myList Privacy Policy
Last updated: 31 July 2026
This policy explains what personal data the myList mobile app and its backend
service collect, why we collect it, who we share it with, and how you can have
it deleted. It applies to the Android app com.gudi_stolyarov.mylist
and to the service at gudik-app.space.
The data controller is Denis Stolyarov. You can reach us at gudistolyarov@gmail.com.
What we collect and why
| Data | Why we need it | Required? |
|---|---|---|
| Name and email address | To create and manage your account, sign you in, and send account-related emails such as verification and password reset codes. | Required |
| Password (stored only as a cryptographic hash) | To sign you in. We never store your password in a readable form and cannot recover it. | Required for email sign-in |
| Google account identifier | To sign you in with Google. We receive your name, email address and a stable account identifier — nothing else from your Google account. | Required for Google sign-in |
| Your content: shopping lists, products, templates, contacts | This is the content of the app itself. It is stored so that it is available across your devices and to people you share a list with. | Optional |
| Text recognised from voice input | To turn what you say into products on your list. See “Voice input” below. | Optional |
| Purchase and subscription data | To give you access to Premium features and to verify that a purchase is valid. We store product identifiers, purchase tokens and status — never your payment card details. | Required if you subscribe |
We do not collect your location, your contacts from the device, your device identifiers for advertising, or any analytics about how you use the app. The app contains no advertising and no advertising SDKs.
Voice input
Voice input is a Premium feature and is entirely optional. Speech is converted to text by your device or by the speech recognition service built into your operating system — we never receive or store an audio recording.
The resulting text is sent to OpenRouter, a third-party service that routes it to a large language model, which identifies the products you named. We send only the text itself and no information identifying you. We keep a copy of the text and the model’s response in our own logs so we can investigate problems with recognition; these logs are deleted together with your account.
Who else receives your data
- Google — if you choose to sign in with Google, and for processing purchases through Google Play Billing.
- OpenRouter — receives text from voice input only, as described above.
- Our email provider — receives your email address in order to deliver verification, password reset and account deletion messages.
- Our hosting provider — stores the database on our behalf.
We do not sell your data, and we do not share it with advertisers or data brokers.
Sharing lists with other users
If you share a shopping list with another person, that person can see the list, its contents and the name under which you are registered. If you delete your account, lists you own are deleted for everyone; lists owned by someone else remain with their owner, and you are simply removed from them.
How long we keep your data
We keep your data for as long as your account exists. When you delete your account, it is removed immediately and permanently, not archived.
One exception: to prevent the same person from claiming the free trial repeatedly, we keep a one-way cryptographic hash of your email address after deletion. A hash cannot be turned back into an email address and is not linked to any other data — it only lets us tell that some mailbox has already used its trial.
Deleting your account and data
You can delete your account and all associated data at any time:
- In the app — open Profile and tap Delete account.
- On the web — use https://gudik-app.space/account/delete, which works even if you have already uninstalled the app. For your protection, we email you a confirmation link, so only the owner of the mailbox can delete the account.
Deleting your account does not cancel a subscription bought through Google Play. Cancel it in your Google Play account settings, or billing will continue.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict its processing, and to complain to your local data protection authority. Deletion is available directly in the app and on the web as described above. For anything else, write to gudistolyarov@gmail.com and we will respond within 30 days.
Security
All traffic between the app and our servers is encrypted with HTTPS. Passwords are stored as bcrypt hashes, and verification and deletion codes are stored hashed and expire quickly. No system is perfectly secure, but we take reasonable measures to protect your data and limit who can access it.
Children
myList is not directed to children and is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update the date at the top of this page. Where the changes are significant, we will also notify you in the app.
Contact
Questions about this policy or about your data: gudistolyarov@gmail.com.