Privacy Policy
The short version
- We collect only what Ostli needs to work: your account, your lists, and what you ask the assistant.
- No ads, no selling your data, and no tracking you across other apps or websites.
- We collect anonymous crash and performance data to find and fix bugs. It is not linked to you.
- Your lists are visible only to the people you share them with.
- You can delete your account in the app at any time.
1. Who is responsible
Ostli (Finland) is the controller of your personal data when you use the Ostli app and ostli.app. For anything about your data, email support@ostli.app.
2. What we collect and why
Your email address and name, and a profile photo if you add one. If you sign in with Apple or Google, we receive the details they share with us.
Why: To create your account, sign you in and show others who you are on shared lists.
Legal basis: Contract
Your lists and their contents, and who is on each list.
Why: This is the service itself: keeping your lists in sync with the people you share them with.
Legal basis: Contract
The messages you send to the assistant, and the contents of your lists so it can answer about them. Recent messages are kept so the conversation makes sense, and you can clear them at any time.
Why: To answer your questions and suggest items.
Legal basis: Contract
A notification token for your device, and the reminders you set.
Why: To tell you when a shared list changes and to send the reminders you asked for.
Legal basis: Contract
Anonymous technical information when something goes wrong, such as crash reports, device model, system version and app version. It is not linked to your name, email or account.
Why: To find and fix bugs and keep the app running smoothly.
Legal basis: Legitimate interest
What you send us through the app, along with basic technical details.
Why: To reply to you and fix problems.
Legal basis: Legitimate interest
Limited, short-lived technical records.
Why: To stop abuse, spam and attempts to break into accounts.
Legal basis: Legitimate interest
Location. The store finder uses your location on your device to find nearby shops. We don't store your location.
What we don't collect. No contacts, no advertising identifiers and no payment details. We don't use your data for advertising.
3. Who else handles your data
We use a small number of trusted service providers who process data only on our instructions:
- Google: cloud hosting, storage, sign-in, notifications and crash reporting.
- An AI provider: powers the assistant. It receives your assistant messages and list contents, but not your name or email, and doesn't use them to train its models.
- An email provider: sends your sign-in emails.
- Apple: if you use Sign in with Apple, and to deliver notifications. If you choose to share analytics with app developers in your iPhone settings, Apple also shares anonymous crash reports with us.
Some of these providers may process data outside the EU. When they do, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.
People you share a list with see that list, its items, and your name and photo. We never sell your data and only disclose it to authorities when the law requires us to.
4. How long we keep it
- Your account and lists: for as long as you have an account.
- Deleting your account: in the app go to Profile, tap your name, then Delete account. You have 7 days to change your mind by signing in and choosing “Recover account”. After that your data is permanently deleted. Items you added to someone else's shared list stay on their list.
- Security records and crash data: kept only as long as needed, then deleted automatically.
- Feedback: until it has been handled.
5. Your rights
You can ask to see the data we hold about you, correct it, delete it, get a copy of it, or object to or restrict how we use it. You can change your name and photo and delete your account directly in the app. For anything else, email support@ostli.app and we will reply within one month.
If you think we have handled your data wrongly, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live.
6. Security
Your data is encrypted and protected with industry-standard security. Only you and the people you share a list with can read it.
7. Children
Ostli is not intended for children under 13. If you believe a child has created an account, contact us and we will delete it.
8. This website
ostli.app does not use cookies, analytics or tracking.
9. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top shows when it was last updated.