Mga Tuntunin at
Privacy.

Ang buong mga tuntunin at patakaran sa privacy sa ibaba ay nasa Ingles, tulad sa app. Available rin ang bersiyong Aleman sa menu ng wika.

Terms of Use

Document version: 2026-10-28.1

Terms of Use
Effective date: Oct 28, 2026

1. Subject

LilliBasket is used to organize shopping lists and products together within households. These terms apply to the version of the app that runs on the operator's own infrastructure (details in the Privacy Policy).

2. Account and sign-in

Using the app requires a LilliBasket account with an email address and password. Registration is completed with a confirmation code sent by email; the password can be reset the same way. Older versions of the app used Google sign-in on Google Firebase infrastructure; the previous terms apply to them until they are replaced.

3. Household and invitations

A user can create a household as owner and add other people using a time-limited invitation code that is checked on the server. Codes may only be shared with authorized people. The owner can transfer ownership to another member and remove members.

4. Permitted use

The app may only be used lawfully. Users must not store content they are not entitled to process, and should not capture unnecessary personal or sensitive information in product photos.

5. Fees and future plans

Using the app is currently free of charge. In this version, the app offers no way to purchase and does not conclude any paid contract. Paid plans (Premium, Premium+) with their own limits, in particular for product photos, are planned for the future; they only become binding with an actual purchase offer including prices, terms and withdrawal information. Until then, the operator can determine and adjust the scope of free use.

6. Operator limits

The operator can set maximum values per account, for example for the number of households or memberships. When a maximum is reached, only the creation of new items is prevented; existing households, memberships and content are never automatically deleted as a result.

7. Account deletion

Users can delete their account themselves in the app. Deletion requires entering the current password. Anyone who is owner of a household with other members must first transfer ownership or delete the household. When the account is deleted, all sessions and devices are signed out, own households without other members are deleted as well, and memberships in other people's households are ended. The email address can then be used for a new account; doing so does not restore the previous account's data or permissions. The Privacy Policy provides information on deletion periods.

8. Household and list deletion

The owner triggers the permanent deletion of a household by entering a deletion word. It affects all members and removes the associated lists, products, memberships and stored product photos in the server-side deletion process. Old shopping lists are not deleted merely because of inactivity without prior inquiry and confirmation. Legally required retention remains unaffected.

9. Telegram input (optional)

The owner of a household can connect authorized private Telegram accounts to the household using a link code and can end these links in the app at any time. Messages to the operator's bot are assigned to the linked household and processed as a list entry or, if clarification is needed, as a review suggestion. Telegram's own terms of service apply to Telegram; the members are responsible for which Telegram accounts they link.

10. Acceptance of these terms

To use the app, you accept the Terms of Use. The Privacy Policy explains how your data is processed; acknowledging it is not a blanket consent to additional processing. Where an optional feature requires consent, it is requested separately and can be withdrawn for the future. Acceptance and acknowledgment are recorded on the server with version and time. When there is a new version, you are asked to accept again; without acceptance, the app cannot be used any further. Regardless of this, data protection rights can be exercised at any time through the privacy contact.

11. Switchover without data transfer

With the switch to the operator's own infrastructure, LilliBasket starts with an empty data set. Data from older versions (Google sign-in) is not transferred. The older services are being shut down.

12. Availability

Availability at all times or freedom from errors cannot be guaranteed. Network, server and maintenance disruptions can temporarily limit features.

13. User content

Users remain responsible for their entries and photos. Unlawful content can be blocked or deleted.

14. Liability

LilliBasket helps with organizing shopping. Mandatory statutory liability rules remain unaffected.

15. Changes

Features and terms may be further developed. Significant changes will be communicated in a suitable form and require renewed acceptance under Section 10.

16. Mandatory consumer rights

Mandatory consumer protection laws of the country in which the user has their habitual residence remain unaffected.

17. Operator and contact

Lillime Lab – Volker Schepler
UP Compound, IRRI Staff Housing 40, 4031 Los Baños, Laguna, The Philippines
Contact: info@lillibasket.com

18. Third-party components and open-source licenses

The app contains third-party libraries and other components. Their respective license terms apply to those components, including associated copyright notices, disclaimers and any source-code rights. These Terms of Use do not restrict rights granted by the respective open-source licenses. Available original texts and notices are provided in the app under Settings → Legal → Third-party licenses; they can also be opened before accepting these Terms of Use. License texts are provided in their original language. Optional external services are additionally governed by their own terms. Naming providers or trademarks does not imply that those providers endorse or support LilliBasket.

