Privacy Policy

Last updated: October 2026

This Privacy Policy explains what personal data Jotivo collects when you use the app, how we use it and what rights you have.

1. Who We Are

Jotivo is provided by Sebastian Gustavsson, a sole trader (enskild firma), organisation number 880323-2712, VAT number SE880323271201, Svinaberga 30, 343 93 Älmhult, Sweden ("we", "us" or "our"). We publish Jotivo under the name NorthernTales Studio. We are the controller of the personal data described in this policy. You can contact us at support@jotivo.app.

2. Information We Collect

Account information

When you create an account, we collect your email address, the display name you choose and your password, which we store only in hashed form. An email address is required to create an account. If you sign in with Google or Facebook, we receive your name, email address, an account identifier and a link to your profile picture. We never receive your Google or Facebook password.

Your lists

The lists, items, notes, quantities, groups and categories you create are stored on our servers and linked to your account, so that they can be synced across your devices. The same applies to your list order and display preferences, your personal dictionary, your custom categories and the history the app uses to suggest items.

Shared lists

Lists you don't share are visible only to you. If you share a list, the people you share it with can see everything in it, add, change and remove items, and see your name and email address, and you can see theirs. Invitations show the name and email address of the person who sent them. You can only invite people who already have a Jotivo account. If you block someone who invited you, we store the block so that they can't invite you again.

Notifications

If you allow notifications, we store a push token for your device together with its platform (for example Android) and language, so that we can notify you when someone invites you to a list. The notification shows the name of the list and of the person who invited you.

Usage analytics

We use PostHog to understand how the app is used, for example which screens are opened and which features are used. Analytics is anonymous: events aren't linked to your account, your name or your email address, and don't contain your list content. Each time the app starts, it uses a new random ID that isn't saved on your device, so analytics can't follow you over time. The only device or app information sent is the app version. Like any service on the internet, PostHog receives your IP address when the app sends data, but it's set to discard it without storing it or using it to work out a location.

Security and abuse prevention

To protect Jotivo and its users, we temporarily log some IP addresses and invitation attempts, for example to limit repeated attempts to invite people or to sign up with an email address that's already in use. Supabase also keeps logs of sign-ins and other authentication events.

Emails to us

If you email us, we receive your email address and whatever you write. If you contact us from the app, the email is pre-filled with your email address, account ID, app version and device platform to help us solve your problem. You can remove this information before sending.

Plan information

We store which plan your account has, for example Free or Premium, so that the app can unlock the right features. We never receive your payment card details.

We don't collect your location or your advertising ID, and Jotivo contains no ads.

3. How We Use Your Information

Under the EU General Data Protection Regulation (GDPR), we need a legal basis for each way we use your personal data. We use it:

To run your account, store and sync your lists, let you share lists and send you emails about your account, such as sign-up confirmations and password resets (to perform our agreement with you)
To send the notifications you've allowed (to perform our agreement with you). You can turn notifications off at any time in your device settings
To understand how the app is used and improve it with anonymous analytics (our legitimate interest in improving Jotivo)
To keep Jotivo secure and prevent abuse (our legitimate interest in protecting the service and its users)
To answer your emails and fix problems you report (our legitimate interest in providing support, or to perform our agreement with you)
To comply with the law, for example if a court or authority requires us to hand over data (legal obligation)

We don't sell your personal data, we don't use it for advertising, and we don't make decisions about you based solely on automated processing.

4. Troubleshooting Reported Problems

In exceptional cases, when a reported problem can't be found or fixed any other way, we may copy the affected account's data to an internal, private test environment. If the problem is in a shared list, the copy can also include the lists the account shares with other people, including what the other members have added. Nothing else from their accounts is copied. The copy can't be used to contact you or the other members: all email addresses are replaced, the other members' names are replaced too, and passwords and notification tokens aren't copied. Only we have access to the copy, and we delete it as soon as the problem is resolved. We do this based on our legitimate interest in keeping Jotivo working correctly.

5. Who We Share Your Data With

Apart from the people you share lists with, we only share personal data with service providers that process it on our behalf and according to our instructions:

Supabase: database, accounts and server functions, hosted in Ireland (EU)
PostHog: usage analytics, hosted in the EU
Resend: sending account emails, such as sign-up confirmations and password resets, from servers in Ireland (EU)
Expo and, on Android, Google Firebase Cloud Messaging: delivering notifications to your device
Strato: our email service for messages you send us, based in Germany (EU)
Cloudflare: hosting our website, jotivo.app, including the pages our emails link to

When you sign in with Google or Facebook, or download Jotivo from Google Play or the App Store, those companies process your data as independent controllers under their own privacy policies. We may also disclose personal data if the law requires us to.

6. Transfers Outside the EU

Your account and lists are stored in the EU. Some of our providers are based in the United States or use subcontractors outside the EU, so personal data may be transferred to or accessed from countries outside the European Economic Area, for example when notifications are delivered through Expo and Google. In those cases we rely on the EU-US Data Privacy Framework, where the provider is certified under it, or on the European Commission's standard contractual clauses.

7. Data Retention

We keep personal data only as long as we need it:

Your account, lists and related data: until you delete them or your account. Lists in the trash are deleted automatically after 30 days, or after 365 days with Premium
When you delete your account, your data is deleted immediately. Copies in our backups are gone within 7 days
If you delete your account, items you've added to someone else's list stay in that list, but are no longer linked to you
Usage analytics: kept by PostHog for at least one year. It isn't linked to you, so it can't be picked out and deleted when you delete your account or ask us to
IP addresses and invitation attempts logged to prevent abuse: 24 hours
Sign-in logs at Supabase: 7 days
Records of notifications sent to you: 30 days
Records of emails we've sent you: kept by our email provider under its own retention rules
Emails you send us: as long as we need them to handle your request
Copies made to troubleshoot a problem: until the problem is resolved

8. Your Rights

Under the GDPR, you have the right to:

Access your personal data and get a copy of it
Have inaccurate data corrected. You can change your name and email address yourself in the app
Have your data deleted. You can delete your account yourself in the app, see jotivo.app/data-deletion
Restrict how we use your data
Get your data in a machine-readable format (data portability)
Object to our use of your data based on legitimate interests

To use your rights, email us at support@jotivo.app from the address linked to your account. We'll respond within one month.

If you think we handle your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or with the data protection authority in the country where you live.

9. Age Requirement

Jotivo is intended for people aged 18 and over. We don't knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, contact us at support@jotivo.app and we'll delete it.

10. Changes to This Policy

We may update this policy, for example when we add features or change service providers. We'll update the date at the top, and if the changes are significant, we'll tell you in the app or by email before they take effect.

11. Contact

If you have questions about this policy or how we handle your personal data, contact us at support@jotivo.app.