Privacy Policy

Who we are

LystMate is a personal project by Dimitrios Spyridon Karampelas. The service is available at www.lystmate.app. If you have questions about this policy, you can reach us through the app.

What data we collect

• Account data — your name, email address, and a hashed (bcrypt) password when you register.
• List and item data — the lists, items, and invites you create or are invited to.
• Usage data — standard server logs including IP address, browser type, and pages visited. These are not linked to your account and are retained for a maximum of 30 days.

We do not collect payment information, location data, or any third-party tracking data. We do not use analytics tools (e.g. Google Analytics).

Why we collect it

• To provide and maintain the service (account authentication, list management).
• To send transactional emails — email verification, password reset, and security alerts. We use Resend to deliver these.
• To protect the service from abuse (rate limiting, fraud prevention).

We do not send marketing emails. We do not sell your data to anyone.

Legal basis (GDPR)

For users in the EU/EEA, we process your personal data on the following bases:

• Contract — processing your name and email is necessary to provide the service you signed up for.
• Legitimate interests — server logs and rate limiting to keep the service secure and operational.

How we store your data

Your data is stored in a PostgreSQL database hosted on Railway in the EU region. Passwords are never stored in plain text — only bcrypt hashes. Access tokens are short-lived (15 minutes). Refresh tokens are stored in httpOnly cookies.

Third-party services

• Railway — database and API hosting.
• Vercel — frontend hosting and edge network.
• Resend — transactional email delivery.

Each of these services has its own privacy policy. We share only the minimum data necessary for each service to function.

Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (you can do this directly in Settings).
• Erasure — delete your account and all associated data at any time from Settings → Danger zone.
• Portability — request your data in a machine-readable format.
• Object — object to processing based on legitimate interests.

To exercise any of these rights, reach out through the app. We will respond within 30 days.

Data retention

Your account data is retained for as long as your account exists. When you delete your account, all personal data — including your name, email, lists, items, and invites — is permanently deleted immediately. Server logs are retained for 30 days then automatically purged.

Cookies

We use one cookie: a refreshToken httpOnly cookie used solely for authentication. It is not a tracking cookie and contains no personal data. No consent banner is required for strictly necessary cookies.

Changes to this policy

If we make material changes we will update the date at the top of this page. Continued use of LystMate after changes are posted constitutes acceptance of the updated policy.