Privacy policy

Controller

Tobias Wissmüller
Groschenweg 41g
81825 München
Germany
Email: hello+bento-lists@ramuslabs.com
More details: Imprint

In short

Your lists stay yours. Bento Lists needs no account and shows no ads. Your Lists, folders, Boxes and Events are kept on your device and, on iPhone, iPad and Mac, in your own iCloud; they never reach us. Bento Lists sends anonymous usage statistics to our own server, without any ID of you or your device.

Your lists

Lists, folders, items, the Boxes that combine them, your Events and what you checked off are saved in one local file on your device. Bento Lists has no server that stores your content, and there is no sign-in.

iCloud sync on iPhone, iPad and Mac. If you are signed in to iCloud, Bento Lists keeps your Lists, Boxes and Events in sync between your Apple devices through your own private iCloud database (Apple CloudKit, container iCloud.com.ramuslabs.bentolists). Apple stores this data in your iCloud account under Apple’s privacy policy. It is in your private database, so we have no access to it. To keep your lists on the device only, turn off iCloud for Bento Lists in your device’s iCloud settings. On Android, Windows and the web Bento Lists does not sync; your lists stay on that device.

If you delete the app, the local file is deleted with it unless you keep a copy; what is in your iCloud stays there until you delete it in Bento Lists or in your iCloud settings.

AI agents (MCP)

On a computer you can let an AI agent of your choice work on your lists through Bento Lists’ MCP server. That server runs locally on your computer and edits the local file; nothing is sent to us. Which AI service your agent uses, and what it sends there, is your choice and outside Bento Lists; the privacy policy of that service applies.

Usage statistics

Your lists never reach us. Their names, items and anything you write stay on your devices and, if you use it, in your own iCloud. Bento Lists never sends them to us.

To see whether Bento Lists works for people, the app sends a few usage events to our own server (api.bento-lists.ramuslabs.com, hosted by Hetzner Online GmbH in Germany): that the app was opened for the first time, that it was used on a day, that a first Event was created and an item checked off, that the subscription screen was shown, and that a purchase failed (with the product and the store’s error code). Each event carries when it happened, the app version and the platform (for example iOS or Android). These events are anonymous: they carry no name, account, location, content, install ID or device ID. The same connection delivers settings to the app and carries no identifier of your device.

The legal basis is our legitimate interest in understanding whether the app is used and in improving it (Art. 6(1)(f) GDPR). Storing the small markers on your device that make sure “first opened” and “used today” are sent only once is covered by § 25(2) No. 2 TDDDG. We do not sell this data, do not use it for advertising and do not share it with third parties apart from our hosting provider as processor.

Retention. Usage events wait on your device until they can be sent; events that could not be sent within 30 days are deleted there. On our server each event is kept only until it has been counted, and is deleted at the latest 30 days after it arrived (usually after 3 days). We keep only daily counts per event and app version, which do not relate to any installation or person; we keep them without a time limit. Our server does not store or log your IP address: the web server writes no access logs, and the app server neither stores nor logs IP addresses. The app sends no device identifier, so our server stores nothing that identifies your device. Technical error logs are limited in size, older entries are overwritten, and they are deleted with every update of the server software. Our hosting provider makes daily backups of the server, each kept for 7 days, so deleted data can remain in a backup for up to 7 more days.

Subscription

Unlimited Lists and Boxes and one open Event are free. The monthly subscription, which lets you keep more Events open at once, is sold through the App Store on Apple devices and through Google Play on Android; the store bills it, and we never see payment details. On Windows and the web the subscription is not offered yet.

Purchases are validated by RevenueCat, Inc. (USA) as our processor. To check what you have bought, the app sends RevenueCat a randomly generated app user ID, technical device and app information (such as the operating system version) and the store transaction (your purchase history for Bento Lists). The ID is not linked to your name, your store account or any other identity.

The legal basis is the performance of the purchase contract and our legitimate interest in verifying purchases reliably (Art. 6(1)(b) and (f) GDPR). Data is transferred to the USA under the EU-US Data Privacy Framework and standard contractual clauses. See revenuecat.com/privacy.

Tracking

No ads, no tracking across apps, no advertising identifier and no third-party analytics SDKs. The usage statistics described above are not used for tracking.

App downloads

When you download or update the app, the App Store or Google Play processes data under their own privacy policies. We only receive aggregated, anonymous statistics such as download counts.

Contacting us

If you write to us at hello+bento-lists@ramuslabs.com, we process your email address and message only to answer you (Art. 6(1)(b) and (f) GDPR).

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). Write to hello+bento-lists@ramuslabs.com.

Most data never reaches us. It stays on your device or in your own iCloud account, and you can delete it yourself at any time by removing the app or its files.

Right to lodge a complaint

You can complain to a data protection supervisory authority, in particular in the member state where you live. The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

Children

Our apps work without an account and do not ask for your age. We do not knowingly collect personal data from children under 16.

Changes

When the app or the law changes, we update this policy. The version published here applies.