Privacy Policy — Home List

1. Introduction and data controller

Home List (Ev Listesi, “the App”) is a mobile app that helps roommates and families coordinate their shared household needs simply, calmly and in real time.

This text explains which data is processed when you use the App, which services it is shared with, and how it is kept and deleted. Before public release, the identity of the data controller and the legal text will be reviewed separately.

Privacy and support email: support@homelist.fatihaltuntas.dev. Never send your account password or a verification code.

2. Personal data collected and why

Home List follows the principle of data minimization (collecting only what is needed). It does not build profiles, collect advertising identifiers or track your location.

Data category	Information collected	Purpose	Legal basis
Identity & account	Name / display name, email address, user ID (UID)	Creating your account, signing in, resetting passwords, showing home members to each other	Performance of a contract (KVKK art. 5/2-c)
Sign-in provider	Apple ID or Google OAuth token	Secure one-tap sign-in with your Apple or Google account	Performance of a contract
Home and list data	Home name, item names, quantities, item notes, shopping trip records	Syncing the shared shopping list between home members in real time and showing finished trips in history	Provision of the service / legitimate interest
Notifications and device	Device installation ID (UUID), Expo push token, notification preferences, platform (iOS/Android), app language (notification text is prepared in this language)	Telling the home members who allowed it about changes to the list	Explicit consent (if you allow notifications)
Security and operations	Request fingerprints (hashes), operation IDs (requestId)	Preventing duplicate submissions (idempotency), detecting abuse	Legitimate interest / system security
Crashes and diagnostics	Technical information such as the error stack and message, app version, device model, operating system version, memory and disk state, and a random Crashlytics installation ID. Your account ID, name, email and list content are not added to reports.	Finding and fixing app crashes and errors	Legitimate interest; can be turned off with Home > My account > Send crash reports
Home List Plus purchases	Product (yearly or lifetime), purchase status and expiry, the store's transaction ID or a hash of the purchase token, and a purchase mark derived from your user ID by one-way hashing. Payment and card details are handled only by Apple or Google; we never receive them.	Activating Plus for your account and homes, renewals, refunds and restoring purchases	Performance of a contract
Plus content	List names, item prices, currency and monthly budget, recurring items and receipt photos you choose to add	Plus features shared with the members of the home	Performance of a contract

3. Third-party service providers and data transfers

Your data is never sold, rented or passed to ad-targeting companies. We only work with trusted infrastructure providers:

Google Cloud / Firebase: used for authentication (Firebase Authentication), data storage (Cloud Firestore) and server operations (Cloud Functions). The Firestore database is in the nam5 multi-region location and Cloud Functions run in us-central1; data is therefore not hosted only in the EU. App Check client setup is in progress; enforcement is not yet enabled. The phone app uses Firebase Crashlytics for crash reports.
Expo (650 Industries, Inc. – USA): only for delivering push notifications (Expo Push Service). Notification bodies contain no item names, notes or other sensitive content: only general activity and counts (“A new item was added to your list.”, “Purchased: 3. Still needed: 1.”) and, when a member starts shopping, that member's display name (“Jake is shopping. Anything else to add?”); this notification goes to the other members of the same home.
Apple & Google: for optional social sign-in (Sign in with Apple / Sign in with Google) and distribution through the official app stores.
Firebase Cloud Storage (Google): stores receipt photos that members of a Plus home choose to add. Only members of that home can open them.
Apple App Store and Google Play: process Home List Plus payments, trials, renewals, cancellations and refunds under their own privacy terms. Our server checks purchases with them (App Store signed transactions and server notifications, the Google Play Developer API and its real-time notifications).

4. Retention and automatic clean-up

Home List has active clean-up rules so that data does not pile up on servers without need:

Account and profile data: kept until account deletion is completed; leaving a home alone does not delete the account.
Operation records (_requests): created with a 7-day lifetime to prevent duplicate operations, and removed in periodic maintenance after they expire.
Invitation codes (_invitations): 8-character codes become invalid after 24 hours. Old codes are physically removed separately.
Notification event queue (_notificationEvents): records are created with a 7-day lifetime; expired ones are removed in periodic maintenance.
Crash reports: kept by Firebase Crashlytics for up to 90 days. When the switch is turned off, unsent reports are deleted from the phone.
Device notification tokens: the related records are removed when notifications are turned off or during account/membership changes. Tokens reported invalid during delivery are removed; uninstalling the app does not guarantee immediate clean-up.
Purchase records (_purchases, _entitlements): kept while your account exists, so Plus keeps working and refunds are applied; removed when your account is deleted. Apple and Google keep their own purchase records.
Receipt photos: kept until removed by the member who added them or the home owner, until the home is closed, or until the account that added them is deleted.
Home screen widget: the list summary shown in the widget is stored only on your phone (an App Group on iPhone, app storage on Android).

5. Cookies and tracking

Our mobile app and this website do not use advertising trackers (IDFA / GAID), third-party analytics SDKs or user-tracking cookies. Firebase Crashlytics in the phone app is used only for crash and error diagnostics, never for advertising or user tracking. This website only stores your language choice in your browser.

6. Your rights (KVKK & GDPR)

Under Article 11 of KVKK (the Turkish Personal Data Protection Law) and the relevant articles of the GDPR, you have the right to:

Be informed: learn whether your personal data is processed.
Access: request information about the processing and receive a copy of your data.
Rectification: ask for incomplete or incorrect data to be corrected.
Erasure (right to be forgotten): ask for your data to be deleted or destroyed.
Object: object to an outcome against you produced by automated systems.

7. Deleting your account and data

You can start an account deletion request in the app. Security conditions such as re-authentication, an active shopping trip or transfer of ownership apply:

In the app: go to the Home tab → My account → Delete my account and create a deletion request after re-verifying. If Apple is linked, its authorization is revoked; for large histories, clean-up may continue in the background.
Outside the app: if you can't access the app, send a request to support@homelist.fatihaltuntas.dev stating your registered email address. Sending an email alone does not delete the account; identity verification and processing of the request are required.

Detailed steps: Account and data deletion guide.

8. Security measures

The App's server connections use HTTPS/TLS.
Database access is restricted to verified home members with Firebase Security Rules.
Invitation attempts and notification device registrations are rate-limited. App Check enforcement has not yet been turned on in production.
Password verification is handled by Firebase Authentication; the App does not keep plain-text passwords in its own database.

9. Contact

Support email for privacy questions and requests to exercise your rights: support@homelist.fatihaltuntas.dev.