Privacy Policy
Last updated: 2026-11-03
1. Data controller
The data controller for Buy The Way is the publisher of this application. For any privacy-related request, including access, rectification or deletion, contact: danielebelfiorepc@gmail.com. This service is operated for personal and non-commercial purposes.
2. Data we collect
When you sign in we collect: your email address (from Google or the one you provide for the sign-in link), display name and profile photo when available from the method you choose, an authentication identifier (uid) provided by Firebase Authentication, and the date and time of your last sign-in. While you use the service we store: lists and items (name, quantity, note, priority, checked state), any photos you upload for items, collaborators and pending invites (including invited email addresses), in-app notifications, usage counters for your personal catalog, and wallpaper and favorites preferences per list. When you share a list, your name, email and profile photo are visible to the other collaborators on that list. Your browser stores local preferences and an offline cache in localStorage and IndexedDB, and on the device that requested the sign-in link it keeps the email used to complete passwordless sign-in. On the sign-in page we load Google's Sign in with Google (One Tap): if you are already signed in to Google in your browser, it suggests your account, and if you have used Buy The Way before it signs you in without a click. At that moment Google receives technical browser data and the page address, and it may set a functional cookie (g_state) to remember whether you dismissed the prompt. After you sign out, automatic sign-in stays off until your next sign-in. If you use voice input, audio is processed by your browser's speech engine (e.g. Google or Apple) outside our direct control. The feedback form sends email, uid, message, app version and user agent through Resend. The "Contact us" form on the public pages, which works without an account, sends your name, email and message through Resend: we use them only to reply to you. To limit abuse, we count submissions per IP address, kept only for short time windows. We do not use profiling cookies or advertising. We count visits with just-analytics, our own tool hosted on Netlify, without cookies: page visited (without the list identifier or the title), referrer, approximate country, device type, browser and operating system. The IP address is used only at that moment to estimate the country and is not stored.
3. AI assistants (MCP)
You can optionally connect an AI assistant (for example Claude) to your lists through the MCP protocol. The connection is made only after your explicit consent on a Buy The Way screen that shows which assistant is asking. What the assistant can do: see your lists and their items; add, edit, check off and remove items; create, rename and empty lists; move and copy items between lists; read a list's favorites and pin or unpin them; read past shops and your stats to suggest what to buy; choose your default list. It cannot delete lists, manage collaborators or see photos. Items it adds are marked as added by an assistant. What we store to manage the connection: the name the assistant registered with and its redirect addresses, the date of connection and of last use, and access tokens stored only in hashed form with an expiry (1 hour for access, 30 days for renewal). The list content the assistant reads or changes goes through the assistant's provider, which processes it as an independent controller under its own privacy policy: we do not control it. You can disconnect an assistant at any time from Settings → Connected apps: the connection and its tokens are deleted immediately. Deleting your account revokes every connection.
4. Legal basis
The processing of your data is based on the performance of the contract you enter into with us when you start using the service (art. 6.1.b GDPR). Sending transactional emails strictly necessary for the service (sign-in links, list invites) is based on contract performance or our legitimate interest in delivering the feature you requested. Security logs, anti-abuse counters on email functions and abuse prevention rely on our legitimate interest in keeping the service safe (art. 6.1.f GDPR). Visit statistics rely on our legitimate interest in understanding how the service is used (art. 6.1.f GDPR), with aggregated data that cannot identify you.
5. Data processors
We rely on the following sub-processors: Google Ireland Limited (Firebase Authentication, Cloud Firestore, Firebase Storage, Firebase Hosting) for authentication, database, photo storage and app hosting; Resend Inc. for transactional email delivery (list invites, sign-in links, feedback messages and contact form messages); Netlify Inc. for progressive web app hosting, serverless functions and visit statistics. These providers process data on our behalf. Where data is transferred outside the EEA, standard contractual clauses or equivalent safeguards under their agreements apply.
6. Data retention and deletion
Your account data is retained for as long as your account is active. You can delete your account at any time from Settings → Delete account; the operation removes your owned lists, your collaborator references in other users' lists, your personal catalog, your photos, your user profile, disconnects AI assistants and revokes sign-in access. JSON export from Settings creates a file on your device and does not store an additional copy on our servers. Feedback messages submitted through the form are kept for as long as needed to handle the report. Contact form messages are kept in the mailbox for as long as needed to reply. Rate-limit metadata on server functions is kept for short time windows for anti-abuse purposes. Firebase backups follow a 30-day rolling window after which deleted data is permanently removed. Visit statistics are aggregated data, kept without an expiry date.
7. Your rights
You have the right to access your data, rectify it, request erasure, port it to another service, object to certain processing and request its restriction. The erasure right is exercised self-service through the Delete account flow in Settings. The portability right can also be exercised through Export my data in Settings, which downloads a JSON file with your profile, lists, items and catalog. For any other request write to danielebelfiorepc@gmail.com. You can also lodge a complaint with the Italian data protection authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).
8. Children
The service is not directed at users under the age of 16. We do not knowingly collect data from minors. Access requires a Google account or an email address you control; the chosen provider's terms govern the applicable minimum age.
9. Changes to this policy
When we change this policy in a material way we will publish an in-app banner on next sign-in and update the date below. Continued use of the service after the effective date constitutes acceptance of the revised policy.
10. Effective date
This version of the Privacy Policy is effective from 28 October 2026.