Privacy Policy

1. Who we are

SabKiList is operated by Mahesh Bodhgire, India, who is the Data Fiduciary for your personal data. You can reach us at support@sabkilist.com.

2. Data we collect

• Account data from Google Sign-In: your name, email address, profile photo and a unique account ID.
• Household data you enter: home name, household type and size, and the members of your home.
• Shopping data: lists, items, quantities, notes, estimated prices, templates and purchase history.
• Device data: a push-notification token if you allow notifications, and your language preference.
• Technical logs: IP address, browser type and error logs, kept for security and troubleshooting.

We do not collect payment details, precise location, contacts or data from your shopping apps.

3. How we use your data

• To sign you in and keep your account secure.
• To share lists with the members of your home, in real time.
• To suggest items you may need, based on your household’s own lists and purchase history. Suggestions are generated by our own rules; we do not send your data to third-party AI providers.
• To send reminders and notifications you have turned on.
• To send service emails such as invitations and important account notices.
• To fix problems, prevent abuse and improve the service.
• If you allow it, to see which features are used, such as adding an item or sharing a list, linked to your account ID. We never record list contents, notes or searches, and you can turn this off at any time in Settings.

We do not sell your personal data and we do not show third-party advertising.

4. Who can see your data

Lists and household details are visible to the other members of your home. The home owner can remove members; members can leave at any time.

We use these service providers to run SabKiList, only for the purposes above:

• Google Firebase: sign-in and push notifications.
• MongoDB Atlas (hosted in Mumbai, India): database.
• Vercel: website hosting.
• Render (Singapore): API hosting.
• Resend: service emails.
• Cloudflare: domain, network security and email forwarding.
• Sentry: error reports, so we can fix crashes. Reports carry your account ID, not your name, email or list contents.
• PostHog (United States): usage analytics, only if you allow it in the app.

Some of these providers process data outside India. We only use providers that apply appropriate security safeguards. We may also disclose data where required by law.

5. How long we keep data

We keep your data while your account is active. When you delete your account, we delete or anonymise your personal data within 30 days, except where the law requires us to keep it longer. Backups are overwritten on a rolling basis.

6. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you;
• ask us to correct, complete or update it;
• ask us to erase it, or withdraw your consent, by deleting your account;
• nominate a person to exercise these rights on your behalf; and
• raise a grievance with us, and then with the Data Protection Board of India.

Email support@sabkilist.com to use any of these rights. We respond within 30 days.

7. Security

Data is encrypted in transit (HTTPS) and at rest, and access is limited to what is needed to run the service. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

8. Children

SabKiList is intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Changes to this policy

If we make material changes, such as adding new service providers or AI features that process your data, we will update this page and notify you in the app before the change takes effect.

10. Contact and grievances

Questions, requests and grievances: support@sabkilist.com.