Privacy Policy

About this policy

Vinicius Martins Delgado trading as Listto, ABN 68 820 965 824, is responsible for the personal information described here. Privacy questions and complaints can be sent to admin@listto.com.au.

Account and provider information

Before collecting email or provider account information, Listto processes your date of birth only to determine whether you are 16 or older. Listto does not retain the submitted birth date. It stores only the eligibility result, rule version, method and evaluation time.

Email signup collects your email address, public Full name, unique public username and password-derived security data. Listto does not collect country or gender during signup.

Google or Facebook signup receives a stable provider-specific identifier, email evidence and the name made available through the provider authentication response. The provider-supplied name becomes the initial public Full name and cannot be replaced by browser-supplied data during provider signup. You may edit it later through Profile. Listto does not merge accounts merely because provider and Listto email addresses match.

Email choices and evidence

At signup you may separately choose to receive recipe inspiration, trending recipes and Listto product updates by email up to once a week. This optional choice is off by default and is not required to create or use an account.

When you opt in, Listto records the communication category, the exact prompt version and hash, source and time so the choice can be demonstrated. You can withdraw it at any time in communication settings or through an unsubscribe link. Withdrawal updates the preference and creates a purpose-specific suppression; it does not disable necessary account or security messages.

Service notifications

Shopping-list invitation emails are factual collaboration messages, separate from weekly marketing. They may include the inviter Display Name, list name, permission and a safe link to Listto notifications, but no list items or promotional copy.

You can disable shopping-list invitation email in account settings without removing the in-app notification. Security, verification, recovery and legal messages remain available where necessary to operate and protect the account.

Purposes, disclosure and overseas processing

Listto uses the eligibility result to enforce its 16-plus account rule. Account information is used to create, authenticate, secure, administer and recover accounts, display the public Full name and @username, prevent provider mix-ups and fraud, and provide requested recipe and collaboration features.

Authorised Listto personnel and contracted hosting, security and email providers process only the information needed for their function. Google or Meta receives the authentication request you choose. Resend processes recipient addresses, transactional message content and delivery events in the United States, with Listto sending routed through Tokyo, Japan.

Delivery events, retention and security

Listto may process delivery, bounce, complaint and suppression events to protect sender reputation and prevent unwanted repeat delivery for the affected purpose. Email eligibility is checked again immediately before applicable service or future marketing delivery.

Listto protects credentials and action secrets with hashing, encryption and access controls, uses short-lived verification records and revocable sessions, and retains personal information and consent evidence only as needed for account, security, preference, complaint and legal purposes. No internet service can guarantee absolute security.

Listto protects Admin access with an authenticator-app secret protected at rest and separate one-time recovery-code hashes. Authenticator secrets, QR setup data and recovery codes are not placed in ordinary logs or browser storage.

Shopping list suggestions and activity data

After the feature is enabled, the exact policy versions are approved and you complete the required review, Listto may record append-only shopping activity used for suggestions. This can include adds and duplicate merges, actual purchased or returned changes, removals and renames, recipe imports, and suggestions shown, selected or used to assist an add. Records can include your account identifier, an immutable shopping-list context identifier, a catalog item identifier or version-normalized custom-item identity, a safe item-name snapshot, normalized list-title tokens, the event and source type, source-record and decision/model details, rank, and time.

Listto uses frequency, recency, purchase cadence, day or month timing, normalized list-title context, same-list history and current-item co-occurrence to rank candidates. Shared-list actions contribute only to the acting user's personal history and also to that list's context. Population suggestions use privacy-thresholded aggregation: one person contributes at most one vote per item, catalog items require at least three distinct people and custom items require at least ten. Custom names, list titles, user identifiers and decision contents are not written to recommendation timing or mode metrics.

Raw recommendation events are retained for no more than 730 days, described as 24 months, and are then removed in batches. Actor-item and actor-list-item signal projections are rebuildable from retained events. Listto does not send this activity to an external recommendation service, embedding model, large language model or Python analytics stack.

Account deletion and retained information

A signed-in account owner may permanently delete the account through Account Security after typing the exact confirmation phrase containing the account's @username and completing a fresh code sent to the verified email. Listto immediately disables sign-in, revokes sessions, removes password and provider-login associations, and de-identifies the former email address, Full Name, date of birth, gender, country, phone number, profile biography and avatar.

The username, its reservation and its relationship to the deleted account are retained permanently to prevent reuse, impersonation and confusion in historical records. Public recipes remain available under 'Anonymous'. Authorised administrators may see the protected historical Display Name, @username and deletion date for legal, safety, moderation, security and ownership work; ordinary users cannot. Published reviews retain the historical Display Name with a deleted-account indication but no username or active profile link.

