Privacy Policy - LystBot

1. Data Controller

TourAround UG (haftungsbeschränkt)
Menzelstr. 18
55127 Mainz, Germany
Email: hello@touraround.io
Website: www.touraround.io

Managing Director: Alexander Iyimen

2. Overview

LystBot is a list app that works without an account or login. We value data minimization and only collect data that is strictly necessary for operating the service.

3. Data We Collect

3.1 App Usage

Device UUID - A randomly generated ID stored on your device. Used for identification without personal data.
Device name and model - Displayed in shared lists (e.g., "iPhone 15 Pro")
Display name and signature emoji - Chosen freely by you
Language setting (locale) - For localized notifications
List data - Titles, items, status (checked/unchecked), share codes
Push notification token - For real-time notifications about list changes

3.2 API Access (Agents/Bots)

API keys - For authenticating AI agents
Agent name and emoji - Displayed in the app

3.3 What We Do NOT Collect

We do not collect your real name, email address, phone number, location data, IP addresses (except in temporary server logs), or any other personal data unless you voluntarily provide it.

4. Legal Basis

The processing of your data is based on the following legal grounds:

Art. 6(1)(b) GDPR (Contract performance) - Processing is necessary to provide the service.
Art. 6(1)(f) GDPR (Legitimate interests) - Push notifications and synchronization serve the smooth operation of the service.
Art. 6(1)(a) GDPR (Consent) - For push notifications, you grant separate consent at the device level.

5. Purpose of Processing

Your data is used exclusively to:

Synchronize your lists across shared devices
Send push notifications about list changes
Display member information in shared lists
Enable AI agents to access your lists

6. Hosting and Data Storage

All data is stored on servers in Germany (EU). Our hosting provider is DigitalOcean (Frankfurt data center). No data is transferred to third countries except as described in Section 7.

We implement appropriate technical and organizational measures to protect your data, including encrypted database connections and access restrictions.

7. Third-Party Services

We do not sell or share your data with third parties. The following external services are used:

7.1 Firebase Cloud Messaging (Google)

We use Firebase Cloud Messaging (FCM) by Google Ireland Limited to send push notifications. Your device token is transmitted to Google. Google processes this data in accordance with their Privacy Policy. Data transfer to the USA is based on the EU-US Data Privacy Framework.

8. Cookies and Tracking

The LystBot app and website use no cookies, no tracking, and no analytics services. No usage profiles are created.

9. Data Retention and Deletion

Your data is stored as long as you use the app. Uninstalling the app does not automatically delete your data from our servers, as other members of shared lists may still need access.

You can request complete deletion of all your data at any time by contacting us at hello@touraround.io. We will process your request within 30 days.

10. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Access (Art. 15 GDPR) - You can request information about your stored data.
Rectification (Art. 16 GDPR) - You can request correction of inaccurate data.
Erasure (Art. 17 GDPR) - You can request deletion of your data.
Restriction (Art. 18 GDPR) - You can request restriction of processing.
Data portability (Art. 20 GDPR) - You can receive your data in a common format.
Objection (Art. 21 GDPR) - You can object to the processing.
Withdrawal (Art. 7(3) GDPR) - You can withdraw any given consent at any time.

Contact us at hello@touraround.io to exercise your rights.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
(State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate)
Postfach 30 40
55020 Mainz, Germany
www.datenschutz.rlp.de

12. Changes to This Policy

We may update this privacy policy from time to time. The current version is always available in the app and at this URL. We will notify you of significant changes through the app.