WeeList privacy policy

WeeList is an app for creating, sharing, and managing collaborative lists, available on iPhone, Android, and the web (app.weelist.app), with its informational website weelist.app. The data controller is Miguel Ángel Chica Cámara. For any privacy questions or to exercise your rights, email soporte@weelist.app.

• Account data: name, username, and email address.
• Profile picture (avatar): the one you optionally upload or, if you sign in with Google, the photo from your Google account.
• User-generated content: lists, items (including their text), images attached to items, mentions, members, and invitations.
• Device push notification token (when notification permissions are granted).
• Error diagnostics: device model and operating system, app version, a random installation identifier, and the technical details of the failure. The approximate country and region are inferred from the connection, but the IP address is not stored. It does not include the content of your lists or your email, and you can turn it off in your Profile.
• Voice: when voice dictation is used, the microphone audio is processed by the system speech recognition service (Apple on iOS; the system speech service on Android), which may do so on the device itself or on its servers, depending on the model and settings. WeeList does not store or receive the audio, only the resulting text added to the lists.
• Platform, app version and language (iOS, Android, or web, the version number and the chosen language) associated with the account.
• Website weelist.app: anonymous, cookie-free visit statistics (page visited, referring site, language, screen size, and approximate country) that do not identify anyone.

• Creating and maintaining your account and session — basis: performance of the service you request.
• Enabling shared lists, invitations, and collaboration — basis: performance of the service.
• Sending notifications about activity on your lists — basis: consent (device notification permission).
• Sign-in with Google or Apple — basis: consent when you choose that method.
• Protecting the platform, preventing abuse, and resolving incidents — basis: legitimate interest in security and proper operation of the service.
• Emailing you about the service and the app (notices, updates and occasional requests for feedback) — basis: legitimate interest; you can object at any time.
• Providing support, knowing which platforms and app versions are in use, and how the website is visited — basis: legitimate interest in maintaining and improving the service.

WeeList relies on the following providers, who process data on behalf of the controller:

• Supabase — authentication, database, file storage (avatars and item images), and server functions. Hosts most of the service data, in the European Union (Stockholm, Sweden).
• Expo (Expo Application Services) — app builds and push notification service (Expo Push), which forwards alerts to the operating system platform.
• Google — Firebase Cloud Messaging (FCM) — technical delivery of push notifications on Android. Google Sign-In when you choose to sign in with Google.
• Apple — Sign in with Apple when you choose to sign in with Apple.
• Sentry (United States) — app error and stability diagnostics. It is on by default and you can turn it off in your Profile.
• Brevo — delivery of service emails (account confirmation, password recovery, address change) and occasional communications about the app.
• GoatCounter — anonymous, cookie-free visit statistics for the weelist.app website.
• GitHub — storage of the service's encrypted backups.

Some of these providers may process data outside the European Economic Area; in that case, safeguards provided by applicable law apply (e.g. standard contractual clauses).

Lists and items are shared with people the user invites. Each person is responsible for the content they publish. Within the app, WeeList offers the ability to report content and block other users so you no longer see their content. Reported content may be reviewed and removed, and accounts that violate the rules may be limited or suspended. Your name, username, and profile picture are visible to the people you share a list with. Item photos are stored at an unguessable address that only the list members receive; anyone with that address can open the photo.

We retain data while the account is active or as long as needed to provide the service, resolve incidents, or comply with legal obligations. Items you delete go to their list's trash and are permanently removed after 30 days. We make daily encrypted backups that are kept for 30 days: whatever is deleted also disappears from them within that period. Error diagnostics are kept by Sentry for the period of its plan, currently about 30 days. If you tell us why when deleting your account, that reason is stored without any data that identifies you. When you delete your account, the process described in the next section applies.

The app includes a Delete account option in the profile. When you delete your account:

• The authentication user and profile are removed.
• Memberships, push tokens, and owned lists with their associated content are removed.
• The avatar and storage files belonging to owned lists are removed.
• Items created by that person in lists owned by others may remain without an associated author to preserve the integrity of the shared list.
• What is deleted also disappears from the encrypted backups within 30 days at most.

The detailed process is described in data-deletion.html.

You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by emailing soporte@weelist.app, and withdraw your consent at any time (for example, by removing the notification permission or turning off diagnostics in your Profile). You also have the right to lodge a complaint with the competent supervisory authority (in Spain, the Spanish Data Protection Agency, www.aepd.es).

WeeList is not directed at minors below the minimum age required by applicable law. If we detect an account belonging to a minor without the required authorization, we will delete it.