LemonList Privacy Policy

Effective date: October 17, 2026

LemonList is a shared grocery list app for households. It is made by Pacific Web Design LLC, an Oregon limited liability company ("we", "us", "our"). This policy explains what information LemonList collects, why, who we share it with, how long we keep it, and the choices and rights you have. It covers the LemonList apps for iPhone and Android, our servers, and the website at lemonlist.io (together, "LemonList").

If you have a question about this policy or your information, email support@lemonlist.io.

The short version

We collect what we need to run a shared grocery list: your email address, the name and color you choose, your household, and the lists and items your household adds.
Your household can see what you add. Everyone in your household sees the shared lists, who added or checked off each item, your name, and your color. Your email address is not shown to them.
We use a small number of service providers to run LemonList (hosting, sign-in emails, notifications, crash reports, analytics, subscriptions, and an AI service that sorts unusual items into aisles). They may use your information only to provide their service to us.
We don't sell your personal information, we don't share it for targeted advertising, and LemonList has no ads.
You can delete your account at any time in the app (Household tab, then Delete account). You can also email us to access, correct, or delete your information.

1. Information we collect

Information you give us

Account information. Your email address, which you use to sign in. If you sign in with Apple or Google, we receive the email address (Apple may give us a private relay address instead of your real one) and, if you allow it, your name from that service. We also keep a basic record of how you sign in (for example, "email" or "Apple") and when your account was created.
Profile. The display name and the color you choose. Your color is shown as a small sticker with your initials. If you don't choose a name, we start with your name from Apple or Google, or the part of your email address before the "@", and you can change it at any time.
Household information. When you create a household, its name. We record who created the household (its owner), who its members are, their roles, and when each person joined.
Invitations. When you invite someone, we create a 6-character invite code and record who created it, when it expires, and who used it and when. We don't access your contacts. You share the invite through your phone's own share sheet, so we never see who you send it to.
Lists and items. The lists your household creates and their names, and every item on them: the item name, quantity, unit, any note you write, its aisle, whether it's a favorite, and its usual quantity. We record who added each item and when, and who checked it off and when.
Shopping history. To learn your household's habits and suggest what you're running low on, we keep a history of items being added, bought (checked off), removed, and suggestions being accepted or dismissed, with who did it and when. We also keep shopping trips (who started one and when), Build mode sessions (who started one, on which list, and when), snoozed or dismissed suggestions, items your household has asked us never to suggest, and your household's preferred aisle order.
Settings. For example, whether you want a notification when others add items, and whether you've already seen certain one-time screens.
Messages to us. If you email us, we receive your email address, the content of your message, and anything you attach.

Information collected automatically

Device push token. If you allow notifications, your phone gives us a push token (an identifier that lets us send notifications to that device) and we store it with your device type (iPhone or Android). We keep at most the 10 most recently used devices per person.
Crash and error reports. When the app crashes or a request to our servers fails unexpectedly, the app sends a report to our crash reporting provider (Sentry). A report contains technical details: what went wrong and where in the code, the app version, the device model and operating system version, and a small sample of performance timings. It is tagged with your account's random user ID so we can tell how many people a problem affects. Before a report leaves your phone, the app removes email addresses, web address query strings (which could contain item names), and database values, and it doesn't send your name or IP address.
Product analytics. We use an analytics provider (PostHog) to understand how LemonList is used, for example how many households use Build mode, where people get stuck when setting up, and how many people choose Premium. Analytics events describe actions in the app (such as "opened the Premium screen" or "finished a shopping trip"), along with your random user ID, your household's random ID, and basic device and app information (such as the app version, operating system, and approximate country derived from your IP address). Analytics events do not include your name, your email address, or the names of the items on your lists. We don't use analytics to build advertising profiles, and we don't record your screen.
Server logs. Like most online services, our hosting providers automatically log requests to our servers, including the IP address, the time, and the type of request. These logs are used for security, abuse prevention, and fixing problems, and are kept only for a short time.

Information from other companies

Apple and Google sign-in. If you choose Sign in with Apple or Continue with Google, that company tells us your email address and, if you allow it, your name.
App Store and Google Play. If you subscribe to Premium, Apple or Google processes the payment. Through our subscription provider (RevenueCat) we receive information about the subscription: which plan, the store, when it started, renews, or expires, whether it will renew, whether it's in a trial or grace period, and whether there's a billing problem. We never receive your card number or other payment details.

