Privacy Policy

ListEka ("we", "us", or "our") is a smart shopping checklist application operated by NSK Technologies. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application or website (collectively, the "Service"). Please read this policy carefully. If you do not agree with its terms, please discontinue use of the Service.

We are committed to complying with applicable privacy laws including the EU General Data Protection Regulation (GDPR), the US Children's Online Privacy Protection Act (COPPA), and the California Consumer Privacy Act (CCPA).

We use the information we collect to:

• Create and maintain your account and authenticate your identity.
• Provide, operate, and improve the Service.
• Sync your checklists securely across your devices.
• Analyse usage patterns to improve features and fix bugs.
• Send transactional emails (e.g. password reset, sign-in links).
• Comply with legal obligations.

We do not use your data for targeted advertising.

If you are in the European Economic Area (EEA), we process your personal data on the following bases:

• Contract performance: To provide the Service you signed up for.
• Legitimate interests: To improve the Service and ensure security, where these interests are not overridden by your rights.
• Legal obligation: Where required by law.
• Consent: For any processing not covered above, we will ask for your explicit consent.

ListEka is designed for family use and may be used by children under 13 under parental supervision. We comply fully with the Children's Online Privacy Protection Act (COPPA) and Google Play's Families Policy.

• We do not knowingly collect personal information from children under 13 without verifiable parental consent.
• We do not show behavioural advertisements to any user, including children.
• We do not share children's data with third parties for commercial purposes.
• Children's accounts may only be created with parental consent and oversight.
• Parents or guardians may request deletion of a child's data by contacting us at support@listeka.com.

If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly.

We share your information only in the following limited circumstances:

• Firebase (Google LLC): Our backend infrastructure for authentication, database, and analytics. Google processes data under its own privacy policy and our Data Processing Agreement.
• Apple Inc.: When you use Sign in with Apple, subject to Apple's privacy policy.
• Legal requirements: If required by law, court order, or government authority.
• Business transfer: In the event of a merger or acquisition, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We do not sell, rent, or share your personal data with advertising networks or data brokers.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain it longer (e.g. financial records).

Anonymised analytics data may be retained indefinitely as it cannot be linked back to you.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your data ("right to be forgotten").
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Request that we restrict processing of your data.

To exercise any of these rights, contact us at support@listeka.com. We will respond within 30 days.

We implement industry-standard security measures including TLS encryption in transit, Firebase security rules to restrict database access, and secure credential storage on device. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

The Service uses the following third-party services, each governed by their own privacy policy:

• Firebase / Google — Google Privacy Policy
• Apple Sign-In — Apple Privacy Policy

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where Firebase infrastructure is hosted. We ensure appropriate safeguards are in place (including Standard Contractual Clauses where required by GDPR).

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page and, for material changes, notify you via in-app notification or email. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: