Hummlist Join the waitlist

Privacy policy

This is a translation. The German version is authoritative.
Last updated: 7 November 2026

This page explains which personal data Hummlist processes, why, on what legal basis, who receives it and what rights you have. Hummlist is a shopping-list app for households on iPhone, Android and in the browser (app.hummlist.com), with the website hummlist.com.

1. Controller

Peter Trost, Yalovastr. 5, 72108 Rottenburg am Neckar, Germany. E-mail: support@hummlist.com. No data protection officer has been appointed.

2. Website hummlist.com

The website sets no cookies, loads nothing from other servers and uses no analytics. The pages are served as static files. Only the waitlist form sends your details to our server, a function at Vercel (section 2a). The connection is received by the Vercel location nearest to you. Vercel is a US company; access from the USA is possible, and the transfer relies on the EU-US Data Privacy Framework and Standard Contractual Clauses (section 13). When you visit it, our host Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) processes technically necessary data: IP address, time, page requested and browser identifier. This is needed to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR; our legitimate interest is secure operation). Server logs are kept for at most 30 days.

2a. Beta waitlist

If you join the waitlist on hummlist.com, we store your email address, whether you have an iPhone or an Android phone, the language of the page (German or English), whether you also want an email when the app launches, the times you signed up and confirmed, and the version of the consent text.

Why: we send you an email to confirm your address, then a welcome email and the invite to the Hummlist beta. Only if you ticked the box do we also email you once when the app officially launches. We need your phone platform to invite you the right way, and the language to write to you in German or English. For the invite we pass your email address to Apple (TestFlight) or Google (Google Play); Apple or Google then sends you the invite (section 12).
Legal basis: your consent (Art. 6(1)(a) GDPR).

Confirmation: you are only on the list once you tap the link in the confirmation email. The link works for 48 hours. We store only the time, not your IP address. If you don't confirm, we delete the sign-up after 7 days.

If an AI assistant or someone else enters your address for you, we only send the confirmation email. You're only on the list once you agree yourself on the confirmation page. Until then we keep your details (address, phone platform, language) based on our legitimate interest in checking that the address really is yours (Art. 6(1)(f) GDPR) and delete them after 7 days; the delete link in the email does it right away. We don't store who or what entered the address.

We invite in weekly groups: everyone who confirmed in the same calendar week. We start each invite by hand; there is no automated selection.

Service providers: the form is received by our host Vercel; the server function runs in Frankfurt am Main, and Vercel sees your IP address as with every visit (section 2). Sign-ups are stored at Supabase in the database in Frankfurt am Main. Emails are sent by Resend from Ireland; Resend stores the emails and delivery logs in the USA and deletes them after 30 days (sections 12 and 13). Our emails contain no tracking pixels, and links are not redirected to count clicks.

Unsubscribe and objection: every email has an unsubscribe link; one click is enough, no sign-in. You can also write to support@hummlist.com. This withdraws your consent for the future and objects to the use for these emails (Art. 21(2) GDPR); we delete your sign-up at once.

Retention: without the launch email, we delete your sign-up 3 months after the beta invite is sent; with it, 30 days after that email is sent, and in any case by 31 December 2027.

Proof of consent: so that we can show you agreed, we keep a record after the end: a check value of your email address from which the address can't be read, the version of the consent text, the language and the times of sign-up, confirmation, last email and unsubscribe. We delete it after 3 years. Legal basis: Art. 6(1)(c) GDPR with Art. 7(1) GDPR, and Art. 6(1)(f) GDPR (our legitimate interest in being able to prove consent).

The waitlist and the beta are for people aged 16 and over.

3. Web app app.hummlist.com

The web app is also delivered by Vercel as static files (see section 2). The web app currently loads program libraries and fonts from Google servers (gstatic.com); Google receives your IP address when it does. We will change this shortly.
Hummlist stores the following in your browser's local storage or on your device: your sign-in session; a copy of your list and your list settings, so the app starts quickly and works offline; your language; and your choice about usage data (section 9). These are strictly necessary for the app you asked to use (§ 25(2) no. 2 TDDDG). A service worker caches the app files. A random installation ID is stored only if you allow usage data (section 9).

