A clear explanation of how to use LilliBasket, which data it needs to operate, and the limits we set.
2026-10-28 · 2026-10-28.1
Terms of Use
Document version: 2026-10-28.1
Terms of Use Effective date: Oct 28, 2026
1. Subject
LilliBasket is used to organize shopping lists and products together within households. These terms apply to the version of the app that runs on the operator's own infrastructure (details in the Privacy Policy).
2. Account and sign-in
Using the app requires a LilliBasket account with an email address and password. Registration is completed with a confirmation code sent by email; the password can be reset the same way. Older versions of the app used Google sign-in on Google Firebase infrastructure; the previous terms apply to them until they are replaced.
3. Household and invitations
A user can create a household as owner and add other people using a time-limited invitation code that is checked on the server. Codes may only be shared with authorized people. The owner can transfer ownership to another member and remove members.
4. Permitted use
The app may only be used lawfully. Users must not store content they are not entitled to process, and should not capture unnecessary personal or sensitive information in product photos.
5. Fees and future plans
Using the app is currently free of charge. In this version, the app offers no way to purchase and does not conclude any paid contract. Paid plans (Premium, Premium+) with their own limits, in particular for product photos, are planned for the future; they only become binding with an actual purchase offer including prices, terms and withdrawal information. Until then, the operator can determine and adjust the scope of free use.
6. Operator limits
The operator can set maximum values per account, for example for the number of households or memberships. When a maximum is reached, only the creation of new items is prevented; existing households, memberships and content are never automatically deleted as a result.
7. Account deletion
Users can delete their account themselves in the app. Deletion requires entering the current password. Anyone who is owner of a household with other members must first transfer ownership or delete the household. When the account is deleted, all sessions and devices are signed out, own households without other members are deleted as well, and memberships in other people's households are ended. The email address can then be used for a new account; doing so does not restore the previous account's data or permissions. The Privacy Policy provides information on deletion periods.
8. Household and list deletion
The owner triggers the permanent deletion of a household by entering a deletion word. It affects all members and removes the associated lists, products, memberships and stored product photos in the server-side deletion process. Old shopping lists are not deleted merely because of inactivity without prior inquiry and confirmation. Legally required retention remains unaffected.
9. Telegram input (optional)
The owner of a household can connect authorized private Telegram accounts to the household using a link code and can end these links in the app at any time. Messages to the operator's bot are assigned to the linked household and processed as a list entry or, if clarification is needed, as a review suggestion. Telegram's own terms of service apply to Telegram; the members are responsible for which Telegram accounts they link.
10. Acceptance of these terms
To use the app, you accept the Terms of Use. The Privacy Policy explains how your data is processed; acknowledging it is not a blanket consent to additional processing. Where an optional feature requires consent, it is requested separately and can be withdrawn for the future. Acceptance and acknowledgment are recorded on the server with version and time. When there is a new version, you are asked to accept again; without acceptance, the app cannot be used any further. Regardless of this, data protection rights can be exercised at any time through the privacy contact.
11. Switchover without data transfer
With the switch to the operator's own infrastructure, LilliBasket starts with an empty data set. Data from older versions (Google sign-in) is not transferred. The older services are being shut down.
12. Availability
Availability at all times or freedom from errors cannot be guaranteed. Network, server and maintenance disruptions can temporarily limit features.
13. User content
Users remain responsible for their entries and photos. Unlawful content can be blocked or deleted.
Features and terms may be further developed. Significant changes will be communicated in a suitable form and require renewed acceptance under Section 10.
16. Mandatory consumer rights
Mandatory consumer protection laws of the country in which the user has their habitual residence remain unaffected.
17. Operator and contact
Lillime Lab – Volker Schepler UP Compound, IRRI Staff Housing 40, 4031 Los Baños, Laguna, The Philippines Contact: info@lillibasket.com
18. Third-party components and open-source licenses
The app contains third-party libraries and other components. Their respective license terms apply to those components, including associated copyright notices, disclaimers and any source-code rights. These Terms of Use do not restrict rights granted by the respective open-source licenses. Available original texts and notices are provided in the app under Settings → Legal → Third-party licenses; they can also be opened before accepting these Terms of Use. License texts are provided in their original language. Optional external services are additionally governed by their own terms. Naming providers or trademarks does not imply that those providers endorse or support LilliBasket.
Privacy Policy
Document version: 2026-10-28.1
Privacy Policy Effective date: Oct 28, 2026
1. Controller
The controller responsible for data processing is: Lillime Lab – Volker Schepler UP Compound, IRRI Staff Housing 40, 4031 Los Baños, Laguna, The Philippines Contact: info@lillibasket.com
2. Where the data is processed
This Privacy Policy applies to the version of LilliBasket that runs on the operator's own infrastructure: a server in a data center in Vienna, Austria (hosting provider: netcup GmbH, Karlsruhe, Germany). Account data, household data and lists are stored there in a database; product photos are temporarily held there as files for transfer between devices (Section 5). No Google services are used for sign-in, storage or synchronization.
Transition period: Older versions of the app still use Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions). The previous privacy policy applies to these versions until they are shut down. Data from the older versions is not transferred to the new system.
3. Data processed
To the extent the respective feature is used, LilliBasket processes:
- Account data: email address, password (only as a cryptographic hash), time and version of acceptance of the Terms of Use and of acknowledgment of this policy; - Session and device data: signed-in devices with a technical identifier, session durations; - Household and membership data, including invitation codes; - Shopping lists, products, quantities, notes and list-specific stores; - optionally scanned barcodes; - Product photos and thumbnails (Section 5); - Review inbox items (entries flagged for review); - with a linked Telegram input: Telegram user and chat ID, display name, message ID and incoming message texts (Section 7); - Technical protection and operational data: events for rate limiting (including IP address), a change log for synchronization (90 days) and duplicate detection records (180 days).
For registration and password reset, the operator sends emails with confirmation codes to the address provided.
4. Purposes and legal bases
The data is processed to provide sign-in, shared households, synchronization, offline use, product memory, photo/barcode features, invitations, review workflows, the optional Telegram input, security and support. Where the GDPR applies: the core features (account, households, lists, synchronization, photos, email codes) are based on performance of a contract (Art. 6(1)(b) GDPR); security and protection measures (rate limiting, abuse prevention, technical logs) on legitimate interests in secure and stable operation (Art. 6(1)(f) GDPR); optional links such as the Telegram input on your separately given, withdrawable consent through active setup (Art. 6(1)(a) GDPR).
For barcode and text recognition performed at your request, Art. 6(1)(b) GDPR applies where the GDPR is applicable. Technical diagnostics and abuse prevention serve the legitimate interest in reliable and secure features (Art. 6(1)(f), where legally permitted). Advertising processing that requires consent is based on your separate consent (Art. 6(1)(a)); withdrawal takes effect for the future. Acknowledging this policy is not blanket consent to SDK data processing. Sections 14 and 15 describe the Google services in more detail.
5. Product photos and barcodes
Barcodes can be used by all users. The camera original of a product photo is processed locally; a compressed product image and a separate thumbnail are stored.
Product images and thumbnails are stored on participating devices and temporarily held on the server for transfer. Server copies may be removed after successful distribution to the household's devices or after the transfer period expires. Later redelivery requires a suitable copy to remain available.
Photos can unintentionally contain personal information; users should therefore only store suitable product pictures. Photos belong to the household: if a member leaves a household, the photos they contributed remain available to the remaining members. The other members' photos are no longer provided on the departed member's device; any protected copy still present there is removed by the device's regular cleanup runs. The operator cannot remotely delete data on devices that are permanently switched off or offline.
6. Future plans
Paid plans with their own photo retention rules are planned but not active in this version; there is no way to purchase. Before they are introduced, the storage and deletion rules that will then apply will be described in a new version of this policy.
7. Telegram input (optional)
The owner of a household can connect authorized private Telegram accounts to the household using a link code and can end the links in the app at any time. Messages to the operator's bot are assigned to the household and processed as a list entry or, if clarification is needed, as a review suggestion. Raw texts stored on the server are removed in the next scheduled cleanup once they are 90 days old; resulting shopping-list entries, review texts and provenance records remain subject to their own retention rules. Telegram is an independent service with its own privacy policy; the operator has no influence on processing within Telegram.
8. AI help (Bea)
The optional help answers product questions using an AI service (OpenAI or Anthropic). The app does not automatically add any account, household or list content to the request; what is transmitted is your input and the conversation so far — which may contain personal details you enter yourself — as well as technical identifiers for abuse prevention without a disclosed link to your account. Conversations expire after 24 hours and can be deleted at any time; usage is stored only as anonymous daily totals for up to 90 days. If Bea cannot answer a question, only the question text, without any link to your account, is collected to improve the help and is deleted after 90 days at the latest. Only at your explicit request (Get answer by email) is the account's email address linked to that one question, used solely for the answer and deleted once the question has been handled, after 90 days at the latest.
9. Retention and deletion
- Account: Users can delete their account themselves in the app (with password confirmation). Sessions and devices are signed out immediately, own households without other members are deleted as well, memberships are ended and the sign-in data is removed. The email address can then be used for a new account; a new account takes over nothing from the old one. A technical lock record (checksum of the old account identifier, without the email address) is valid for at most 30 days and only prevents reuse of the old account. - Household: After deletion by the owner, content and photo files are removed in the next server-side cleanup run. A residual skeleton without shopping or photo content, with the technical associations needed to synchronize the deletion, is kept for 90 days so that devices that have been offline for a longer time can properly follow the deletion. A deletion record without image content is kept for each deleted photo revision. - Confirmation codes: Codes become invalid when used or when they expire; the code content in sending jobs is cleared on completion, and the technical process records are then removed in the regular scheduled cleanups (processes after 7 days, sending jobs after 30 days). - Change log: 90 days. Duplicate detection: 180 days. Telegram raw texts: cleanup from 90 days (Section 7). - Otherwise, data remains stored as long as the associated household or service is used or legal obligations require further storage. Orphaned product photos are cleaned up regularly.
10. Recipients and visibility
Within the app, members of the same household see the shared content (lists, products, photos, origin of entries). Data is not sold to advertisers. The only external recipients are: the hosting provider (netcup GmbH, Germany; data center in Vienna, Austria) as processor, the delivery route for confirmation emails, the Telegram service (independent controller) if the link is activated, and the respective AI service (OpenAI or Anthropic) when the Bea help is used. Any further transfer takes place only where required by law or initiated by a user action.
Google is an additional recipient for the ML Kit, advertising and consent services described in Sections 14 and 15. The data flows and privacy information described there apply.
11. Special information for users in the EU and the EEA
- Legal bases: see Section 4. - Rights: access, rectification, erasure, restriction, data portability, objection and withdrawal of consent; in addition, the right to lodge a complaint with a data protection supervisory authority. These rights can be exercised at any time through the privacy contact, regardless of whether new versions of the Terms of Use have been accepted. - Data location: Data is stored in Vienna, Austria. The operator manages the service from its base in the Philippines and accesses the stored data in doing so. When Telegram or the Bea help is used, data may be processed outside the EU by these services.
12. Users outside the EU (including the USA)
To the extent the law of your country provides corresponding rights (such as access, rectification or erasure), you can exercise them through the privacy contact. Otherwise, Sections 1 to 10 apply.
13. Privacy contact
info@lillibasket.com
14. Barcode and text recognition with Google ML Kit
The app uses Google ML Kit for barcode, text and document recognition. Recognition of the images and text supplied to these features takes place on the device; according to Google, ML Kit does not send these inputs or recognition results to Google. The separate photo, synchronization and Bea features are described in the preceding sections.
ML Kit may contact Google for model updates, bug fixes and compatibility information and transmit technical data: device and app information, technical identifiers, and usage, performance and error data. Google uses this data for diagnostics, maintenance, improvement and abuse detection. These transmissions may occur even when recognition runs locally. This does not mean signing in with Google or storing your shopping list with Google.
Further information: https://developers.google.com/ml-kit/terms and https://developers.google.com/ml-kit/android-data-disclosure. General information about Google's processing, retention and international transfers is available at https://policies.google.com/privacy.
15. Google advertising and privacy options
When the app offers advertisements, it uses Google AdMob / Google Mobile Ads and the User Messaging Platform (UMP). Depending on the feature, consent status and device settings, data processed may include the IP address, approximate location derived from it, device/advertising identifiers, interactions with advertisements, and diagnostic and performance data. Purposes include serving and measuring advertisements, technical analytics and fraud prevention. The app does not supply its shopping lists, product photos or Bea messages to the advertising SDK as advertising content or audience targeting attributes.
Before explicitly initializing advertisements, the app checks through UMP whether it may request ads. A consent dialog is displayed where required. When Google provides privacy options, you can change your choices under Settings → Legal → Change ad consent. Accepting the Terms of Use and optionally subscribing to product information do not replace advertising consent. Test advertisements do not mean that the SDK processes no technical data.
Further information: https://developers.google.com/admob/android/privacy/play-data-disclosure and https://policies.google.com/technologies/ads. Google may also process data outside your country of residence, including in the United States. The Google entities involved and further details are described at https://policies.google.com/privacy and in the displayed privacy options.
