Privacy Policy

Last updated: 2026-10-19

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

This policy explains what data Talklist (talklist.app) processes when you use it. In short: there are no accounts, no advertising, no analytics and no cookies.

2. What we process, why, and for how long

Your list

When you add your first item, we create a list. It contains the items (name, category, quantity), whether each is checked, and timestamps. The list is identified by a random, hard-to-guess ID that is part of your list link. We store only a one-way hash (SHA-256) of that ID, not the ID itself. Anyone who has the link can open and edit the list, so do not put personal or sensitive information in it. We delete a list automatically about 180 days after its last change; the database may take a few more days to remove it. We cannot link a list to a person.

Text you say or type

The text you enter or dictate is sent to our server and forwarded to Anthropic (Claude, an AI service) to extract the grocery items. We also send the language settings of your browser (for example “ru, de, en”) so that words from several languages are understood. We do not store the original text, only the resulting items. Please do not include personal data in what you say.

Voice input

Speech recognition is performed by your browser, not by us. Depending on your browser, your audio is sent to its provider (for example Google for Chrome, Apple for Safari, Microsoft for Edge) under that provider’s privacy policy. We only receive the resulting text, never audio. The microphone level display is calculated on your device and is not transmitted.

Technical data and abuse protection

To deliver the site, our hosting provider processes your IP address and request data. To protect the service against abuse, we keep daily request counters under a salted hash of your IP address and delete them after about two days. Error logs, which contain no list text, are kept for 30 days.

Browser storage

Your browser’s local storage keeps the ID of your list and your language choice, so that the list is still there next time. A temporary session value remembers which food icon the microphone button shows. This is strictly necessary for the service you request and is not used for tracking, so no consent banner is needed (§ 25 (2) no. 2 TDDDG). We set no cookies. Fonts are served from our own domain, so no request goes to Google Fonts or similar services.

3. Legal bases

• Providing the list service you request: Art. 6(1)(b) GDPR.
• Security, abuse prevention and stable operation: our legitimate interest, Art. 6(1)(f) GDPR.

4. Who receives data

• Amazon Web Services (AWS): hosting, content delivery, DNS and database, under a data processing agreement.
• Anthropic: processes the text you send in order to extract items, under its commercial terms and data processing terms. Under those terms, data sent through the API is not used to train its models by default.
• Your browser’s provider: for voice recognition, as described above. This is outside our control.

We do not sell data and do not share it for advertising.

5. Transfers outside the EU

Our infrastructure runs in AWS region US East (N. Virginia), and Anthropic operates in the United States. Where required, transfers rely on EU standard contractual clauses or the EU–US Data Privacy Framework as provided by these companies.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection and data portability under the GDPR. Because lists are anonymous, we can only act on a list if you send us its link; to have a list deleted, email us the link. You can also stop using a list at any time and it will expire on its own. You have the right to lodge a complaint with a data protection supervisory authority, for example that of your place of residence or of the German state where we are based.

7. Security

Data is transmitted encrypted (HTTPS) and stored with access restricted to the service. No system is perfectly secure; keep your list link private if the contents matter to you.

8. Changes

We may update this policy when the service changes. The date above shows the latest version.

9. Contact

Questions about privacy: lazurkin@posteo.de.