4. Account and sign-in

For an account we process your e-mail address, a password (stored only in hashed form) or your Google or Apple sign-in, and a display name. If you sign in with Google or Apple, we receive your account ID, your e-mail address (with Apple possibly a relay address) and, if provided, your name; Google or Apple learn that you sign in to Hummlist. Sign-in links and confirmations are e-mailed via our service provider Supabase.
Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

5. Shopping list and household

We store what you enter in Hummlist: the household name, members and their roles, invitations, items (item name, quantity, who added and bought it, timestamps), a history of changes, and what Hummlist learns for your household (categories, stores, brands). All members of your household see the list, the history and the other members' display names. Invite links expire after 7 days and work only once.
Legal basis: Art. 6(1)(b) GDPR.

Hummlist Premium in the beta

For testers and for Apple's and Google's review of the app, we unlock Hummlist Premium free of charge; the unlock lasts until we end it. You buy nothing and pay nothing, and the unlock never turns into a paid purchase or subscription. For this, we create your household at our processor RevenueCat, Inc. (USA, sections 12 and 13) with the household's ID (a random number, not your account ID) and give it the free unlock there with a start and end date. RevenueCat receives only this ID and the details of the unlock, no names, e-mail addresses, account IDs or list content; because we do this and not the app, it doesn't receive your IP address or device data either. Our server asks RevenueCat which unlocks the household has and stores only that a free unlock exists, since when and until when. When RevenueCat reports a change, we store only the report's ID and type, for 90 days. The household's members see in the app that it is unlocked free of charge. If anyone in that household sends usage data (section 9), we mark it as internal so it is left out of our statistics.
Legal basis: Art. 6(1)(f) GDPR (our interest in testing the unlock under real conditions before sales start, giving testers Hummlist Premium free of charge, having the app reviewed by Apple and Google and preventing misuse). You can object at any time (section 15); we will then end the free unlock for your household and have its record at RevenueCat deleted.
Retention: we delete the entry on our side when the unlock ends or we end it, at the latest with the household. We delete the household's record at RevenueCat 30 days after the household is deleted.

6. Voice input

When you dictate an item in the iPhone or Android app, your operating system's speech recognition turns speech into text. This happens only on your device: if the device cannot recognise German without the internet, Hummlist does not offer voice input. There is no voice input in the browser. The app sends the recognised text to our server, which turns it into items; we never receive audio.
Legal basis: Art. 6(1)(b) GDPR.

7. Siri, Alexa and AI assistants

You can connect Hummlist to AI assistants (for example through the Model Context Protocol at mcp.hummlist.com) or to Siri through a shortcut you set up yourself. This only happens if you create an access token or approve a connection yourself. For Siri directly in the iPhone app, see "Siri on iPhone" below. The connected service can then read and change your list items, and its provider processes that content under its own privacy terms. For each token we store a name, a hash, its last four characters and when it was last used. When a token ends, for example because you revoke it or leave the household, we delete this data at the next daily clean-up 30 days later. You can revoke tokens and connections in the app at any time.
Legal basis: Art. 6(1)(b) GDPR.

Siri on iPhone

When you are signed in to the iPhone app and belong to a household, the app automatically creates its own access token for Siri; you don't need to do anything. In the app it is called "Siri (this iPhone)". The token is kept in this iPhone's Keychain and is not transferred to other devices. For it we store a hash (SHA-256) of the token, its last four characters, the name "Siri", which sign-in session it belongs to, and when it was created and last used. The token only works for Siri requests to Hummlist, and only while you are signed in and a member of that household.

When you ask Siri to add something to your list or read it out, Apple turns your speech into text. We do not receive a voice recording. We only receive the recognised text or the name of a suggestion you picked (for example "milk"), whether you want to add or hear items, the language (German or English) and the token. When reading out, no text is sent. We add the items to your household's list just as if you had entered them in the app; the other members see them. We do not write the text to logs or to usage analytics; for errors we only log the type of error.

So that Siri understands phrases like "Add milk to Hummlist", the app stores up to 50 item names of your household on your iPhone and passes them to iOS's App Shortcuts. How Apple processes your speech, its transcript and this data is governed by Apple, as an independent controller, in its privacy policy and in your iPhone's Siri settings; we have no influence on this.

