Privacy Policy

Last updated: August 2026. This describes how ListLavish handles data across the web app and the mobile app. Please have legal counsel review before public launch.

What we collect

• Account: a user identifier and email address from Sign in with Apple or Google, used only to authenticate you and associate your lists with you.
• Your lists: the lists and items you create, and whether each item is checked off.
• Voice: when you use voice, audio is streamed for transcription and a spoken reply is generated. Audio is processed to fulfil your request and is not stored by us. We do not sell your data or use it for advertising.
• Preferences: theme, font, chosen assistant voice, and haptics setting.
• Usage counts: a per-day count of assistant requests, used solely to enforce the free-tier limit.

Storage in your browser

The web app stores your session token, your user id, and a cached copy of your preferences in your browser’s localStorage — not in cookies. We do not set advertising or tracking cookies. You can clear this at any time by signing out, or by clearing site data in your browser settings. (Our hosting providers may set strictly necessary cookies required to serve the site.)

Microphone

Voice features are optional. On the web, your browser asks for microphone permission the first time you use them, and audio is captured only while the microphone is actively engaged — you can see when it is on, and stop it at any time. On mobile, the same applies via the operating system’s permission prompt. You can use ListLavish entirely by typing.

Service providers

We share the minimum necessary with these processors to deliver the feature you asked for:

• Deepgram — converts your speech to text.
• Anthropic — interprets the transcribed request to manage your lists.
• ElevenLabs — generates the spoken reply from the reply text.
• Railway — hosts our backend and database.
• Vercel — hosts this website and the web app.
• Apple / Google — sign-in. Push notifications apply to the mobile app only; the web app does not send push notifications.

Where your data is held

Your account and lists are stored in a managed Postgres database operated by Railway. Processing by the providers above may occur in the United States.

Retention & deletion

Your lists and account data are kept until you delete them. You can delete your account and all associated data at any time:

• in the web app — Settings → Delete account;
• in the iOS app — Settings → Delete account;
• or via listlavish.com/delete-account.

Deletion removes your account record, lists, items, preferences, usage counters, and any push tokens. We may retain minimal records where required by law.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. You can exercise access and deletion directly in the app, or contact us at privacy@listlavish.com. We do not sell personal information.

Children

ListLavish is not directed to children under 13 (or under 16 where local law requires), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

If we make material changes we will update the date above and, where appropriate, notify you in the app before the change takes effect.

Contact

Questions: privacy@listlavish.com