Privacy Policy

1. Who we are and what this policy covers

MariaList is provided under the name Iacob&Maria Apps (“we”, “us”, or “our”). This policy explains how personal data is handled in the MariaList Android app, including accounts, shared shopping lists, optional Google Drive backups, subscriptions, analytics, advertising, and support.

For privacy questions or requests, contact support@marialist.app.

This policy explains our data practices. Reading or accepting it does not, by itself, give consent to optional processing.

2. Information we process

Account information

When you create an account or sign in, we process your account identifier, email address, authentication information, and any profile name you provide. Google sign-in can also supply your profile name and photo. Firebase Authentication handles sign-in and account verification. Account records may also be stored in Cloud Firestore.

Shopping lists and shared-list information

MariaList stores lists and preferences on your device. When you share a list or join one, Cloud Firestore also stores the shared content so participants can use the same list. This includes list titles, item names, categories, notes, quantities, units, prices, checked status, ordering, and presentation settings.

For collaboration, we also process list and item identifiers, owner and member account identifiers, roles, membership status, invitation tokens, and creation and update times. Records can identify who created or last changed an item. Member records can include a display name and profile-photo address.

Optional backup information

If you authorize Google Drive backup or restore, MariaList transfers a copy of the app data included in the backup to or from your Google Drive. This is separate from shared-list synchronization. Authorization is requested through your Google account.

Usage, device, and diagnostic information

Google Analytics for Firebase processes app usage events, such as feature interactions, backup activity, and subscription-flow activity, together with technical information such as app version, device and operating-system information, language, and app-instance identifiers. Google services may also process device or advertising identifiers, depending on their configuration and your device settings.

Authentication and other service providers process connection and security information, such as IP addresses and technical logs, to operate their services and help prevent abuse.

Advertising information

MariaList includes Google AdMob. Its advertising services can process IP addresses, approximate location inferred from an IP address, app and ad interactions, diagnostic information, and device or advertising identifiers when available. This information is used to deliver and measure ads and detect invalid traffic. Non-personalized ads can still involve data processing.

Subscription and purchase information

Google Play processes Android purchases. We use RevenueCat to check, restore, and manage access to paid features. This involves an app user identifier, purchase tokens or transaction references, purchased products, subscription status and dates, and technical device information. A RevenueCat identifier can be linked to your MariaList account. We do not receive your full payment-card details from Google Play.

Support correspondence

If you contact us, we receive your email address, message, and anything you choose to include, such as screenshots, device details, or an app version. Please avoid sending passwords or unnecessary sensitive information.

3. How shared lists affect your privacy

Sharing a list makes its contents available to the people who join it. Members can view the shared items and, according to their role, make changes that are synchronized to other participants. Profile information associated with membership may also be available to other members.

An active invitation link can be forwarded. Someone who receives it may be able to sign in and join the list, so share links only with people you intend to invite. Do not place information in a shared list that you do not want its participants to see.

Owners can use the sharing controls to remove members or stop sharing, and members can leave a joined list. Leaving a list does not automatically remove the items or changes you contributed to it. Stopping sharing deactivates sharing and its invitation; it is not the same as permanently erasing all stored records.

Participants may retain information they already viewed, copied, exported, or captured in a screenshot. MariaList cannot recall copies held independently by other people.

4. Why we process information

We use information to run accounts, provide lists and collaboration, carry out requested backups and restores, manage subscriptions, answer support requests, understand feature use, and protect the service.

Where European data-protection law applies, the relevant grounds depend on the purpose:

• Providing the service you request: processing necessary to perform our agreement with you, including account access, shared lists, requested backups, and paid features.
• Security and support: our legitimate interests in keeping the service reliable, preventing abuse, and responding to enquiries, where those interests are not overridden by your rights.
• Legal obligations: processing necessary to meet applicable legal requirements, including handling valid privacy requests and required transaction records.
• Consent: where required for optional analytics, advertising personalization, or access to information on your device. Consent must be specific and separate from acceptance of this policy.

Account details are needed for account-based features, and shared-list content must be processed in the cloud for collaboration to work. You can choose not to use these features.