Information that stays on your phone

The app keeps a copy of your household's lists on your phone so it works offline, plus any changes waiting to be sent.
On iPhones that support Apple Intelligence, the app may use Apple's on-device model to understand what you type (for example, splitting "2 lb chicken thighs" into an item, a quantity, and a unit). This happens entirely on your phone; we don't send that text anywhere for this step.

What we don't collect

We don't collect your precise location, contacts, photos, microphone or camera input, health data, browsing history on other sites, or payment card details. We don't ask for your address or ZIP code. The lemonlist.io website doesn't use cookies, analytics, or third-party scripts.

2. How we use your information

We use your information to:

Provide LemonList: create your account, sign you in, run your household, store and sync your lists between everyone's phones in real time, and show who added what.
Make suggestions: use your household's purchase history and favorites to suggest what you might be running low on, and to draft your next shop in Build mode. These suggestions are calculated from your household's own data. You always see why something is suggested, and nothing is added to your list without you.
Sort items into aisles: using a built-in dictionary, your household's past choices, and, for Premium households, an AI service (see "Aisle sorting" below).
Send notifications you've turned on, such as "Sam added 3 items". You can turn these off in the app (Household tab) or in your phone's settings.
Send sign-in emails with your sign-in code or link. We don't send marketing email.
Manage plans and subscriptions: track your household's free starter period, apply the free plan's limits, and turn Premium on for your household when someone subscribes.
Keep LemonList secure: prevent abuse (for example, limiting repeated guesses at invite codes), and protect our users and our service.
Fix and improve LemonList: find and fix crashes and errors, and understand which features are used so we can improve them.
Provide support: answer your messages.
Meet legal obligations: for example, keeping records we must keep for tax purposes, and responding to valid legal requests.

Legal bases (for people in the European Economic Area, the UK, and Switzerland)

Where these laws apply, we rely on: performing our contract with you (providing the service you signed up for, including your household's shared lists and subscriptions); our legitimate interests (keeping LemonList secure, fixing errors, and understanding how it's used so we can improve it, in ways that respect your privacy); your consent (push notifications, which you can withdraw at any time in your phone's settings); and legal obligations (such as tax records).

3. Who can see your information

Your household

LemonList is built for sharing. Members of your household can see:

your display name and your color (not your email address);
your role (owner or member) and when you joined;
everything on the household's lists, including who added each item and who checked it off, and when;
the household's history, favorites, and suggestions;
if you subscribe to Premium, that you are the person paying for the household and the subscription's status (for example, "Premium · paid by Sam · renews Nov 3").

Only members of your household can see your household's data. Our database enforces this for every request, so people outside your household can't read or change it.

Service providers

We share information with companies that provide services to us, only as needed for them to provide those services, and under contracts or terms that limit their use of it. They are:

Supabase, Inc. (United States): our database, sign-in system, real-time sync, and server functions. All of your account and household data is stored with Supabase, in the United States (US East region).
Resend (United States): sends our sign-in emails. It receives your email address and the sign-in email.
Expo (650 Industries, Inc.) (United States): delivers push notifications and app updates. To send a notification it receives your device's push token and the notification text (for example, "Sam added 3 items"); it passes them to Apple Push Notification service or Google Firebase Cloud Messaging for delivery. When the app checks for updates, Expo receives basic device and app information.
Anthropic, PBC (United States): AI aisle sorting for Premium households (see below). It receives only a grocery item name.
Sentry (Functional Software, Inc.) (United States): crash and error reports, as described above.
PostHog, Inc. (United States): product analytics, as described above.
RevenueCat, Inc. (United States): manages subscriptions bought through the App Store and Google Play. It receives your random user ID, your household's random ID, and your subscription and purchase records from Apple or Google.
Apple and Google: sign-in (if you choose Sign in with Apple or Continue with Google), push notification delivery, and payments for subscriptions bought in their stores. Their handling of your information is covered by their own privacy policies. If you email us, your message reaches our support inbox, which is hosted by Google (Gmail).
Cloudflare, Inc. (United States): runs the lemonlist.io domain, forwards email sent to our addresses, and hosts this website. It processes website requests (including IP addresses) and emails sent to us.

Aisle sorting with AI (Premium households)

When you add an item, the app first tries to sort it into an aisle on your phone and from our own list of known items. If it still doesn't know the aisle, it sends the item name (lowercased, simplified, and stripped of punctuation) to our server. We keep a shared table of item names and the aisle they belong to, so that each name only needs to be looked up once. This table contains only generic item names such as "dragon fruit", never who added them or which household they came from. If the name isn't in that table and your household has Premium, our server asks Anthropic's AI model which aisle it belongs in. Anthropic receives only the item name, with no information about you or your household. Anthropic processes it under its commercial terms, which don't allow it to use our data to train its models. On the free plan, item names are never sent to Anthropic.

