Privacy policy
This policy explains what personal data the Lappen app and this website handle, why, and what rights you have. We collect as little as we can.
Who is responsible
RIEN Network AB (org. no. 559323-5277), Bockhornsvägen 5, 587 32 Linköping, Sweden, is the controller for your personal data. Contact us at lappen@riennetwork.com.
What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Your name, email address, profile picture link and sign-in method (Apple or Google), received when you sign in | To create your account, and so the owner of a list you join can see who you are | Contract | Until you delete your account |
| Lists and items: names, checked state, colour markers, the colour the owner gave each person, who added and checked each item, and when | To provide the shared lists | Contract | Until you, or the list owner, delete them, or the account is deleted |
| Which lists you belong to | To give you access to shared lists | Contract | Until you leave, are removed or delete your account |
| Which lists you marked as favourites. Only you see them. | To show your favourite lists first | Contract | Until you remove the star, leave the list or delete your account |
| A push notification token for each phone you are signed in on, with its platform and language, if you allow notifications | To notify you when someone adds an item to a list that has notifications on | Contract | Until you sign out on that phone, delete your account, or 90 days after the phone last opened the app |
| When you last caused a notification in each list | To send at most one notification an hour per person | Contract | 1 day |
| Invitations: the list, who created the invitation, when, and a scrambled (hashed) version of the code. We don't store who it was sent to. | To let people join lists | Contract | 30 days after the code is used or expires |
| Attempts to join with a code: your account and the time | To stop people guessing codes | Legitimate interest (security) | 1 day |
| Crash and error reports: device model, operating system, app version and technical details about the error, with a random identifier. No names, email addresses or list contents. | To find and fix errors | Legitimate interest (a working app) | Up to 90 days |
| Emails you send us | To answer you | Legitimate interest | Up to 24 months |
Who can see your data
- The owner of a list sees the name, email address and profile picture of its members.
- If the owner turns on "Members see each other", everyone in the list sees the names and profile pictures of the others. Email addresses stay with the owner.
- Everyone in a list sees its items, who checked them, the colour markers and the colours the owner gave each person.
- If the owner turns on notifications, the others in the list are told your name and the item when you add one.
- Nobody else can see your lists. This is enforced in the database, not only in the app.
- We don't sell your data and we don't use it for advertising.
Service providers
We use the following providers to run Lappen. They process data only on our instructions, under data processing agreements.
- Supabase: database, sign-in and server functions. Your account and lists are stored in the EU (Ireland).
- Sentry: crash and error reports, stored in the EU.
- Expo (650 Industries): delivers push notifications to Apple's and Google's notification services. It receives the notification token, the list name, the item name and the name of the person who added it.
- Vercel: hosting for this website.
- Namecheap: email, for messages you send us.
Apple and Google handle signing in under their own privacy policies. Some providers are US companies. Where data may be accessed from outside the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. See Data handling for details.
Storage on your device and cookies
The app stores your sign-in session, language and appearance choice on your phone, which it needs to work. It also keeps a copy of your lists and their items there, so they open at once, and deletes it when you sign out. This website uses no cookies and no tracking. If you pick a language here, that choice is saved in your browser only.
Your rights
Under the GDPR you can ask to see the data we hold about you, have it corrected or deleted, restrict or object to how we use it, and get a copy in a machine-readable format. You can delete your account yourself in the app (how). For everything else, email lappen@riennetwork.com. We answer within one month.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Security
Data is encrypted in transit. Access rules in the database make sure only members of a list can read it. Invitation codes are stored scrambled, and there are limits that stop code guessing and spam.
Children
Lappen is not intended for children under 13.
Changes
If we change this policy, we update the date below. If the change matters for you, we tell you in the app first.
Last updated: