Who is responsible
monpetitlistou is operated by the operator of monpetitlistou, who is the data controller for everything described here. For any question about your data, or to exercise any of the rights below, write to [email protected].
What is stored
- Your lists. Titles, items, notes, quantities and the state of each item — whatever you type. This is the service; there is no version of it that does not store it.
- A display name, if you give one. Free text you choose, shown next to the things you did so the other people on a list know who did them. It is visible to everyone holding the link, which is why the field asks for a first name.
- A device identifier. A random value in a cookie, created the first time you use the app. It is what makes a list yours without an account. It says nothing about you and is not linked to anything outside this app.
- If you sign in with Google: your Google account identifier and the name on it, taken from the sign-in session on each request. Your email address and avatar are received from Google during sign-in and are not copied into our database.
- Technical records. A hashed form of your IP address, used only to stop one source from flooding the service, and server logs from our host.
Why, in legal terms
Storing and showing your lists is our legitimate interest in delivering the service you asked for — it is strictly necessary, and there is no way to provide a shared checklist without keeping the checklist. Signing in is optional and is performed at your request. Rate-limiting is our legitimate interest in keeping the service available to everyone.
We ask for no consent, because we set no advertising or tracking cookies and run no cookie-based analytics. That is also why you are not being shown a cookie banner: there is nothing to consent to. If that ever changes, the banner comes with it.
Cookies
All five are strictly necessary, and none of them are used to profile you.
- anon_id
- The device identifier described above. Signed and server-only, so it cannot be forged.
- grants
- Remembers that you opened a share link, so you keep access to that list.
- display_name
- The name you chose, so the app does not have to ask again.
- NEXT_LOCALE
- The language you chose, so every page opens in it.
- Session cookie
- Present only while you are signed in with Google.
How long
- Lists made without an account: 90 days after the last change. The list page warns you two weeks before, and any edit — or signing in — resets the clock. Signing in removes the deadline entirely.
- Lists owned by an account: until you delete them. There is no inactivity deadline.
- Deleted lists: 30 days in the trash, then removed. Deleted items behave the same way, so that a device which was offline can learn they are gone.
- The change log: 7 days. It is what powers the activity trail and offline sync.
- Hashed IP addresses: 24 hours.
Who else is involved
We do not sell anything and we share nothing for advertising. The service runs on other companies’ infrastructure, and they process data on our behalf:
- Vercel — hosting and delivery.
- MongoDB Atlas — the database, hosted in the European Union.
- Google — sign-in, only if you choose to use it.
Some of these are US companies and may process data outside the European Union, under the transfer safeguards in their data processing agreements. If another processor is added — for error monitoring or for aggregate, cookieless usage statistics — this list is updated before it starts.
Sharing a list, and publishing one
A share link grants whoever holds it the access it was made for. Treat it like a key: anyone it reaches can read the list, and an edit link lets them change it. You can revoke links at any time from the list’s share panel.
Publishing a list is different and deliberate: a published list is visible to anyone and may appear in search engines. Lists shared only by link are never indexed.
Your rights
- A copy of everything. Signed in, use Export my data in settings, or call
GET /api/account/export. It returns every list your account owns as one JSON file. - Deletion. Delete my account in settings removes your account and the lists it owns, immediately and irreversibly. Lists other people own stay, with your contributions no longer attributed to you.
- Correction. Change your display name at any time; it applies to what you do next, and past entries keep the name that was shown when they happened.
- Objection and restriction, and the right to complain to the CNIL (France) or to the authority where you live.
Without an account there is nothing for us to look up: a request would have to identify a list, and we cannot verify who a device belongs to. Deleting a list you own, or clearing this site’s data in your browser, is the equivalent — and is under your control rather than ours.
Children
The service is not directed at children, and we do not knowingly collect data from them. A list a family shares is a family’s list; nothing here asks a child for anything about themselves.
Changes to this page
If what we do changes, this page changes first, and the date at the top moves with it. The terms are the other half of the same answer.