Green Lists Privacy Policy

Last updated: October 17, 2026

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Green Lists application for iOS, Android, and the web at lists.colorhub.online (the "Application"). The Application is provided by Color Hub, operated by Luka Katsadze, a sole proprietor based in Tbilisi, Georgia ("we", "us", or "our"). Please read this Policy carefully. If you do not agree with it, please do not use the Application.

1. Data Controller

For the purposes of the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR"), the UK GDPR, and similar data protection laws, the data controller for personal data processed in connection with the Application is Luka Katsadze (Color Hub), Tbilisi, Georgia. You can contact us about this Policy or to exercise your rights at support@colorhub.online.

2. Information We Collect

2.1 Information You Provide

  • Email address: if you sign in with email, Apple or Google, to authenticate you and send service communications.
  • User ID: a unique identifier (a Firebase Authentication UID) generated for your account. The Application starts with an anonymous account, which has only this identifier until you link a sign-in method.
  • Display name and profile image: received from a sign-in provider or set by you.
  • Your lists: list names, the products and categories in them (including custom products and categories you create), quantities, and what you have ticked off.
  • Shared lists: the members of each list you share or join, and the invite codes you create.
  • AI assistant conversations: the messages and photos you send to the shopping assistant and its replies (see Section 4).
  • Ideas and feedback: feature ideas you suggest on the in-app ideas board, the ideas you vote for, and ideas you report.
  • Support correspondence: the contents of any messages you send us by email. A support email composed from the Application is pre-filled with your app version, device model, operating system, language and user ID, so that we can help you. You can remove these before sending.

2.2 Information Collected Automatically

  • Internet Protocol (IP) address;
  • device or browser information: operating system and version, device model, language, time zone, and app instance identifiers. On Android, Firebase Analytics may also read your device's advertising identifier. We do not use it for advertising or for tracking you across other apps, and you can reset or delete it in your device settings;
  • usage information: screens visited and features used. We record that a list or product was added, never the names you type;
  • crash, error and performance data (for example stack traces and the device state at the moment of an error);
  • a record of attempts to join lists by invite code, to prevent abuse;
  • subscription and purchase status (entitlement information, never full payment card data).

The Application does not collect location data or your contacts.

3. Shared Lists and Other Users

Your lists are private until you share them. When you share a list with an invite code, or join someone else's list:

  • every member of the list can see and edit its name, products and categories, and can see the other members' display names and profile images;
  • an invite code is valid for 24 hours, and anyone who has it during that time can join the list, so share it only with people you trust;
  • the owner of a list can remove members and delete the list; any other member can leave it at any time.

Your display name and profile image can be read by other signed-in users of the Application so that list members can recognise each other. Your profile image is stored at an unguessable address, and anyone who has that address can open the image.

Ideas board. Ideas you suggest are reviewed by us before publication. Approved ideas are visible to all users without your name. Your votes are not shown to anyone.

Widgets. If you add a home-screen widget, the name and items of the list you choose are stored on your device for the widget to display.

4. The AI Shopping Assistant

The Application includes an optional AI assistant that can read your lists, add items, and tick them off at your request. It is processed by Google's Gemini models through Google Cloud Vertex AI.

  • What is sent: your messages, any photos you attach (for example of a recipe or a shopping list), and the list names and items the assistant looks up to answer you.
  • Storage: conversations and their photos are stored in your account so that you can return to them. You can delete them at any time.
  • Limits: we keep a counter of your requests to apply your plan's limits. It contains no content.

AI replies can be inaccurate. Check what the assistant adds to your lists.

5. How We Use Your Information and Legal Bases

  • To create and maintain your account and sync your lists: performance of a contract (Art. 6(1)(b) GDPR).
  • To operate shared lists: performance of a contract with you and with the other members.
  • To run the AI assistant: performance of a contract.
  • To process payments and manage subscriptions: performance of a contract; legal obligation (tax, accounting).
  • To provide customer support: performance of a contract; legitimate interest in responding to requests (Art. 6(1)(f)).
  • To moderate the ideas board: legitimate interest in keeping it useful and safe.
  • To detect, prevent, and address fraud, abuse, or security incidents, including invite-code abuse: legitimate interest.
  • To analyse usage, fix errors, and improve the Application: legitimate interest.
  • To comply with legal obligations and respond to lawful requests: legal obligation (Art. 6(1)(c)).

We do not use your data for advertising, we do not track you across other companies' apps or websites, and we do not engage in automated decision-making that produces legal or similarly significant effects on you.

6. Cookies and Similar Technologies

The web version uses browser storage and similar technologies to keep you signed in, remember your settings, and protect the service from abuse (Google reCAPTCHA Enterprise, part of Firebase App Check). Firebase Analytics may store an identifier in your browser to measure usage as described in Section 2.2. We do not use advertising cookies.