Private recipes, pantry records, private shopping lists and other non-public content stay non-public and become inaccessible through the deleted account. Listto may retain that content and minimal account, legal-acceptance, security, complaint, moderation and deletion evidence where reasonably needed for legal compliance, dispute handling, safety, fraud prevention, service integrity and controlled backup retention.

Account deletion is intended to be irreversible for the ordinary user. A later account using a released email or provider identity is separate and is not reconnected to deleted-account data. The former Display Name may be used by another account because Display Names are not unique.

When account deletion completes, Listto purges recommendation events and derived recommendation signals attributed to that account. Shopping-list rows and other content may still be handled under the separate retention rules above, but they are not retained as that deleted user's personal recommendation history.

Your choices and rights

You may edit your public Full name, request access to or correction of personal information, change communication preferences, unsubscribe, unlink an external provider when another usable method remains, complain about privacy handling or permanently delete the account through Account Security. Username changes are restricted to authorised administrator corrections and retain the previous reservation and audit evidence. Contact admin@listto.com.au for privacy questions or complaints.

Shopping list suggestions are controlled from account settings. The personalization preference defaults to on, but collection, personalised serving and any legacy bootstrap remain inactive unless the feature is enabled, these exact policy revisions are approved and you have completed the required review. Turning personalization off stops personal recommendation collection, purges recommendation events and derived signals attributed to you, and uses only curated fallback items. You may instead reset the same history while leaving personalization enabled.

Community price learning and your choice

Listto can use eligible shopping prices to improve estimates for people shopping in the same market. The community-price contribution preference begins on, but collection requires the feature to be enabled, approved versions of these notices, your completed review, a verified active account at least seven days old and the required activity history. You may turn contributions off or reset your contribution history in settings. Signup or a saved recipe alone does not create a community price vote.

When eligible, Listto records shopping activity markers and prices you enter, correct or confirm, with an internal account identifier, selected market, normalized item identity, brand or package where supplied, quantity, unit, price, timing and reliability information. It uses this information to compare like products, limit repeated voting and calculate community estimates. It does not publish your name, account identifier, individual price history, list contents or private recipe through a community quote.

Community estimates require at least five distinct contributors for catalog items or ten for custom items, including at least three or five manual contributors respectively. Current consensus uses eligible observations from the previous 90 days. Market, brand, package and unit compatibility remain separate. Estimates are not a retailer offer or a guarantee of availability, and community updates do not replace a current manual correction.

Transient capture work expires after 30 days and account-attributed observations expire after 365 days; bounded cleanup may follow expiry. Turning contributions off, resetting them or deleting the account removes its shared observations and effective votes and schedules affected aggregates to be rebuilt. Already saved shopping prices and private remembered prices can remain under their ordinary lifecycle. Deletion from backups follows the backup lifecycle described in this policy.

The contribution flow is processed by Listto's service and database; it does not send contribution history to an AI provider or buy transcription. Separately enabled AI price estimates use the product and market context described by the existing feature disclosures. Declining community contributions does not prevent ordinary shopping-list use or private price corrections. Access, correction and complaints can be requested through admin@listto.com.au.

Optional live voice input

When you choose live voice input and confirm the microphone notice, Listto sends microphone audio and a bounded set of item-name hints to xAI for live transcription. Hints can include names already in the shopping list you are editing and general shopping vocabulary. The speech service operates in the United States. Listto does not intentionally send your account identifier, email, authentication credentials or the whole shopping list to xAI.

For live voice, Listto uses xAI's team-level Zero Data Retention (ZDR) setting. xAI states that audio and transcription content are processed without being retained after processing and are not used for model training without explicit permission. Provider request content is therefore unavailable for later retrieval or recovery. Listto still saves validated item changes as described below. Do not dictate sensitive information or record other people without permission.

Listto handles raw audio, item hints and transcripts transiently during the recording; it does not save them to its database, browser storage, analytics or ordinary logs. Validated item additions, changes and removals are saved through the normal shopping-list or pantry APIs and follow their existing sharing and deletion rules. People with access to that list can see saved changes. Temporary processing in device and server memory remains necessary to provide the feature.

Recording requires your action and browser microphone permission. You can stop at any time or type instead. A recording ends after ten seconds without new recognised word progress or five minutes overall; the server bounds setup and draining as well. Two recordings may run per account across devices, with sixty starts per rolling hour and twenty combined minutes per UTC day. Setup, connection and final-result draining count toward that allowance; an interrupted session may conservatively consume its reserved time until reconciled. Other capacity and shared spending limits can temporarily prevent use. Background noise or recognition errors can affect transcription; inspect saved items and correct or undo changes.

For access, correction, deletion or privacy complaints, contact admin@listto.com.au. The account, backup, international-transfer and complaints provisions elsewhere in this policy continue to apply. Live voice does not activate the separate camera feature.