SHIST. Back to Shist

PRIVACY BY CHOICE

Privacy Policy

Shist is designed so you decide what stays on your device, what is backed up, and what is shared.

Last updated: 6 September 2026

1. About this policy

This policy explains how Shist handles information when you use the Shist mobile app and the website at shist.co.nz. In this policy, “Shist”, “we”, “us” and “our” refer to the Shist service.

2. Your privacy choices

Local Only

You can use Shist without a cloud account. Your Lists, Items, Tasks, Notes, saved places, settings and local Activity stay on your device unless you choose a feature that clearly sends information, such as place search or Feedback.

Cloud Account

Creating or signing in to a Cloud Account does not automatically upload your private Lists. Account information is handled separately from your List content.

Cloud Backup & Sync

Cloud Backup & Sync is optional and off by default. Only the Lists you select, together with their Sections, Items, Tasks, Notes, recurrence settings and linked places, are synchronized.

Shared Lists

Sharing uploads only the List you explicitly choose to share. People with access may see that List and its content according to their role. Your other Lists are not included.

3. Information Shist may process

  • Account information: your email address, display name, authentication provider and provider account identifier when you create or connect a Cloud Account.
  • Device and session information: a random Shist installation identifier, device model or manufacturer where useful, platform, App version, Build number, session activity and revocation status. Shist does not collect serial numbers, IMEI values or hardware fingerprints.
  • Selected or shared content: the Lists and related content you explicitly select for Cloud Backup & Sync or Sharing.
  • Location information: saved place names, addresses, coordinates and reminder radius may be synchronized only with an eligible selected or Shared List. Device permission, current position, geofence state and trigger history remain device-specific. Place search sends the search text and, if provided, a nearby location to the Shist place-search service.
  • Activity and notifications: Shist may store account, Connection, Group and Shared List Activity needed to show updates. Push alerts may include the member, Shared List, Item, Task, Category or Section involved, but do not include Notes, email addresses, precise Location details, unrelated Lists, sign-in data or raw sync data.
  • Feedback: when you choose to send Feedback, Shist stores your message with limited diagnostics such as App version, Build number, platform, system version, device model and submission time. Local Only Feedback is anonymous. Cloud Account Feedback is linked to that account.

4. Voice input

Voice recordings are never uploaded to Shist cloud storage. Raw recognized voice text remains local by default. Your device platform may process speech recognition under its own privacy terms when you use voice input.

5. How information is used

Shist uses information only to provide the features you choose, including authentication, device and session security, synchronization, Sharing, Connections, Groups, reminders, Activity, notifications, account support, Feedback and service reliability. Shist does not sell personal information or use it for targeted advertising.

6. Service providers

Shist uses trusted providers only as needed to operate the service:

  • Supabase for Cloud Account authentication and cloud database services.
  • Cloudflare for the Shist API, website, queues and supporting infrastructure.
  • Expo, Apple and Google for push-notification delivery and platform services.
  • Postmark for account and invitation email.
  • Apple and Google for sign-in when you choose those providers.

These providers process information under their own terms and may process it in countries other than yours.

7. Retention and deletion

Local data remains on your device until you delete it, delete the App, or use the relevant App control. Cloud data remains while needed to provide the cloud features you choose, subject to deletion and operational backup periods.

Shist keeps separate controls for Delete Cloud Data, Delete Account and Delete Local Data. Disabling Cloud Backup & Sync does not silently delete your local Lists. Account export and deletion controls are available in the App for Cloud Accounts.

8. Security

Shist uses access controls, encrypted network connections, scoped credentials and account/device checks to protect cloud information. No system can guarantee complete security, so you should also protect access to your device and account.

9. Your choices and requests

You can change notification and Location permissions in your device settings, choose which Lists use Cloud Backup & Sync, stop Sharing where your role allows it, export Cloud Account data, and use the deletion controls provided in Shist.

For a privacy question or a request to access or correct personal information, email webonz@gmail.com.

10. Changes to this policy

We may update this policy when Shist features or legal requirements change. The current version and its updated date will remain available on this page.