Privacy Policy

Last updated: 14 September 2026

ShareLista is made by Asad Malik, an independent developer based in Pakistan. I'm the data controller for everything described here, and you can reach me at support@sharelista.com.

This policy covers the ShareLista web app at app.sharelista.com, the ShareLista iOS app, and this website.

The rest of this page is the detail.

1. What ShareLista stores

1.1 Your account

There are two ways to be in ShareLista, and they collect different things.

If you created the household (or later chose "Secure your account"), you signed in with Google or Apple. From that sign-in, Google/Apple gives the app:

• your email address
• your name, as your provider supplies it
• a provider user ID

This is held in Firebase Authentication, Google's managed sign-in service. ShareLista never sees or handles your Google or Apple password — the sign-in happens on Google's or Apple's own screen. If you use Sign in with Apple with "Hide My Email", we only ever receive Apple's private relay address, which is fine; everything works the same.

If you joined a household by scanning a QR code, you have an anonymous device account. That is a random identifier for your phone or browser. No email, no name from any provider, no password. Just the display name you typed in when you joined.

1.2 What you and your household put in

Everything the app is for:

• the household — its name, currency symbol, whether it's in full-tracker or shopping-list-only mode, and its current invite code
• members — display names, who is Admin, who is the Money Holder, when each person joined, and an optional avatar photo (see §3)
• expenses — amount, date, category, note, which member paid, whether it's a member's out-of-pocket spend or the money holder's
• item lines on itemized expenses — item name, quantity, price
• payments — reimbursement amounts, dates, notes, who recorded them
• shopping list items and, in list-only households, a price-free purchase log
• an item catalogue built from what you buy (item name, category, most recent price, how often you've bought it)
• recurring bills — label, amount or estimate, category, due day
• categories you create, and an activity feed of what changed in the household
• a monthly budget figure per month

Plain English: the app stores the things you type into it, and nothing else about you.

1.3 Technical data

• On your device: your household and member IDs and a few preferences in localStorage; your sign-in token in IndexedDB; a cached copy of your household's data so the app works offline. Clearing your browser data or deleting the app removes all of this from your device.
• On Google's servers: Google Cloud keeps standard operational logs for the services ShareLista runs on, which include IP addresses and request timestamps. These are Google's logs, retained under Google's policies. I don't run my own server, don't collect my own logs, and never see yours.
• Cookies: the app sets no tracking cookies; Firebase Authentication may set a cookie on the sign-in domain purely to complete a Google/Apple sign-in. This marketing website sets analytics cookies only after you accept the cookie banner — see §1.5.

1.4 What is never collected

For the avoidance of doubt, in the app and in your household data, ShareLista does not collect, request or receive: bank or card details · bank account connections · your location · your contacts or address book · advertising identifiers (IDFA/AAID) · browsing history · biometric data · your Google/Apple password · your phone number · analytics or behavioural event data · crash and performance telemetry from third-party SDKs. (The marketing website's consent-based analytics are described in §1.5.)

1.5 Marketing-site analytics (this website)

This marketing website — sharelista.com — uses two analytics tools so I can see which pages actually help people: Google Analytics 4 (aggregate page views and interactions, with IP anonymisation) and Microsoft Clarity (anonymised interaction analytics — heatmaps and session replays of on-page activity, with text and inputs masked by default). They set cookies and are provided by Google and Microsoft as processors under their own terms.

They load only if you click "Accept" on the cookie banner. Decline and no analytics scripts or cookies load at all — the site works exactly the same. Your choice is stored on your device; clear your browser storage to be asked again.

This applies to the website only. It is completely separate from the app: the ShareLista app and your household data carry no analytics, no Clarity, and no third-party trackers.

2. The camera

The app asks for camera access for exactly one thing: reading the QR code that lets you join a household.

The camera preview is processed on your device to decode the code. No frame is uploaded, transmitted or stored — not to me, not to Google, not anywhere. Decline the permission and everything else in the app still works; you just can't scan an invite.

3. Photos and avatars

If you set a profile picture, the image is processed entirely on your device before it is saved. The app:

• crops it square and scales it to 256×256,
• re-encodes it, which strips EXIF metadata — including any GPS location the photo was carrying,
• saves the result as a small image (typically 4–25 KB) on your member record.

Only the small, stripped version is ever stored. The original photo never leaves your device. Your avatar is visible to the other members of your household. "Remove photo" deletes it.