The token ends when you sign out, leave the household, delete your account, revoke it under More › Access, or sign in again on this iPhone (the app then creates a new one). Each account has at most five Siri tokens; when another is added, the oldest ends. After a token ends, we keep its stored data for 30 more days so we can look into misuse or questions, then delete it at the next daily clean-up. If the token ends because you signed out, we notice this by the next day at the latest.
Legal basis: Art. 6(1)(b) GDPR.

Amazon Alexa

You can enable the Alexa skill "Hummlist" in the Alexa app and link it to your Hummlist account. To do so, you sign in to Hummlist and allow "Amazon Alexa" to access your list. Amazon receives an access token and a refresh token for this and keeps them.

When you ask Alexa to add something to your list or read it out, Amazon records your speech and turns it into text. We do not receive a voice recording from Amazon, only the recognised text (for example "milk and eggs"), the kind of request, the access token, an ID of your Alexa account and technical details about the device and language. We do not use the device ID. We add the items to the list of your current household, just as if you had entered them in the app; the other members see them. In our reply we send Amazon the item names, which Alexa reads out to you and shows as a card in the Alexa app: the items just added, or up to 10 open items on your list.

For this we store a hash (SHA-256) of your Alexa ID, which sign-in session belongs to it and when you last used the skill, so that we can end the connection when you disable the skill. We also count how many items you added in the current minute (at most 30). We delete this data as soon as the connection ends: when you disable the skill in the Alexa app, link it again, choose "Disconnect Amazon Alexa" under More › Access, or delete your account. If you don't use the skill for 12 months, we end the connection and delete this data as well. If you only unlink in the Alexa app, Amazon deletes the tokens; the entry under More › Access stays until you remove it or it has gone unused for 12 months.

Amazon processes your voice recordings, their transcript and our replies as an independent controller under Amazon's Alexa Terms of Use and privacy notice. For Alexa on amazon.de, your contract partner is Amazon Media EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg. How long Amazon keeps voice recordings and how you delete them is set in the Alexa app; we have no influence on this.
Legal basis: Art. 6(1)(b) GDPR.

8. Export your data and delete your account

Account › Export my data gives you your data as a JSON file. Account › Delete account deletes your account immediately. What happens to shared households is explained at https://app.hummlist.com/konto-loeschen.html.

9. Usage data and error reports (only with consent)

Only if you agree, Hummlist stores a random installation ID on your device and sends usage data and error reports to our processor PostHog Inc. (servers in the EU, Frankfurt). Sent: the installation ID, your household's ID, platform, app version, technical details of the device and the app (in the iPhone and Android app: app build, device maker, model and type, operating system and version, screen size, language, time zone, whether Wi-Fi or mobile data is used, on Android also Bluetooth status, the mobile network's name and the system's HTTP user agent; in the browser: browser and operating system with version, device type, screen and window size, language and time zone, but never the page address or the referring page), a random session ID that changes after 30 minutes without use, actions such as "app opened for the first time", "household created", "invite accepted", "item added/ticked off" and "category/store reordered" (with details such as your role in the household, the number of members and whether an item was typed, dictated, suggested or added through Alexa), and error reports. We clean errors in the app's own code before sending. If the iPhone or Android app crashes, it sends the operating system's crash report (error type, error message, technical stack trace) at the next start; we don't clean this one, but it normally holds none of your list content. For in-app purchases our servers send the purchase event (purchase, refund or restore) with the same installation and household ID, with product, price, currency, store, country and a pseudonymised purchase reference (hash), but without payment data; this too only if you agreed. If you add an item through Alexa that was not yet on the list, our servers send the event "item added" marked "through Alexa", with your role and the number of members, under the installation ID of the device on which you last decided about usage data, and only if that decision was yes. To make this possible and to be able to prove your consent, we store for your account, per installation, your decision (yes or no), when you made it, which version of this notice you saw and the installation ID: for a yes the new one, for a no the previous one, if there was one, so that we can match your withdrawal to that ID and send nothing more under it; at most the 20 most recent decisions. If we change the notice to cover new purposes or data, we ask you again and send nothing until you answer. They are deleted with your account (legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). Never sent: item names, list contents, names, e-mail addresses, IP address and location. PostHog creates no person profile and does not derive a location from the IP address. The data is pseudonymous. Also only with your consent, the app asks PostHog, using the installation ID, which features are switched on for your installation. For this, in the iPhone and Android app, the PostHog software stores the installation ID, events not yet sent and the answer about switched-on features on your device; in the browser it stores nothing. If you switch usage data off, we delete this on your device.
Purpose: to see which features are used, find bugs, measure whether Hummlist pays for itself and switch new features on step by step.
Legal basis: your consent (Art. 6(1)(a) GDPR; for storing the ID, § 25(1) TDDDG). You can withdraw it any time under More › Usage data, with effect for the future.
Retention at PostHog: 1 year.

