Privacy Policy

Effective: January 1, 2026

We take the protection of your personal data seriously. This policy explains which data Pauly processes, for what purpose, and what rights you have. Pauly is a voice-input shopping list app for iOS and Android.

1. Data Controller

The data controller within the meaning of the GDPR is:

Data controller / contact

2. Data Processed and Storage

2.1 Local Storage

All shopping lists, items, categories and settings you create in the app are first stored locally on your device. The app is fully functional offline.

2.2 Cloud Backup and Shared Lists

When you sign in with an account or share lists, list data is transmitted via TLS encryption to our backend provider Google Firebase. Firebase is operated by Google Ireland Limited. Data is processed on servers within the EU or in regions Google offers. We have a Data Processing Agreement (DPA) in place with Google.

2.3 Voice Recordings

Voice input uses your device's native speech recognition (Apple Speech Recognition or Google Speech-to-Text). Pauly itself does not store any audio files. Processing follows Apple's or Google's privacy policies. We process the recognised text locally on your device to build your list.

3. Authentication

You can sign in using:

  • Apple Sign-In — Apple transmits a user ID and, with your consent, your email address.
  • Google Sign-In — Google transmits a user ID, email address and, with your consent, your display name.
  • Email and password — via Firebase Authentication.

This data is used exclusively for account creation, authentication and account recovery.

4. Analytics and Crash Reports

4.1 Firebase Analytics

We use Firebase Analytics to collect anonymised usage statistics (e.g. number of app launches, features used). No personal names or email addresses are transmitted. You can opt out at any time in the app settings.

4.2 Firebase Crashlytics

If the app crashes, technical information (stack trace, device model, OS version, anonymised installation ID) is transmitted to Firebase Crashlytics to fix the issue. This data is deleted after a maximum of 90 days.

5. Advertising

The free version of the app shows ads via Google AdMob (Google Ireland Limited). AdMob may process device information and an advertising ID for ad personalisation. Before showing the first ad, we request your consent via the User Messaging Platform (UMP) SDK in accordance with the GDPR and IAB TCF. You can withdraw or update this consent at any time in the app settings.

6. Subscriptions and Purchases

Pauly Pro is processed via RevenueCat (RevenueCat Inc., USA). RevenueCat handles App Store purchases and only tells us whether a valid subscription exists. RevenueCat does not have access to your shopping lists or personal data in the app.

Payments are processed exclusively by your App Store provider (Apple App Store or Google Play). We do not receive payment data.

7. Push Notifications

With your consent, we send push notifications via Firebase Cloud Messaging (FCM), e.g. when someone adds an item to a shared list. You can withdraw consent at any time in your device's system settings.

8. Cookies and Tracking

The app itself uses no cookies and no tracking pixels. This website uses only technically necessary server session mechanisms and no tracking cookies.

9. Retention

  • Local data stays on your device until you delete it or uninstall the app.
  • Cloud data is retained for up to 90 days after account deletion and then permanently removed.
  • Analytics and crash data are automatically deleted after 90 days.

10. Your Rights (GDPR)

You are entitled to:

  • Access (Art. 15 GDPR) to the data we store about you
  • Rectification (Art. 16 GDPR) of inaccurate data
  • Erasure (Art. 17 GDPR) — also directly in the app via "Delete account"
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Lodging a complaint with a supervisory authority (Art. 77 GDPR)

Contact us via the address shown in §1 to exercise any of these rights.

11. Children's Privacy

Pauly is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If we become aware of such data, we delete it without delay.

12. Changes to this Policy

We may update this policy to keep it current. We will notify you in the app or by email about material changes. The current version is always available at getpauly.com/en/privacy.

13. Contact

For privacy questions, contact us via the address shown in §1.