5. Who receives information

• People in your shared lists: the list content and collaboration information described above.
• Google and Firebase: authentication, cloud storage and synchronization, Google Drive backup when authorized, analytics, advertising, and Google Play purchases, as applicable.
• RevenueCat: account-linked identifiers, purchase and subscription information, and technical information needed to manage paid access.
• Service providers supporting communications: information needed to deliver and handle messages you send to support.
• Authorities or other recipients when legally necessary: information required by a valid legal obligation or necessary to establish, exercise, or defend legal claims.

Providers may process data on our behalf, or for their own purposes under their applicable terms and privacy notices. Further information is available in Google’s Privacy Policy, Firebase’s privacy information, and RevenueCat’s privacy information.

6. Storage and security

Local app data is stored on your device. Account and shared-list data is processed through Firebase services. Shared lists may also be cached locally to support use of the app. Google Drive backups remain in the Google account you authorized.

Our service providers offer safeguards such as encrypted network connections and access controls. Google Drive encrypts stored files and transfers, but MariaList does not add its own end-to-end encryption to the backup files. Shared lists are also not end-to-end encrypted by MariaList.

No online service or device can be guaranteed completely secure. Keep your device and Google account protected, and take care when distributing invitation links or sharing backup files.

7. International processing

Google, Firebase, RevenueCat, and their service providers may process information outside your country, including in the United States. A regional database location does not mean every authentication, support, analytics, or subscription operation remains in that region.

The providers’ data-processing terms describe the safeguards they make available for regulated international transfers, including standard contractual clauses where applicable. See the Firebase data-processing terms and RevenueCat Data Processing Addendum. Contact us to ask about the safeguards relevant to your data.

8. Retention and deletion

Different data has different storage lifecycles. We consider whether it is needed to provide an active service, resolve a support request or dispute, protect the service, or meet a legal obligation when determining retention.

• Device data: managed through the app and Android’s app-storage controls. Removing local data does not itself erase a cloud account, shared list, or Google Drive backup.
• Shared-list records: removing an item from view can mark it as deleted without immediately erasing the stored record. Stopped lists and disabled invitations can remain in cloud storage. Contact us to request erasure of personal data.
• Google Drive backups: remain in your Drive until you delete them or they are otherwise removed under Google’s controls. Revoking MariaList’s authorization does not by itself delete an existing backup.
• Accounts, support, diagnostics, and subscriptions: retention depends on the purpose and relevant provider settings and legal requirements. Some transaction or security records may need to remain after a deletion request.

To request deletion of your MariaList account and associated personal data, follow our account deletion guide or email support@marialist.app. You can make this request without reinstalling or signing in to the app. Include the account email address and describe the data concerned; do not send your password. We may need proportionate information to verify the request.

Signing out, uninstalling the app, leaving a shared list, or cancelling a subscription are separate actions from requesting account deletion. Manage any ongoing subscription through Google Play. Where data must be retained or a request cannot be fully fulfilled, we will explain the applicable reason.

9. Your choices and rights

You can choose whether to share or join lists, authorize Google Drive access, or make a purchase. Google-account settings let you manage connected-app access, and Android settings provide controls for app permissions and advertising identifiers. These device controls do not necessarily stop every kind of analytics or diagnostic processing.

Depending on applicable law, you may request access to your personal data, correction, deletion, restriction of processing, or a portable copy of data.

Right to object: where processing is based on legitimate interests, you may object on grounds relating to your situation. You may object to processing for direct marketing at any time.

Withdrawing consent: where processing is based on consent, you may withdraw it. This does not affect processing lawfully carried out before withdrawal. Contact us if you need help exercising this right.

Send requests to support@marialist.app. We respond within the time limits required by applicable law. You may also complain to your local data-protection authority, including in the EEA country where you live, work, or believe an infringement occurred.

10. Changes and contact

We may update this policy as the app or our data practices change. The current version will remain available at /privacy-policy, with its revision date shown above. For material changes, we will provide additional notice where required and obtain consent where required.