Privacy policy

Last updated: 29 October 2026 · Version française

1. What we collect, and why

Your account

You sign in with your Google account. Sign-in happens entirely at Google; from it we receive your email address, an internal account identifier and the address of your Google profile photo. The app itself keeps only that identifier, your first name, the address of your Google profile photo and, if you have chosen one, your avatar.

We never see your password — it is never sent to us.

Your first name

When you share a list, we publish to the other members of that list only your first name, your Google profile photo unless you choose an animal or "Initial" (see below) and, if you have chosen one, your avatar, so they can tell who did what.

You do not type that name: our server derives it from the name on your Google account, keeping only the first word. If that name looks like an email address, we keep only the part before the at-sign. Your full email address is never published to other members, nor is your surname.

Your Google profile photo

If your Google account has a profile photo, it is your default avatar: we show it to the other members of the lists you share, and you see it too. We do not copy the image: we publish only its address at Google, and each member's app downloads it directly from Google's servers to display it.

It is not shown if you choose an animal or "Initial" as your avatar: we then remove it from your shared lists. Its address is included when you download your data, and it is erased with your account.

Likewise, when you view a shared list, your phone loads the other members' photos from Google's servers.

Your avatar

You can choose an avatar: one of eleven animal drawings that come with the app, or "Initial". It is optional; with no choice, other members see your Google profile photo if you have one, otherwise the initial of your first name. With "Initial", they see the initial, never the photo. We store your choice with your account and show it to the other members of your lists. It is included when you download your data, and it is erased with your account.

Your lists

The content you create: your lists, items, quantities, aisles, and any list snapshots you keep.

Without an account, your lists stay on your phone. Once you are signed in, they are stored with your account, and we download them to every phone where you sign in to that account: that is how you get them back on another phone or after reinstalling the app. This covers your own lists and the shared lists you are a member of.

If you sign out, your lists are removed from this phone, along with the count of what you buy often. Your aisle order and the aisles you picked for your items stay on it. If some changes have not been sent yet, the app warns you first.

Your lists stay stored with your account, and you remain a member of shared lists. They come back when you sign in again, on this phone or another one, with their last 4 shops. To stop being a member of a shared list, tap "Leave list", ask the list's owner to remove you, or delete your account.

What you buy often

The app counts, on your phone only, how many times you add each item. That is how it can offer your usual products first. This count never leaves the device — it is not sent to us or to anyone else.

Notifications

If you turn on notifications for a shared list, we keep your preferences (which lists, your quiet hours, your time zone) and the technical tokens that let a notification reach your devices.

An installation identifier

The app generates an identifier specific to your copy of the app, so that our providers can tell one installation from another. It is tied neither to your identity nor to any advertising, and it disappears when you uninstall the app.

Usage statistics

To improve Mirilio, we would like to measure how the app is used. We only do so if you agree: the app asks you only once, after the guided tour of the home screen, and you can change your mind at any time from Settings › About › Privacy, with the "Usage statistics" switch. Until you agree, nothing is sent.

If you agree, the app sends the following to Google Analytics for Firebase, a Google service:

• what you do in the app: creating or sharing a list, joining a list, importing a recipe, opening an offer, for example, with a few details (a number of items, an aisle, the part of the app the action started from). A list is referred to by its internal identifier, never by its name; an imported recipe, by its public reference on the site it comes from and that of its author;
• the name of an item the app could not file under an aisle, written in lower case and without accents, to improve how it sorts items;
• the language of the app, and whether or not you are a member of a shared list;
• what Google measures by itself, such as the first opening, the start and length of your sessions, the app version, your phone's model, system and language, and an approximate location (the city at most) that Google infers from your connection;
• a statistics identifier specific to this installation, created by Google, which links these measurements together.

These statistics are pseudonymous: they contain neither your name, nor your email address, nor your account identifier, nor your phone's advertising identifier. They are not used for advertising.

This detailed data is kept for 2 months at most, at Google as well as in the copy we make of it for our dashboards. If you withdraw your agreement, collection stops at once, the statistics still on your phone are erased from it, and this installation's identifier is replaced by a new one. When you delete your account, the statistics still on your phone are erased and this installation's identifier is replaced too; if you had agreed, collection then continues under the new identifier until you withdraw your agreement in Settings. Data already sent is removed at the end of its retention period.

2. Advertising

The app is funded partly by advertising. On the free version, you may see a small amount of advertising.

When the app asks whether you accept personalised advertising, your answer is not final: you can change or withdraw your consent at any time, as easily as you gave it, from Settings › About › Privacy. Withdrawing applies from then on; it does not affect what was done with your consent before.

