Privacy Policy — ListBud
Last updated: October 2026
Summary
Your lists stay on your phone. For a voice command, the recording is sent to our server to be transcribed and interpreted, then deleted: it is not kept on our server. We never sell any data.
1. Introduction
ListBud is a mobile app for creating and managing lists by voice command, developed and published by an independent developer.
The data controller is: Maël THEVENOT, independent developer, based in France.
This privacy policy describes how ListBud collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR) and applicable laws.
2. Data collected
2.1 Data stored locally on your device
The following data is stored on your phone:
- The content of your lists (list names, items)
- The categories assigned to your lists and your custom categories
- Colours and display preferences
✅ This data stays on your device. Only the items described in 2.2 are transmitted, when you use a voice command.
2.2 Data transmitted during a voice command
When you use a voice command, the audio recording is sent to our server, then transcribed and interpreted by the OpenAI API. This processing is necessary for the voice feature; the app remains usable without it.
| Data | Processing |
|---|---|
| Audio recording of your command | Transcribed, then deleted as soon as processing ends. Not kept on our server. |
| Context of the current list (name, category, section headings, Latin-alphabet preference) | Transmitted to interpret the command. Not kept after processing. |
| Names of your custom categories | Transmitted to file your lists correctly. Not kept after processing. |
| Installation identifier | Random identifier generated by the app, not linked to your identity. Used to prevent abuse; only a non-reversible hash appears in our logs. |
| Technical metrics | Action type, detected language, duration and sound levels of the recording, number of items, category, any errors, associated with the hash of the installation identifier. Kept for up to 90 days for debugging and improvement purposes. |
2.3 Data not collected
ListBud does not collect:
- Your identity or contact details — no user account required
- Your location
- Your email address or phone number
- Your browsing data or advertising data
- Your payment details — payment is handled by Google Play
3. Purposes and legal basis for processing
The data processed is used exclusively to:
- Interpret your voice commands and extract the actions to perform
- Link your commands to the context of your current list
- Improve the reliability and performance of the app
- Manage your ListBud Premium subscription and verify your access
- Prevent abuse, by limiting the number of requests per installation
No processing is carried out for advertising, profiling or resale purposes.
Legal basis for processing (Article 6 GDPR):
- Processing of voice data is based on the performance of the service requested by the user (Article 6(1)(b) GDPR).
- Subscription management is based on the performance of a contract (Article 6(1)(b) GDPR).
- Technical metrics and abuse prevention are based on our legitimate interest in ensuring the reliability and security of the app (Article 6(1)(f) GDPR).
4. Data retention
The audio recording and context data (list name, categories, sections) are not kept on our server: each request is processed in real time, then the recording is deleted. OpenAI applies its own API data retention policy to this data.
Technical metrics may be kept for up to 90 days for debugging and continuous improvement purposes.
Subscription data (purchase history, anonymous identifier) is kept by RevenueCat for as long as necessary to manage your subscription.
Data stored locally on your device is kept until the app is uninstalled or the data is manually deleted.
5. Hosting, processors and international transfers
Our server is hosted on Railway (Railway Corp., United States). Requests are secured via HTTPS. Access to the server is protected by an API key and a request rate-limiting system. This transfer to the United States is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission.
Transcription and interpretation of voice commands are performed via the OpenAI API (OpenAI, LLC, United States). Data sent to OpenAI is subject to its own privacy policy, available at openai.com/policies/privacy-policy. OpenAI commits not to use API data to train its models. This transfer is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission and by OpenAI’s privacy policy applicable to API data.
Subscription management is provided by RevenueCat (RevenueCat, Inc., United States). RevenueCat receives your purchase history from Google Play and an anonymous identifier generated by the app, in order to verify your Premium access. This transfer is governed by the Standard Contractual Clauses adopted by the European Commission.
Payments are processed by Google Play, under Google’s privacy policy. No banking data is transmitted to us or to RevenueCat.
6. Data sharing
⛔ We do not sell, rent or share your data with any third party for commercial or advertising purposes.
Data is transmitted only to the technical providers strictly necessary for the app to work (Railway, OpenAI, RevenueCat, and Google Play for payments), for the purposes described above.
7. Your rights
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of the data concerning you
- Right to rectification: correct inaccurate data
- Right to erasure: request the deletion of your data
- Right to object: object to certain processing
- Right to data portability: receive your data in a readable format
To exercise these rights or for any privacy question, you can contact us at the address given in the Contact section. For a request concerning your subscription data, include your installation identifier: a long press on “Version”, at the bottom of Settings, copies it.
Note that since most of your data is stored locally on your device, you can delete it at any time directly in the app or by uninstalling it.
You also have the right to lodge a complaint with the competent supervisory authority. In France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL): cnil.fr.
8. Children
ListBud is not intended for children under 13. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with information, please contact us so that we can take appropriate action.
9. Changes to this policy
We reserve the right to modify this privacy policy at any time. In the event of a substantial change, you will be informed via a notification in the app or via the update of the date at the top of this document.
Your continued use of the app after a change constitutes your acceptance of the new policy.
10. Contact
For any question about this privacy policy or to exercise your rights:
Email: listbud.app@gmail.com
App: ListBud
ListBud — Privacy Policy — Maël THEVENOT