Privacy Policy

Document version: 2026-10-28.1

Privacy Policy
Effective date: Oct 28, 2026

1. Controller

The controller responsible for data processing is:
Lillime Lab – Volker Schepler
UP Compound, IRRI Staff Housing 40, 4031 Los Baños, Laguna, The Philippines
Contact: info@lillibasket.com

2. Where the data is processed

This Privacy Policy applies to the version of LilliBasket that runs on the operator's own infrastructure: a server in a data center in Vienna, Austria (hosting provider: netcup GmbH, Karlsruhe, Germany). Account data, household data and lists are stored there in a database; product photos are temporarily held there as files for transfer between devices (Section 5). No Google services are used for sign-in, storage or synchronization.

Transition period: Older versions of the app still use Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions). The previous privacy policy applies to these versions until they are shut down. Data from the older versions is not transferred to the new system.

3. Data processed

To the extent the respective feature is used, LilliBasket processes:

- Account data: email address, password (only as a cryptographic hash), time and version of acceptance of the Terms of Use and of acknowledgment of this policy;
- Session and device data: signed-in devices with a technical identifier, session durations;
- Household and membership data, including invitation codes;
- Shopping lists, products, quantities, notes and list-specific stores;
- optionally scanned barcodes;
- Product photos and thumbnails (Section 5);
- Review inbox items (entries flagged for review);
- with a linked Telegram input: Telegram user and chat ID, display name, message ID and incoming message texts (Section 7);
- Technical protection and operational data: events for rate limiting (including IP address), a change log for synchronization (90 days) and duplicate detection records (180 days).

For registration and password reset, the operator sends emails with confirmation codes to the address provided.

4. Purposes and legal bases

The data is processed to provide sign-in, shared households, synchronization, offline use, product memory, photo/barcode features, invitations, review workflows, the optional Telegram input, security and support. Where the GDPR applies: the core features (account, households, lists, synchronization, photos, email codes) are based on performance of a contract (Art. 6(1)(b) GDPR); security and protection measures (rate limiting, abuse prevention, technical logs) on legitimate interests in secure and stable operation (Art. 6(1)(f) GDPR); optional links such as the Telegram input on your separately given, withdrawable consent through active setup (Art. 6(1)(a) GDPR).

For barcode and text recognition performed at your request, Art. 6(1)(b) GDPR applies where the GDPR is applicable. Technical diagnostics and abuse prevention serve the legitimate interest in reliable and secure features (Art. 6(1)(f), where legally permitted). Advertising processing that requires consent is based on your separate consent (Art. 6(1)(a)); withdrawal takes effect for the future. Acknowledging this policy is not blanket consent to SDK data processing. Sections 14 and 15 describe the Google services in more detail.

5. Product photos and barcodes

Barcodes can be used by all users. The camera original of a product photo is processed locally; a compressed product image and a separate thumbnail are stored.

Product images and thumbnails are stored on participating devices and temporarily held on the server for transfer. Server copies may be removed after successful distribution to the household's devices or after the transfer period expires. Later redelivery requires a suitable copy to remain available.

Photos can unintentionally contain personal information; users should therefore only store suitable product pictures. Photos belong to the household: if a member leaves a household, the photos they contributed remain available to the remaining members. The other members' photos are no longer provided on the departed member's device; any protected copy still present there is removed by the device's regular cleanup runs. The operator cannot remotely delete data on devices that are permanently switched off or offline.

6. Future plans

Paid plans with their own photo retention rules are planned but not active in this version; there is no way to purchase. Before they are introduced, the storage and deletion rules that will then apply will be described in a new version of this policy.

7. Telegram input (optional)

The owner of a household can connect authorized private Telegram accounts to the household using a link code and can end the links in the app at any time. Messages to the operator's bot are assigned to the household and processed as a list entry or, if clarification is needed, as a review suggestion. Raw texts stored on the server are removed in the next scheduled cleanup once they are 90 days old; resulting shopping-list entries, review texts and provenance records remain subject to their own retention rules. Telegram is an independent service with its own privacy policy; the operator has no influence on processing within Telegram.

8. AI help (Bea)

The optional help answers product questions using an AI service (OpenAI or Anthropic). The app does not automatically add any account, household or list content to the request; what is transmitted is your input and the conversation so far — which may contain personal details you enter yourself — as well as technical identifiers for abuse prevention without a disclosed link to your account. Conversations expire after 24 hours and can be deleted at any time; usage is stored only as anonymous daily totals for up to 90 days. If Bea cannot answer a question, only the question text, without any link to your account, is collected to improve the help and is deleted after 90 days at the latest. Only at your explicit request (Get answer by email) is the account's email address linked to that one question, used solely for the answer and deleted once the question has been handled, after 90 days at the latest.