AI suggestions can be wrong. You can move any item to a different aisle, and LemonList remembers your choice for your household.

Other sharing

We may also share information:

to comply with the law, such as a valid subpoena, court order, or other legal process, or to respond to a lawful request from authorities, and we will push back on requests we believe are overbroad;
to protect the rights, property, or safety of our users, the public, or us, including to prevent fraud and abuse;
in a business transfer, such as a merger, acquisition, or sale of assets, in which case your information would stay subject to the promises in this policy, and we would tell you before it becomes subject to a different policy;
with your permission, or at your direction.

No selling, no targeted advertising, no ads

We don't sell personal information. We don't share personal information for cross-context behavioral (targeted) advertising. LemonList shows no ads, and we don't let advertising networks collect information in the app or on our website. We have not sold or shared personal information for these purposes in the past 12 months.

4. How long we keep information

Account and profile: until you delete your account.
Starter period record: when your first household gets its free starter period, we keep a one-way fingerprint of your email address (a SHA-256 hash, which can't be turned back into the address). It stays after you delete your account, so a new account with the same email doesn't get a second starter period. It isn't linked to any other information about you.
Household data (lists, items, notes, favorites, history, suggestions, trips, invites): as long as the household exists. It belongs to the household and stays available to its members when one person leaves or deletes their account. When the last member leaves a household or deletes their account, the household and everything in it are deleted.
Push tokens: until you sign out on that device, delete your account, the device stops accepting notifications, or the device falls outside your 10 most recently used devices.
Failed invite code attempts: about one day (used only to stop people guessing codes).
Deleted items: when an item is deleted from a list, we keep a short record for up to 10 minutes so Undo can restore it exactly. The item's history stays in the household's history.
Crash reports: up to 90 days.
Analytics events: up to 2 years, after which they are deleted or fully de-identified.
Server logs: a short time, typically days and never more than 90 days.
Subscription and purchase records: as long as needed to provide Premium and to meet accounting, tax, and legal obligations (generally up to 7 years after the purchase).
Support emails: as long as needed to help you and keep a record of the conversation, generally no more than 3 years.
Backups: our database is backed up automatically. Deleted information may remain in backups until they roll over, which happens within 30 days.

5. Deleting your account

You can delete your account in the app at any time: open the Household tab and tap Delete account at the bottom of the "You" section. You can also email support@lemonlist.io from the address on your account and ask us to delete it. Here is exactly what happens:

You leave your household. If you were its owner, ownership passes to the member who has been in the household longest. If you were the only member, the household is deleted, along with all of its lists, items, history, favorites, invites, and settings.
Your account is deleted: your login, your email address, your profile (name, color, and settings), your household membership, and your devices' push tokens. Only the one-way starter period fingerprint described in "How long we keep information" remains.
Shared household data stays with the household. Items you added, items you checked off, trips you started, and the household's purchase history remain for the other members, because they're part of their shared lists. They are no longer linked to you; the app shows them as added by a former member.
Invite codes you created or used stay in the household's records but are no longer linked to you.
Information held by service providers is deleted or expires as described in "How long we keep information". Crash reports and analytics events are linked only to your random user ID, which no longer connects to any account once yours is deleted. If you'd like us to delete them sooner, email us.
Subscriptions are not cancelled automatically. Apple and Google bill you, not us, so deleting your account (or the app) doesn't stop a subscription. Cancel it in your App Store or Google Play subscription settings first.

Deleting your account can't be undone. If you just want to stop sharing with your household, you can Leave household instead (also on the Household tab) and keep your account.

6. Your choices

Notifications: turn "When others add items" off on the Household tab, or turn off notifications for LemonList in your phone's settings.
Your profile: change your name and color on the Household tab at any time.
Your household: leave it at any time. The owner can remove members.
Suggestions: dismiss, snooze, or permanently hide any suggestion.
Sign-in with Apple: you can hide your real email address from us by choosing "Hide My Email".

7. Your rights

Wherever you live, you can ask us to:

access the personal information we have about you, and get a copy of it in a portable, machine-readable format;
correct information that's wrong (you can also change your name and color yourself in the app);
delete your personal information (you can also delete your account yourself in the app);
tell you more about how we use and share your information.