7. Third-Party Service Providers

  • Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions, Analytics, Remote Config, App Check, Hosting): account identifiers, list storage, uploaded images, device and usage analytics. Your lists are stored in Google's data centres in the European Union.
  • Google Cloud Vertex AI (Gemini models): content you send to the AI assistant.
  • Apple and Google sign-in: authentication, if you choose to sign in with them.
  • RevenueCat: subscription state, purchase events, your account identifier, email address and display name.
  • Sentry: error, crash and performance reports, including your IP address and device context.
  • Apple App Store and Google Play: payment processing and delivery of in-app purchases. We do not receive your full payment card number from them.

8. International Data Transfers

We are based in Georgia. Several of the providers above are established in the United States or other countries outside the EEA, the UK, or Switzerland, and some processing (such as the AI assistant) takes place outside the EU. When personal data is transferred outside the EEA/UK, we rely on appropriate safeguards under Articles 44–49 GDPR, including adequacy decisions (including the EU–US Data Privacy Framework for certified providers), the Standard Contractual Clauses and the UK International Data Transfer Addendum. You can request a copy of the relevant safeguards at support@colorhub.online.

9. Payments and Subscriptions

The Application offers an optional Premium subscription and a one-time lifetime purchase that unlock more list members, the AI assistant without monthly limits, and other features. Billing is processed by the Apple App Store or Google Play, and subscription state is managed through RevenueCat. We receive only the purchase and subscription status needed to deliver your entitlements. Subscriptions renew automatically unless cancelled at least 24 hours before the end of the current period. Cancellations, refunds, and trial terms are governed by the policies of the respective store.

10. Disclosure of Information

We do not sell or share your personal information, as those terms are defined under California law. We may disclose personal data only to the members of lists you share, as described in Section 3; to our service providers (Section 7) acting on our behalf; to comply with law or valid legal process; to protect rights and safety where we believe in good faith that it is necessary; in a corporate transaction such as a merger or asset sale, in which case the recipient must honour this Policy; or with your consent.

11. Data Retention and Deletion

  • Account data, your lists, AI conversations and ideas: for as long as your account exists.
  • Invite codes: they expire after 24 hours; join-attempt records are kept only as long as needed to prevent abuse.
  • Purchase and subscription records: up to 7 years where required by tax and accounting laws.
  • Support correspondence: up to 3 years from the last interaction.
  • Crash and diagnostic data: typically up to 90 days.

Deleting your account. You can delete your account at any time in Settings → Profile → Delete account. Deleting your account permanently deletes your account and all the data associated with it, including the lists you own, your profile image, AI conversations and ideas, and removes you from lists other people shared with you. Lists you own are deleted for their other members too. This cannot be undone. Residual copies in backups are erased within 90 days. Records we are legally required to keep (such as purchase records) are retained only for the period the law requires. You can also ask us to delete your account by emailing support@colorhub.online.

12. Your Rights

12.1 Rights under EU/UK GDPR

If you are in the EEA, the UK, or Switzerland, you have the right to access your personal data (Art. 15), rectify it (Art. 16), erase it (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20), object to processing based on legitimate interests (Art. 21), withdraw consent at any time (Art. 7(3)), and lodge a complaint with your local supervisory authority (Art. 77).

12.2 Rights under California law (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we have collected about you, its sources and purposes, and the categories of third parties we disclose it to; to request deletion and correction; to opt out of the "sale" or "sharing" of personal information (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

12.3 How to exercise your rights

Contact us at support@colorhub.online. We will respond within the time required by law (generally one month under the GDPR and 45 days under the CCPA). We may need to verify your identity first.

13. Children's Privacy

The Application is not intended for children under 13, and we do not knowingly collect personal data from children under 13. Where the minimum age of digital consent under the GDPR is higher in your country, users below that age may use the Application only with the consent of a parent or legal guardian. If we learn that we have collected personal data from a child below the applicable age without such consent, we will delete it. Contact us at support@colorhub.online if you believe this has happened.

14. Security

We protect your information with encryption in transit (TLS), encryption at rest by our cloud infrastructure providers, server-side access rules that restrict each list to its members, rate limits on invite codes, and app attestation that rejects requests not coming from a genuine copy of the Application. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

15. Data Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33 GDPR), and notify affected users without undue delay where the risk is high (Art. 34 GDPR).

16. Consumer Right to Cancel

If you are a consumer in the EU or UK, unless an exception applies, you have a statutory right to cancel a purchase within 14 days without giving a reason, by sending us a clear statement at support@colorhub.online. For subscriptions, this right applies to the initial subscription and not to each renewal. Refunds for in-app purchases are processed by Apple or Google under their policies.

17. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. For material changes, we will give additional notice (for example an in-app notice).

18. Contact Us

For any questions about this Privacy Policy, contact us at support@colorhub.online. See also the Green Lists Terms of Use.