9. Retention and deletion

- Account: Users can delete their account themselves in the app (with password confirmation). Sessions and devices are signed out immediately, own households without other members are deleted as well, memberships are ended and the sign-in data is removed. The email address can then be used for a new account; a new account takes over nothing from the old one. A technical lock record (checksum of the old account identifier, without the email address) is valid for at most 30 days and only prevents reuse of the old account.
- Household: After deletion by the owner, content and photo files are removed in the next server-side cleanup run. A residual skeleton without shopping or photo content, with the technical associations needed to synchronize the deletion, is kept for 90 days so that devices that have been offline for a longer time can properly follow the deletion. A deletion record without image content is kept for each deleted photo revision.
- Confirmation codes: Codes become invalid when used or when they expire; the code content in sending jobs is cleared on completion, and the technical process records are then removed in the regular scheduled cleanups (processes after 7 days, sending jobs after 30 days).
- Change log: 90 days. Duplicate detection: 180 days. Telegram raw texts: cleanup from 90 days (Section 7).
- Otherwise, data remains stored as long as the associated household or service is used or legal obligations require further storage. Orphaned product photos are cleaned up regularly.

10. Recipients and visibility

Within the app, members of the same household see the shared content (lists, products, photos, origin of entries). Data is not sold to advertisers. The only external recipients are: the hosting provider (netcup GmbH, Germany; data center in Vienna, Austria) as processor, the delivery route for confirmation emails, the Telegram service (independent controller) if the link is activated, and the respective AI service (OpenAI or Anthropic) when the Bea help is used. Any further transfer takes place only where required by law or initiated by a user action.

Google is an additional recipient for the ML Kit, advertising and consent services described in Sections 14 and 15. The data flows and privacy information described there apply.

11. Special information for users in the EU and the EEA

- Legal bases: see Section 4.
- Rights: access, rectification, erasure, restriction, data portability, objection and withdrawal of consent; in addition, the right to lodge a complaint with a data protection supervisory authority. These rights can be exercised at any time through the privacy contact, regardless of whether new versions of the Terms of Use have been accepted.
- Data location: Data is stored in Vienna, Austria. The operator manages the service from its base in the Philippines and accesses the stored data in doing so. When Telegram or the Bea help is used, data may be processed outside the EU by these services.

12. Users outside the EU (including the USA)

To the extent the law of your country provides corresponding rights (such as access, rectification or erasure), you can exercise them through the privacy contact. Otherwise, Sections 1 to 10 apply.

13. Privacy contact

info@lillibasket.com

14. Barcode and text recognition with Google ML Kit

The app uses Google ML Kit for barcode, text and document recognition. Recognition of the images and text supplied to these features takes place on the device; according to Google, ML Kit does not send these inputs or recognition results to Google. The separate photo, synchronization and Bea features are described in the preceding sections.

ML Kit may contact Google for model updates, bug fixes and compatibility information and transmit technical data: device and app information, technical identifiers, and usage, performance and error data. Google uses this data for diagnostics, maintenance, improvement and abuse detection. These transmissions may occur even when recognition runs locally. This does not mean signing in with Google or storing your shopping list with Google.

Further information: https://developers.google.com/ml-kit/terms and https://developers.google.com/ml-kit/android-data-disclosure. General information about Google's processing, retention and international transfers is available at https://policies.google.com/privacy.

15. Google advertising and privacy options

When the app offers advertisements, it uses Google AdMob / Google Mobile Ads and the User Messaging Platform (UMP). Depending on the feature, consent status and device settings, data processed may include the IP address, approximate location derived from it, device/advertising identifiers, interactions with advertisements, and diagnostic and performance data. Purposes include serving and measuring advertisements, technical analytics and fraud prevention. The app does not supply its shopping lists, product photos or Bea messages to the advertising SDK as advertising content or audience targeting attributes.

Before explicitly initializing advertisements, the app checks through UMP whether it may request ads. A consent dialog is displayed where required. When Google provides privacy options, you can change your choices under Settings → Legal → Change ad consent. Accepting the Terms of Use and optionally subscribing to product information do not replace advertising consent. Test advertisements do not mean that the SDK processes no technical data.

Further information: https://developers.google.com/admob/android/privacy/play-data-disclosure and https://policies.google.com/technologies/ads. Google may also process data outside your country of residence, including in the United States. The Google entities involved and further details are described at https://policies.google.com/privacy and in the displayed privacy options.