Changes
Features, plans and terms may change as the service develops. Material changes will be communicated appropriately.
Part 2
Privacy policy
1. Controller
Lillime Lab – Volker Schepler UP Compound, IRRI Staff Housing 40 4031 Los Baños, Laguna, The Philippines
2. Data processed by LilliBasket
Category
Examples
Purpose
Account
Name, email address, user ID, sign-in method
Sign-in, account management and household membership
Compressed product images and thumbnails when your plan allows them
Visual product memory
Incoming messages
Messages sent to the designated Telegram or email inputs
Adding items from external messages to the correct list
Technical data
IP address, device/app information, synchronization and error states
Operation, security, abuse prevention and troubleshooting
3. Camera and barcode
The camera is used when you scan a barcode or take a product photo. Barcode recognition can take place on your device. A camera image is uploaded as a product photo only when you use and save that feature.
4. Technical service providers
LilliBasket uses Google services including Firebase Authentication, Cloud Firestore, Cloud Storage and Cloud Functions for sign-in, storage, synchronization and backend functions. Depending on the service, data may be processed outside your country. Google's Firebase privacy documentation explains its privacy and security terms.
5. Advertising in FREE
The FREE plan may display advertising. Google AdMob may be used to serve ads and may process the data needed for ad requests. Where consent is required, choices are collected through Google's User Messaging Platform (UMP) or an appropriate consent solution.
What matters to LilliBasket
LilliBasket does not provide your shopping-list content, including product names, quantities, barcodes and specific buying decisions, to retailers, brands or ad networks for ad targeting. Nobody can buy a preferred position within your shopping list.
Using the app does not require consent to personalized advertising. Where technically and legally possible, suitable settings may allow non-personalized or limited ads.
6. Legal bases
Where the GDPR applies, processing depends on the feature and is based on providing the requested app service or performing a contract, legitimate interests in security and stability, or required consent. For users in the Philippines, the Data Privacy Act of 2012 also applies.
7. Account deletion and data cleanup
Confirmed account deletion runs directly. It does not wait for the next cleanup and has no retention period of 30, 90 or 183 days. The app confirms completion. If deletion does not complete, contact us through the account deletion page.
Separately, LilliBasket cleans up data no longer needed by existing households:
Image files no longer referenced are removed in a monthly cleanup once they are at least 30 days old. Images still in use are retained.
Unused text-only products without a photo or barcode, and orphaned barcode links, are cleaned up in the monthly run after at least 90 days.
When Premium ends, product photos are hidden immediately. If Premium is not reactivated, the daily cleanup removes them after a retention period of 183 days.
Lists archived for at least a year are flagged for review, not automatically deleted solely for that reason.
8. Recipients and sale
LilliBasket does not sell personal data to retailers, brands or advertisers. Data is transferred only when needed for the stated technical services, required by law or initiated by a user action.
9. Your rights
Where applicable, you may request access, correction, deletion, restriction of processing or data portability, object to processing, and withdraw consent for the future. You may also complain to a competent data protection authority.
10. Delete your account
You can request deletion in the app or through the separate webpage. That page provides the steps and contact details for a request without the app.
This version of the static website uses no analytics or tracking scripts of its own and loads no external web fonts. The hosting or web server may process access logs needed for operation and security.
When you enter without a language in the address, the website uses your preferred browser languages. A language selected in the language menu is stored only in your browser and used on later visits. Direct links to a language version take priority. You can replace the saved choice by selecting another language or remove it by clearing this website’s data in your browser.
Bea is an AI assistant, not a real employee. Website help is optional and does not require an account. When you send a message, your questions and conversation context are sent to the AI provider configured for Bea (OpenAI or Anthropic). Help has no access to your app account, households, lists or email and cannot make changes. Do not enter passwords, payment details or personal account information. Answers may be incorrect. Use Contact for personal matters.
A random chat identifier is stored in an essential cookie so you can continue the conversation. Chat content is temporarily stored on our server and is not saved in browser local storage. “Delete chat” immediately removes it from the active help service. Sessions expire after 24 hours; while running, the service removes expired content every minute. A daily changing hash of your network address is used to limit abuse and is removed after no more than three days. Ratings and usage are retained only as daily totals without conversation content for up to 90 days. Deleting a chat from the help service does not retroactively delete data already sent to the AI provider. The provider processes data under its respective terms. The legal information and contact options in this privacy policy also apply to AI help.