Separately, our servers report errors in server functions to PostHog. Such a report contains the name of the server function, the kind of error, a shortened and cleaned-up error message and the places in the program code where the error occurred. It contains no user, household or installation ID, no e-mail addresses, no list contents, nothing from the request and no IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free operation). Retention at PostHog: 1 year.

10. Contact and support

If you write to support@hummlist.com, hello@hummlist.com or feedback@hummlist.com, we process your e-mail address and your message to reply. Google hosts these mailboxes (Google Workspace, see sections 12 and 13). Peter Trost writes and sends every reply himself.
Legal basis: Art. 6(1)(b) GDPR where it concerns your account, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). Support e-mails are deleted 6 months after the request is closed.

If you send us feedback in the app, we store your message (up to 2,000 characters), the category if you choose one, whether we may contact you about it, app version and build, platform, operating system version (in the browser: browser and operating system), language and the screen you wrote from, together with your user and household ID, at Supabase (servers in the EU). Other members of your household can't see your feedback; only Peter Trost can read it. We use it to fix bugs and improve Hummlist. If you allow it, we reply to your account's e-mail address. We delete feedback automatically after 12 months, and at once if you delete your account. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a bug-free, better app).

11. Backups

An encrypted backup of the database is made every night and deleted automatically after 90 days. It is used only to recover from failures. Location: GitHub Inc., USA (as an encrypted file).
Legal basis: Art. 6(1)(f) GDPR (data security, Art. 32 GDPR).

12. Recipients and processors

These service providers process data on our behalf and on our instructions (Art. 28 GDPR):

Independent controllers: Google or Apple when you sign in with them; Google, as long as the web app loads program libraries and fonts from gstatic.com (section 3); the provider of your operating system's speech recognition; AI assistants you connect yourself; Amazon, when you use the Alexa skill (section 7); Apple and Google as app stores and as providers of TestFlight and Google Play when we invite you to the beta (section 2a).

13. Transfers outside the EU

Some providers are based in the USA or belong to US companies. Supabase's server functions, except the one for purchases, can also run in data centres outside the EU (see section 12). Where data is transferred to the USA or other third countries or US authorities could access it, we rely on the following:

You can get a copy of the safeguards from support@hummlist.com.

14. Retention

We keep your data as long as you have an account. When you delete your account, we delete your account, profile, memberships, access tokens, connections (Alexa included) and your usage-data decisions immediately; for purchases we remove the link to your account. We delete a household's record at RevenueCat 30 days after the household is deleted (section 5). We also delete Alexa connection data as soon as the connection ends (section 7). If you are the last member of a household, the household and everything in it is deleted, as is any household you archived. If you leave a household with Hummlist Lifetime as its last member without deleting your account, the household and its data are deleted. Hummlist Lifetime ends with the household. Otherwise the items and history stay for the other members, without any link to you; the item names remain visible. We keep shared household data, the history included, as long as the household exists, archived households included. Our database provider's logs are deleted after at most 1 day, backups after 90 days, and usage data and error reports at PostHog after 1 year. For the waitlist, the periods in section 2a apply.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw any consent with effect for the future (Art. 7(3)). Write to support@hummlist.com.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart).

16. What you must provide; no automated decisions

You can't create an account without an e-mail address or a Google/Apple sign-in; everything else is voluntary. We make no automated decisions and do no profiling within the meaning of Art. 22 GDPR. Hummlist shows no ads and sells no data.

17. Minimum age

Hummlist is for people aged 16 and over.

18. Changes

We update this policy when Hummlist changes. The version published here applies.