Privacy

Short version: we don't have your data, so we can't lose it, sell it or show it to anyone.

What we collect

Nothing. There are no accounts, no emails, no analytics, no ads and no cookies. We have no database.

Your browser remembers a few conveniences for you: the lists you've opened, and the name you optionally set so others see who's at the shop. These stay on your device.

Where your list lives

Only on the devices that open it, in the browser's local storage (IndexedDB). It is sent directly between those devices over encrypted WebRTC connections.

Who else is involved

• Our web host (Vercel) serves the website files, like any website, and keeps standard short-lived request logs. Once the app is installed on your device (it happens automatically on first visit), list pages load from your device and don't need the host at all.
• Public Nostr relays help devices with the same list find each other. They see a scrambled room id derived from your words and an encrypted handshake, never the words or the items.
• Public STUN servers help devices behind home routers connect, as with any browser video call. They see IP addresses, not list contents.

Search engines

List pages tell search engines and crawlers not to index, archive or follow them, and they are excluded in robots.txt and from the sitemap. Nothing about your list is published anywhere.

Who can see a list

Anyone who knows its three words. Treat them like a door code: share them with the people you shop with. If you need a fresh start, create a new list and stop using the old one.

Deleting

In a list, open the menu and choose "Remove from this device". Once every device that had the list removes it, it no longer exists anywhere.