Privacy policy

1. Who operates the app

Z Shopping List is operated by DMX Designs, based in Cape Town, South Africa. We use the information described below to provide account sign-in, shopping lists, list sharing and related support.

2. Information we handle

• Account details: your email address, account identifier, account creation date and the display name you choose. Firebase Authentication processes your password and manages sign-in credentials; your password is not stored in shopping-list records or shown to other shoppers.
• Shopping-list content: item names, selected categories and stores, item status, creation times and the identifier of the account that added an item.
• Sharing details: list identifiers, invite codes, membership, list ownership, member display names and join dates.
• Notifications: if you permit notifications, a device push token used to deliver shared-list updates. Notification messages can include a shopper's display name, item names, store names and identifiers associated with the change.
• Local settings: sign-in persistence, appearance preference, onboarding status and dismissed update notices are stored on your device.
• Technical information: our authentication, hosting, notification and app-update providers process information such as IP addresses, device or platform details, app identifiers and service logs to operate, secure and deliver their services.
• Support correspondence: your email address and information you send us when asking for help or making a privacy or deletion request.

The app does not include advertising or a dedicated behavioural analytics service. It does not ask to access your contacts, photos, microphone or precise location. Store names are choices you make in the list, not location tracking or purchases made through retailers.

Please avoid putting sensitive personal information into item names or your display name.

3. How we use information

We use account details to identify and authenticate you; shopping-list content to store, display and synchronise your list; sharing details to join and manage shared lists; and push tokens to send updates to other members. Local settings remember your preferences. Technical information supports service delivery, security, troubleshooting and app updates. Support correspondence lets us respond to your request.

4. Sharing and visibility

Shared-list members can see and change shopping-list content and see member display names and membership information. Invite codes let another signed-in person join a list. Anyone you share a code with may pass it on. The list owner can remove members and generate a replacement code.

List records used for joining contain identifiers, invite codes, member names and notification tokens. In the current version, these records can be read by other signed-in accounts. Treat invite codes and shared-list information accordingly; do not use the app to store confidential information.

Notifications pass through service providers and may appear on a device's lock screen. You can change notification permissions and preview visibility in your device settings. The app does not automatically access your address book when you share an invite.

We do not sell or rent your personal information or use it for targeted advertising. Information is also processed by the providers below to run the app, and may be disclosed where required by law or necessary to address abuse or protect legal rights.

5. Service providers

• Google Firebase: account authentication and cloud storage/synchronisation through Cloud Firestore. See Firebase privacy and security information and the Google Privacy Policy.
• Expo: app-update delivery and push-notification routing. See the Expo Privacy Policy.
• Apple and Google push services: delivery of notifications through Apple Push Notification service or Firebase Cloud Messaging, depending on your device. See the Apple Privacy Policy and Firebase information above.

These providers may process information in countries outside South Africa. Their processing locations, safeguards and service-log retention are described in their documentation and applicable terms.

6. Storage and security

Account and shopping-list data are held using Firebase services. Network requests to Firebase and Expo use encrypted HTTPS connections. Authentication and database access rules help control access, subject to the list-record visibility described above. Local settings and sign-in state remain on your device until cleared by the app or your device's storage controls.

No storage or transmission method is completely secure. Protect your device, account credentials and invite codes, and contact us if you suspect unauthorised access.

7. Retention and account deletion

We keep account information and list content while needed to provide the app. You can remove shopping items in the app. Uninstalling the app does not delete your cloud account or shared lists.

To delete your account, open the profile icon, go to Account, select Delete account and confirm. You may need to sign in again before deletion can finish.

Account deletion removes your authentication account and profile record. The app attempts to remove your current shared-list membership and notification token and to delete lists that have no other members. Lists still used by others, including items you contributed and associated item identifiers, may remain available to those members; ownership can transfer to another member. Copies already received by other people, including notifications, are not recalled.

If you cannot use the app, or a deletion does not complete, email info@dmxdesigns.co.za with the subject Z Shopping List account deletion from your registered email address. Do not send your password. We may ask for information needed to verify that the account belongs to you. Contact us if you also want help removing identifying information from content retained in a shared list.

Technical logs, provider backups and records needed to resolve a support request, meet a legal obligation or address a dispute may remain beyond deletion from the active app. Provider retention practices vary; deletion is not a promise that every backup or previously delivered copy disappears immediately.

8. Your choices and privacy requests

You can change your display name, manage list content and membership, choose an appearance setting and disable notifications. To request access to, correction of or deletion of personal information, or to raise a concern about how it is used, contact us. Rights available under applicable data-protection law, including South Africa's POPIA, depend on your circumstances. We may need to verify your identity before acting on a request.

9. Children

The app is not directed at children under 13. If you are a parent or guardian and believe a child has provided personal information without the permission required by applicable law, contact us so we can investigate and address the request.

10. Policy updates

We may update this app-specific policy as the app or its data practices change. The latest version will be available at this URL with an updated date. Where required, we will provide additional notice or request permission for a change.