A closed directory: nobody can browse the list of users; you find someone only by knowing their exact username.
3. Data processed
3.1 Data kept on your device
Stay on your phone and are not sent to us: your display settings (handwriting, watched aisles, statistics choice), recently typed items for autocomplete, scheduled reminders (shopping day, expiry), which are local notifications. The microphone is used for dictation: your phone's dictation service (Apple or Google) turns your voice into text under its own terms; the app only receives and keeps the text, never the recording. The camera is only used to read a QR code: no image is saved or sent.
3.2 Data transmitted
- Technical identifier: a random identifier created on first launch, to link your lists to your installation.
- Profile (if you create one): the identifier and email address provided by Google or Apple at sign-in (Apple may provide a relay address), your first name, username, avatar and language.
- Lists: list names, items, quantities, notes, who added each item, planned shopping day, members, the list's activity log.
- Contacts: requests sent and received, contacts, blocked people, reports.
- Tracked products (expiry mode): product name and chosen date.
- Requests to Sacha: the text of your request, the latest exchanges of the conversation and the relevant content of your lists (list names, items and quantities), the language, country and date are sent to our server functions, then to the AI service, to prepare the suggestion. Names of products missing from our catalogue are also sent to be sorted by aisle.
- Notifications: a device notification token, to let you know (contact request, added to a list, list about to be erased…).
- Messages sent from the app (problem, idea, rating): the message, the rating, the app and system versions, the language.
- Usage and stability: usage statistics without name or address (can be turned off in the settings), crash reports, app and device integrity attestation (to block fraudulent clients), assistance usage counters.
- Subscription: subscription status and history, linked to the technical identifier.
4. Legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: storing and syncing lists, sharing with contacts, notifications, Sacha's assistance, product tracking | Performance of the contract (Article 6(1)(b) GDPR) |
| Security: app integrity, abuse and fraud prevention, blocking and reports, usage limits, crash reports | Legitimate interest (Article 6(1)(f)): protecting the service and its users |
| Usage statistics to improve the app | Legitimate interest (Article 6(1)(f)), with the right to object at any time in the settings |
| Managing subscriptions and keeping accounts | Performance of the contract and legal obligation (Article 6(1)(c)) |
5. Recipients and processors
| Provider | Role | Data concerned |
|---|---|---|
| Google Ireland Ltd — Firebase | Database hosting (European Union), server functions (Belgium), sign-in, notifications, statistics, crash reports, App Check, remote configuration | Identifier, profile, lists, contacts, tracked products, notification tokens, statistics and technical reports |
| OpenAI, L.L.C. (United States) | Artificial intelligence service used by Sacha and to sort items, called only from our servers | Request text (never audio), conversation excerpts, list names, items and quantities, language, country — no name, username, email address or identifier |
| RevenueCat, Inc. (United States) | Tracking subscriptions purchased on the App Store and Google Play | Technical identifier, purchases and subscription status |
| Apple Inc. and Google LLC | “Sign in with Apple / Google”, payment, the phone's voice dictation | Under their own policies, as separate controllers |
| LWS (France) | Website hosting | Technical visit logs (IP address, page, date) |
No data is sold, rented or otherwise transferred to third parties for commercial purposes.
6. Transfers outside the European Union
The database and server functions are located in the European Union. Some processing involves a transfer to the United States: the AI service (OpenAI), subscription tracking (RevenueCat) and, in part, Google's Firebase services (statistics, crash reports, sign-in). These transfers are covered by the adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for certified companies, and by the European Commission's standard contractual clauses. The text sent to the AI service contains neither your name, nor your username, nor your email address; OpenAI undertakes not to use it to train its models and keeps it for at most thirty days for abuse monitoring.
7. Retention periods
| Data | Period |
|---|---|
| Lists and their items, log, notes | Until the erasure date shown in the list's settings: 30 days (free plan) or 90 days (Premium) after the last activity or the planned shopping day; or until it is deleted. Purged every night |
| Profile, contacts, blocked people | Until the account is deleted |
| Unanswered contact requests and invitations | 30 days |
| Tracked products (expiry) | 30 days after the chosen date, or until you remove them |
| Usage counters, technical security data | 7 days for technical data; counters until the account is deleted |
| Messages sent from the app | 1 year, and at the latest when the account is deleted |
| Reports | 1 year, and erased when the account is deleted |
| Usage statistics; crash reports | 14 months at most; 90 days |
| Subscription records | 10 years (accounting obligation, Article L.123-22 of the French Commercial Code) |
8. Subscriptions and purchases
Purchases are processed by Apple (App Store) or Google (Google Play). We receive neither your banking identity nor your payment details. RevenueCat receives proof of purchase and subscription status from the stores, linked to the app's technical identifier, to unlock Premium features.
9. Security
- Encrypted communications (TLS) between the app, our servers and our providers.
- Tested database access rules: each user only reads their own lists and those they are a member of; profiles are read one at a time, never as a list.
- Firebase App Check: only genuine versions of the app, on uncompromised devices, can reach the servers.
- No AI key in the app: everything goes through server functions that verify the user, limit usage and filter requests.
- Built-in blocking and reporting, automatic erasure of temporary data.
As no system is infallible, any data breach presenting a risk would be notified to the CNIL within 72 hours and, if the risk is high, to the people concerned (Articles 33 and 34 GDPR).
10. Website
This website sets no cookies, uses no audience measurement or tracking tools, and loads no third-party resources: fonts and images are served by our host. The host keeps technical logs (IP address, requested page, date) for security, for a limited period. The page opened by a contact's QR code reads the username from the address, only in your browser: nothing is sent.
11. Your rights
Under Articles 15 to 22 GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to give instructions concerning your data after your death (Article 85 of the French Data Protection Act). These rights can be exercised by email at contact.listedecourse@devolim.fr. We reply within one month, extendable by two further months for complex requests.
You can also act directly: change your first name, username and avatar in your profile, delete a list or an item, turn off usage statistics in the settings, and delete your account (see the Help page). To verify your identity, we may ask you to write from the address linked to your account.
12. Complaint to the CNIL
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.
13. Minors
The app is meant for family use. Creating a profile, which allows exchanges with other users, is reserved for people aged 15 and over, or younger people with the consent of a holder of parental authority (Article 45 of the French Data Protection Act). If you believe a child has given us data without such consent, write to us: it will be deleted.
14. Changes
This policy may be amended to reflect legal or technical developments. The last update date appears at the top of this page; substantial changes are notified within the app.
This is a translation provided for convenience. In the event of any discrepancy, the French version prevails.