Odinlist ("we", "us", or "our") is operated by Solid Digital Nordic AB, registered in Sweden. Organisation number: 5569575011. Registered address: S. Promenaden 43. For privacy-related questions, contact us at admin@odinlist.com.

This Privacy & Cookie Policy explains how we collect, use, store, and protect your personal data when you use our website and services. It also describes how we use cookies and similar technologies, including Google Analytics and Google Ads when enabled.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection law.

Depending on how you use the service, we may process:

• Account information — name, email address, password (stored hashed), profile photo, language preference, and start-page preference.
• Personal content — grocery lists and categories, todo lists, notes, workout data, and other items you create in your personal space.
• Sharing data — email addresses you invite, share invitations (pending or accepted), and who can access a shared list or note.
• Authentication data — if you sign in with Google, we receive your name, email, and profile picture from Google.
• Technical and usage data — IP address, browser type, device information, pages visited, and interactions with the service (only when you consent to analytics cookies).
• Cookie preferences — your consent choice and the date it was recorded.
• Communications — messages you send to us, such as support requests.

We use personal data to:

• Provide, maintain, and improve the service.
• Create and manage your account and personal space.
• Enable sharing: send invitations, grant access to people you invite, and sync shared content in real time.
• Send transactional emails (e.g. verification, password reset, and share invitations).
• Send a recommendation email to an address you provide when you ask us to — with the message you wrote.
• Remember when you last used the service so we can show occasional, dismissible in-app suggestions.
• Respond to support requests.
• Analyse usage and improve the product — only with your cookie consent.
• Measure and improve advertising — only with your cookie consent, when Google Ads is enabled.
• Comply with legal obligations and protect our rights.

When you share a grocery list, todo list, or note by email, the invitee can see and manage that shared item according to the invitation. Their email address is stored so we can send the invite and link their account when they accept. Do not invite people unless you intend them to access that content.

We rely on the following legal bases:

• Contract — to provide the service you signed up for.
• Legitimate interests — to secure the service, prevent abuse, and improve functionality (balanced against your rights).
• Consent — for optional analytics and advertising cookies, and for marketing communications where applicable.
• Legal obligation — where we must retain or disclose data by law.

Cookies are small text files stored on your device. We use them to keep you signed in, remember your preferences, and — with your consent — understand how our service is used.

These cookies are required for the application to function. They include session authentication, security (CSRF), and your cookie consent choice. They cannot be switched off.

With your consent, we use Google Analytics 4 to understand how visitors use our service — for example, which pages are visited and how long users stay. Google may process data on servers outside the EU/EEA. We enable IP anonymisation where supported. You can read Google's privacy policy at https://policies.google.com/privacy.

Typical cookies: _ga, _ga_* — duration up to 2 years.

When we enable Google Ads, and only with your consent, we may use cookies and similar technologies to measure ad performance, limit how often you see an ad, and deliver more relevant advertising. Google may use your data for personalised ads according to your Google account settings. You can manage ad personalisation at https://adssettings.google.com.

Typical cookies: _gcl_*, IDE, test_cookie — durations vary.

You can accept or decline optional cookies at any time. Use Cookie settings in the sidebar when signed in, or the cookie icon in the corner of the page when signed out. Declining optional cookies will not affect essential functionality.

We share data with trusted processors who help us operate the service:

• Google — OAuth sign-in, Analytics, and Ads when enabled (privacy policy: https://policies.google.com/privacy).
• Hosting and infrastructure providers necessary to run the application.
• Email delivery providers used to send verification, reset, invitation, and recommendation emails.

We do not sell your personal data.

Some processors (such as Google) may transfer data outside the EU/EEA. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

We keep your data for as long as your account is active or as needed to provide the service. When you delete your account, we delete or anonymise your personal data and content within a reasonable period, except where we must retain it for legal purposes. Revoking a share removes that person's access; invitation emails we already sent may remain in their inbox.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, and access controls. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten") in certain circumstances.
• Restrict or object to processing in certain circumstances.
• Data portability — receive your data in a structured format.
• Withdraw consent at any time (without affecting prior processing).
• Lodge a complaint with your supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY).

To exercise your rights, contact us at admin@odinlist.com. We will respond within one month.

The service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us.

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. For material changes, we may notify you by email or through the service.

Data controller: Solid Digital Nordic AB
Email: admin@odinlist.com
Address: S. Promenaden 43

See also our Terms of Service.