US state privacy rights

Residents of some US states, including California, Oregon, Colorado, Connecticut, Virginia, Texas, and others, have specific rights under their state's privacy law, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and the Oregon Consumer Privacy Act. Depending on where you live, these may include the right to know what personal information we collect, use, and disclose; to access and get a portable copy of it; to correct it; to delete it; to opt out of its sale, of "sharing" for targeted advertising, and of profiling that produces legal or similarly significant effects; to get a list of the specific third parties we've disclosed it to (Oregon); and not to be discriminated against for using these rights.

Some of these laws apply only to businesses above certain size thresholds. We honor the requests above from everyone, whether or not a particular law applies to us. We don't sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of. Our suggestions about what your household might be running low on are calculated from your household's own lists and are only shown to your household. We don't collect "sensitive personal information" as these laws define it, and we don't use it to infer characteristics about you.

Categories of personal information we collect (using the California law's categories), each collected from you, your device, or the companies described in section 1, and used for the purposes in section 2:

Identifiers: email address, display name, random user and household IDs, push tokens, IP address (in server logs and website requests). Disclosed to the service providers listed in section 3 for their stated purposes.
Commercial information: your household's grocery lists and purchase history, and your Premium subscription status. Disclosed to Supabase (storage), RevenueCat and Apple or Google (subscriptions), and, for item names only, Anthropic.
Internet or other electronic network activity: how you use the app (analytics events), crash reports, and server logs. Disclosed to PostHog, Sentry, Supabase, and Cloudflare.
Geolocation data: only the approximate country derived from your IP address for analytics. We don't collect precise location, addresses, or ZIP codes.
Inferences: which items your household is likely running low on, calculated from your household's own history and shown only to your household.

How to make a request

Email support@lemonlist.io from the email address on your LemonList account, and tell us what you'd like. We'll confirm the request came from you by checking that it came from that address, or by asking you to confirm through it. You can use an authorized agent to make a request for you; we'll ask for proof that you authorized them and may need to confirm your identity directly. We'll respond within 45 days, and tell you if we need more time (up to another 45 days, as these laws allow). We won't charge you for a request unless requests are clearly unfounded or excessive.

Information about other people. Because household data is shared, a copy of your data includes what you've added to your household's lists. We may not be able to delete items from the shared lists that other members rely on, but we will remove your name from them, as account deletion does.

Appeals. If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We'll respond to your appeal within 60 days (or the time your state's law requires) and explain our decision. If you're not satisfied, you can contact your state's attorney general (in Oregon, the Oregon Department of Justice).

If you're in the European Economic Area, the UK, or Switzerland, you also have the right to object to or restrict certain processing, to withdraw consent at any time, and to complain to your local data protection authority. Contact us first and we'll try to help.

8. Do Not Track and Global Privacy Control

We don't track you across other companies' apps or websites, sell your information, or share it for targeted advertising, so a Do Not Track signal or a Global Privacy Control (GPC) signal doesn't change anything we do. If we ever start doing something that these signals ask us not to do, we will honor GPC signals as a valid opt-out request.

9. Children

LemonList is not directed to children under 13, and people under 13 may not create an account. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, email support@lemonlist.io and we will delete it. Teenagers aged 13 to 17 may use LemonList with the permission of a parent or guardian where the law requires it.

10. Security

We protect your information with measures appropriate to the kind of information we handle, including:

encryption in transit (HTTPS/TLS) between the app, our website, and our servers, and encryption at rest by our hosting provider;
database rules (row-level security) on every table, so each request can only read or change data that belongs to the requester's own household, with automated tests that check people outside a household can't access it;
sign-in with one-time codes, Apple, or Google, so we never store a password;
secret keys for our providers kept only on our servers, never in the app;
limits on repeated attempts, such as guessing invite codes;
giving access to production data only to the people who need it to run LemonList.

No system is perfectly secure, and we can't guarantee that information will never be accessed, used, or disclosed in a way this policy doesn't describe. If a security breach affects your personal information, we will notify you and the authorities as the law requires.

11. Where your information is processed

We are based in the United States, and LemonList's servers and service providers are in the United States. If you use LemonList from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those where you live. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the standard contractual clauses our service providers offer.

12. Changes to this policy

We may update this policy as LemonList changes or the law changes. When we do, we'll post the new version here and change the effective date at the top. If a change is significant, for example a new use of your information or a new kind of company we share it with, we'll tell you in the app or by email before the change takes effect. If the law requires your consent to a change, we'll ask for it.

13. Contact us

Pacific Web Design LLC
Oregon, United States
Email: support@lemonlist.io