You can also, if you want to, watch an ad video from Settings to hide advertising for 24 hours. It is entirely optional: the video only plays if you ask for it, and doing nothing changes nothing. The option is only offered once you have answered the advertising question. The 24-hour countdown is kept on your device only: it is not sent to us, it is not tied to any account, and it disappears if you uninstall the app.

With Premium there is no advertising at all. The same is true if you bought "Remove ads" (EUR 3.99, paid once): that purchase removes advertising permanently, with no subscription.

Advertising is always labelled as such — a sponsored card carries the word Sponsored.

3. What other members of your household can see

As soon as you join a shared list, the other members of that list can see:

• your first name, as described above;
• your avatar, if you have chosen one;
• your Google profile photo, if you have one and have chosen neither an animal nor "Initial";
• which items you added, by name;
• which items you ticked off, by name, and how long ago;
• which items you removed from a shared list, by name: they see your first name beside them for 24 hours. Your identifier stays recorded on the removed item, on our servers, until the list is deleted or it is erased with your account;
• all the content of the list, of course.

What other members cannot see: your email address, your surname, your location, your other lists, or what you usually buy.

Invitation links

An invitation link is a key: anyone holding the address can join the list, even if the link was not meant for them. There is no second check. Share it as you would share a key to your home, and revoke it from the app if you have any doubt.

An invitation link stops working 30 days after it is created. If you open a link before installing the app, your phone keeps it for 72 hours to finish joining on first launch, then forgets it.

4. Who your data is shared with

We do not sell your data. We share it only as far as the normal operation of Mirilio requires, which means:

• service providers that host and operate the app on our behalf: accounts, the storage and synchronisation of your lists, notifications, and this website;
• the app stores and our subscription-processing partner, when you buy Premium or a one-time purchase. They receive what is needed to validate the purchase, and we never see your card number;
• our advertising partners, on the free version. If you accept personalised advertising they receive an advertising identifier and technical data about your device; if you refuse, only the technical data needed to show a limited ad. Never your lists;
• Google, for usage statistics, if you accepted them: what section 1 describes, nothing more. Google processes them on our behalf;
• the recipe site you import from, which receives only the reference of the recipe, never your lists or your identity;
• the people you invite to a shared list, who see what section 3 describes.

Our providers handle your data under contracts that bind them to use it only for us. Where a provider operates outside the European Union, the transfer is covered by appropriate safeguards.

5. How long we keep things

• Your account and your lists: as long as your account exists. You can delete it at any time from Settings.
• Deleted lists: their content is erased from our servers within 30 days at most — in practice about fifteen.
• Invitation links: they expire after 30 days. Previews of expired invitations are swept daily.
• Technical notification records (what stops us sending you the same push twice): 14 days at most.
• Usage statistics, if you accepted them: 2 months at most for the detailed data.
• Subscription records: see below.

The one thing we keep after an account deletion

When you delete your account, we keep your subscription and payment records: the fact that a subscription existed, its dates, and the billing events relating to it, tied to your account identifier.

Why: tax and accounting law requires us to retain the supporting records for our revenue. We cannot erase them on request, and this is the only such case.

Everything else goes: your lists, your first name, your avatar, the address of your published profile photo, your household memberships, and your name on every item you had added, ticked off or removed — including in other members' lists. After an account deletion, your identifier survives on no live shared document.

Lists you share stay with the other members. The shared lists you owned are not destroyed with your account: each one is automatically handed to another member, who becomes its owner and can from then on rename it, delete it, or manage its invitations. The household loses neither its list nor control of it. Your name is removed from it, as it is everywhere else. Only the lists nobody else uses are deleted with your account.

Deletion is immediate and final: it cannot be undone. You need an internet connection, and to have signed in recently: if not, the app asks you to sign in again. This phone is erased too: your lists, their history and the count of what you buy often are removed from it. Your aisle order and the aisles you picked for your items stay on it.

Your notification preferences (the lists you follow and the delivery tokens) are erased by our servers after your account is deleted; if that erasure fails, it is retried automatically. One caveat, for accuracy: if another phone was signed in to the same account, it may store them again within the next hour. Write to us and we will delete them by hand.

6. Security

Traffic between the app and our servers is encrypted (HTTPS/TLS). Access to your lists is enforced server-side: only members of a list can read or change it, and that rule is applied by the server, not by the app.

No system is perfectly secure. If you find a vulnerability, write to us rather than publishing it, and we will deal with it.

7. Changes

If we change this policy, we update the date at the top of the page. For a significant change to what we collect or who receives it, we will tell you in the app before it takes effect.

8. Who is responsible for your data

The data controller is LUVISALL WEB FACTORY LIMITED, a Hong Kong limited company registered with the Hong Kong Companies Registry under number 53049554, Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong.

For any question about this policy or your data, write to contact@mirilio.com.