Erlist helps households plan meals, check what they have, shop together and keep their
recipes. This policy explains what we collect, why, and who we share it with.
What we collect
- Account details: your email and name, so you can sign in and your household can see who added what.
- What your household makes in the app: plans, meals, pantry checks, shopping trips, Don't forget items, and recipes with their photos.
- Paper receipts: the receipt photos you add, their total and date as you confirmed them, and the lines bought on them, kept as prices (what each item cost, at which store and when). A photo can show what the store printed on it, such as its address or the last digits of a card, and only your household can see it.
- Recipe imports: the link you import from and the page we fetch for it, the files you upload, and for a video, the text your phone read from it (see below).
- Public profile: if you set one up, your @handle, the name you show and a photo.
- Product-usage analytics: events about how the app is used (for example, that a shopping trip was completed), tied to a per-user id like
user_123, never to your email or name.
- Crash and performance data: reports when the app crashes, and Apple's daily performance summaries, so we can fix problems.
- Push notification token: an Apple device token so we can send the notifications you enable.
- Suggestions and bug reports: what you write when you send us one from the app, a screenshot if you add one, the screen you sent it from, your phone model, its iOS version and the app version, and our reply.
- Website page views: when you visit this site, we record the page and a one-way hashed version of your IP address, plus your browser (user-agent), in our own database. We can't reverse the hash back to your IP address.
- Waitlist email: if you join the iPhone beta waitlist, the email you give us and which campaign link brought you, used only to invite you.
Website cookie. Our home page sets one anonymous first-party cookie: a random id,
not linked to your name or email, so we can measure which version of the page works better
(for example, which headline leads more people to try the app). It stays on this site and lives
until you clear it. There are no third-party trackers or advertising cookies on our website.
What stays on your phone
- Videos you import. Your phone listens to the speech and reads the text on screen itself, using Apple's on-device recognition. The video and its sound stay on your phone; only the resulting text (the timed transcript and on-screen text) is sent to us. Step photos taken from the video are uploaded only if you keep them.
- Instagram reels you import are downloaded by the app on your phone.
- A paper receipt's text is read on your phone, using Apple's on-device recognition, to find its total, its date and the lines bought. Only the photo, the numbers you confirm and the lines bought (each one's text, quantity, price and place on the photo) are sent to us: never the store's header, the payment or a loyalty number.
- Hands-free Cooking Mode watches for your raised hand with the camera on your phone; no camera image leaves it.
- Offline copies. So the app works without signal, it keeps recent answers and changes waiting to be sent on your phone. They're cleared when you log out.
- Your sign-in is kept in the iPhone Keychain.
Who we share it with
We do not sell your data, and nothing is used to track you across other apps or websites. We use a small set of processors to run the service, and each gets only what it needs:
- Railway: hosts our servers and database, so it holds everything described above.
- Cloudflare (R2): stores the files you add, such as recipe photos, profile photos, receipt photos and imported files.
-
Anthropic (Claude): reads text so the app can do the work for you. Our servers send it recipe text
(titles, ingredient lines and steps) to read amounts, name and tag ingredients, link steps to their ingredients and
check a recipe before it's published; for an import, the links you import from and the page text we fetched for them,
and the transcript, on-screen text and Instagram caption of a video; the names of items to sort them into aisles and
sections; when you ask for ingredient swaps, the recipe's title and ingredients and your note; for a paper receipt, the text of the lines bought on it and the trip's item names, to say which item each line is; and, in the shelf scan
(still in testing), a crop of an item so it can suggest a description. Erlist never sends your email or name to it.
- TypeSafe (Jev): if you use the shelf scan (still in testing), our servers send it the shelf photo, crops of it, and your household's item names and descriptions, to find what's on the shelf. Scanned photos aren't stored, unless you choose to save one as a labelled example.
- RevenueCat: manages subscriptions to household plans. The app gives it your Erlist account id (a number, not your email or name) and your App Store purchase info: which plan you bought, when, and when it renews or ends. It tells our servers the same, and we keep it with your household.
- PostHog (EU region): product analytics, crash reports and feature flags, plus how long the app's requests take to our servers and which ones fail (sampled). It gets the events, the per-user id described above, a random id for the install, and your phone model and iOS and app version, not your email or name.
- Resend: sends our email, such as password-reset messages, which carry your name and email, and forwards what you email to support@erlist.app to us.
- Better Stack: checks every few minutes that our servers are up (uptime monitoring). It only calls our status page and receives no personal data.
- Apple: Sign in with Apple, if you use it, gives us your name and email (or a private relay address); StoreKit and the App Store handle payments for household plans, so we never see your card; and Apple Push Notification service (APNs) delivers push notifications to your device token.
When you import a recipe from a web page link, our server fetches that page itself, so the site sees our server, not you.
This website and the app's What's new page load their fonts from Google Fonts, so Google sees your IP address
when they load; no cookies are set.
If you connect a supermarket account on the website (Albert Heijn, Jumbo or Picnic), the items you send go to
that supermarket's cart with the access you gave.
Public profiles and published recipes
Recipes stay within your household unless someone in it publishes one. A published recipe can be read by anyone,
including people without an Erlist account, credited to the publisher's @handle. Your public
profile (your handle, the name you show, your photo and the recipes you published) can be seen by anyone signed in to Erlist.
A published recipe's text and photos are shared under the
Creative Commons Attribution-ShareAlike 4.0 licence (CC BY-SA 4.0).
Any member of your household can make it private again; copies other people made while it was public keep the
licence they received.
Your choices and rights
You can permanently delete your account at any time from inside the app: tap your avatar to open
Profile → Delete Account. Deletion is immediate and can't be undone. Your account, sign-ins, devices,
feedback, imports, saved recipes, reviews and profile photo are deleted. In a household you share, what the household
uses (its plans, lists and Don't forget items) passes to another member, and the recipes you wrote stay for the
household without your name; a household only you were in is deleted with everything in it. Recipes you published
stay published. We keep a change history of records for security and support, which isn't deleted with the account.
You can take your recipes with you: Profile → Export your recipes gives you a zip of your and your household's
recipes, with their photos, in the standard schema.org format.
For any privacy question or request, email us at
support@erlist.app.
Analytics are hosted in the EU to support GDPR requirements.