4. Who can see your data

Your household can. This is the part worth reading twice, because it's the thing people get wrong about shared apps.

Every expense, note, shopping item, price and payment you record is visible to every approved member of your household. That is the entire purpose of the app — but it means anything you'd rather your household didn't see shouldn't go in the note field.

No one else can. Access is enforced by Firestore security rules on Google's servers, not just hidden in the app's interface: a request for another household's data is rejected at the database, whoever makes it. New members can only get in by scanning a current invite code and being approved by your Admin or Money Holder.

I can't, in practice. As the developer I have administrative access to the Firebase project, which technically means I could look at the database. I don't, and I have no reason to. I never read household data except where you've asked me to look at a specific problem and given me permission to.

5. Who processes data on my behalf

ShareLista has no servers of its own. It runs on:

Data is stored in Google Cloud's asia-south1 (Mumbai) region. Google acts as a data processor under its Cloud Data Processing Addendum, and international transfers rely on the Standard Contractual Clauses in that addendum.

For your household data, there are no other third parties — no advertising network, no marketing tool, no CDN beyond Google's, no data broker. The only third parties anywhere are the analytics tools on this marketing website (Google Analytics and Microsoft Clarity), which load only with your consent and never receive your household data — see §1.5.

6. Why I'm allowed to hold it (GDPR legal bases)

If you're in the UK or EEA:

• Performance of a contract — storing your household's expenses, list and balances is the service you asked for. Without it there is no app.
• Legitimate interests — keeping the service secure and working, and preventing abuse of invite codes.
• Consent — camera access and photo library access. You grant these at the OS prompt and can withdraw them any time in your device settings.

There is no processing for marketing or profiling, so no consent is sought for it.

7. How long it's kept

• Household data stays as long as the household exists. It's your ledger; deleting last year's expenses on a schedule would defeat the point.
• When a member leaves or is removed, their record is deactivated rather than erased, so past expenses and settled balances don't become orphaned and the household's history stays correct. Their display name remains attached to the expenses they logged. If you want your name fully erased from a household's history, email me — see §8.
• Deleting your account removes your sign-in account immediately (§8).
• Device data is gone as soon as you delete the app or clear your browser storage.

8. Your rights, and how to actually use them

You have the right to access, correct, delete, export and restrict your data, to object to processing, and to complain to a data protection authority. Here's how each works in practice:

I'll respond to any request within 30 days, and usually a lot sooner.

If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect, to request its deletion, and to non-discrimination for exercising your rights. We do not sell or share your personal information, and we do not offer financial incentives for it.

One honest caveat on deletion: ShareLista is a shared ledger. If you delete your account but your household continues, the expenses you logged stay in that household's records — otherwise everyone else's balances and monthly totals would silently become wrong. If you want those records gone too, ask, and either you or the Admin can delete them, or I will.

9. Security

• Everything travels over HTTPS/TLS, and is encrypted at rest on Google's infrastructure.
• Access is enforced by Firestore security rules at the database, scoped to household membership. Every collection has explicit rules; there is no catch-all.
• There is no password to steal. Sign-in is delegated entirely to Google and Apple.
• Joining requires a current invite code plus approval by your Admin or Money Holder. Invite codes can be rotated at any time from Settings, which instantly invalidates the old one.
• The app ships no third-party JavaScript SDKs beyond Google's Firebase client. Fewer dependencies, fewer ways in.

No system is perfect. If you find a security problem, please email support@sharelista.com rather than posting it — I'll take it seriously and credit you if you'd like.

10. Children

ShareLista isn't directed at children and I don't knowingly collect data from anyone under 13 (under 16 where local law sets that bar).

A household is a family, so a parent may well add a child as a member. If you do, that's your decision as their parent — and please add them by first name only. Don't put a child's school, address, or anything else identifying into a display name or note field.

If you believe a child has set up an account independently, email me and I'll remove it.

11. Changes to this policy, and about money

I'll update this page when the app changes, and the "Last updated" date at the top will move. Anything that materially changes how your data is handled will be announced in the app before it takes effect, not slipped in quietly.

On ads and paid features, plainly: ShareLista is free today and has no advertising and no analytics. If it ever grows past what it costs to run for free, there may one day be a paid option. If that happens, I'll say so clearly and in advance. What will not happen is your household's data being sold, shared with data brokers, or used to target advertising at you.

12. Contact

See also our Terms of Service and how to delete your account.