EZlist Privacy Policy
EZlist ("EZlist", "we", "us") is operated by Nifty Inc. This Privacy Policy explains what information the EZlist apps for iOS and Android, and the web app at app.ezlist.store, collect and how we use it. By using EZlist you agree to this policy.
Information we collect
We only collect what we need to run a shopping‑list app:
- Account information. Your email address, and an optional display name. If you create a password, it is stored only as a salted hash — we never store or see your actual password. If you use Sign in with Google or Sign in with Apple, we receive the email address and name you authorize through that provider (Apple may give us a private relay email); we do not receive your Google/Apple password.
- Your content. The shopping lists you create — list names, item names, quantities (free‑form text you type), and whether items are checked off — and, when you share a list, the email addresses of the people you invite.
- Notification token. If you turn on push notifications, we store a push token for your device so we can deliver list and invite notifications. You can turn notifications off at any time in your device settings.
- Technical and log data. Standard server logs such as IP address, request metadata, and timestamps, used for security, debugging, and to detect and investigate abuse, fraud, or automated activity. These logs are retained for a limited period (see “Data retention and deletion”) and are not stored in your account.
EZlist currently does not display third‑party advertising, use third‑party advertising or analytics trackers, or request your device's advertising identifier. We do use error‑ and crash‑diagnostics tooling (see the subprocessors list under "How information is shared") solely to detect and fix problems; it is configured to exclude personal data. Our data practices may change as EZlist evolves (for example, if we introduce advertising or new features) — see "Changes to this policy" below.
How we use your information
- Provide the service: authenticate you, store your lists, and sync them across your devices and the web.
- Enable sharing: deliver invitations and let collaborators view and edit a shared list.
- Send transactional emails: email verification, password reset, and share invitations (via our email provider). We do not send marketing emails.
- Send push notifications you have opted into.
- Keep EZlist secure and reliable.
How information is shared
- With people you share lists with. When you invite a collaborator, they can see that list's contents and that you own or share it; the invitee's email is used to send the invitation.
-
With service providers (subprocessors) that operate EZlist on our behalf:
- Amazon Web Services — application hosting, transactional email (SES), and logging (United States).
- Supabase — managed PostgreSQL database (United States).
- Google Firebase Hosting — serves the web app.
- Expo — delivers push notifications.
- Sentry — application error and crash diagnostics (United States). We configure it to exclude personal data (no IP addresses or account details); it receives technical error reports to help us fix problems.
- Google and Apple — only when you choose Sign in with Google / Apple, to verify your identity.
- Business transfers. If EZlist or Nifty Inc is involved in or evaluating a merger, acquisition, investment, financing, reorganization, bankruptcy, or a sale or transfer of some or all of our assets or business, your information may be disclosed or transferred to the parties involved as part of that transaction. We will notify you of any change in ownership or in how your information is used.
- For legal reasons. We may disclose information if required by law or to protect the rights, safety, and security of our users or EZlist.
We do not currently share your personal information for purposes other than those described in this policy.
Data retention and deletion
We keep your information while your account is active. You can edit or delete any list at any time in the app; deleting a list permanently removes its items and catalog. You can permanently delete your account and all associated data at any time in the app — go to Account → Delete account (also available in the web app). Deletion is immediate and irreversible. You may also email support@ezlist.store to request deletion.
Server logs. Technical logs (including IP address and request metadata) are kept for a short operational window — up to 90 days — and then automatically deleted. They are used only for security, debugging, and abuse investigation, and are separate from your account data (deleting your account does not depend on them).
Cookies and diagnostics
EZlist uses a small amount of essential browser storage to keep you signed in and to remember preferences such as your chosen language. This is required for the app to function and is always on.
With your consent, we also collect anonymous diagnostics via Sentry to detect crashes and fix bugs. On the web we ask for your choice on your first visit and do not collect any diagnostics until you accept — the app works fully if you decline. You can change your choice at any time in Account settings → Privacy. We do not use advertising or cross-site tracking cookies.
Security
Passwords are stored only as salted hashes, all traffic is encrypted in transit (HTTPS), and access to data is restricted. No method of transmission or storage is 100% secure, but we work to protect your information.
Children
EZlist is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from them.
International users
EZlist is operated from, and your information is processed and stored in, the United States. By using EZlist you consent to this processing. For users in the European Economic Area and the UK, transfers to our service providers rely on Standard Contractual Clauses (and the UK Addendum) under each provider's data processing agreement.
Your California privacy rights (CCPA/CPRA)
We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we have not done so in the preceding 12 months. We also do not use your personal information for cross‑context behavioral advertising.
If you are a California resident, you have the right to know what personal information we collect and how we use it; to request access to, deletion of, or correction of your personal information; and not to be discriminated against for exercising these rights. You can delete your account and all associated data yourself at any time (Account → Delete account), or exercise any of these rights by emailing support@ezlist.store — we verify requests against your account email before acting on them.
Changes to this policy
We may update this Privacy Policy from time to time as EZlist changes — including introducing new features such as advertising, or changing how we collect, use, or share information. We will post the updated version here and revise the "Effective date" above, and for material changes we will provide notice through the app or by email and obtain your consent where required by law.
Contact
Questions or requests — including data deletion, exercising your privacy rights, or a current list of our subprocessors: support@ezlist.store.