Privacy policy
Effective October 20, 2026. What the apps collect, where it goes, and what you can ask us to do about it. Read alongside our Terms of Use.
This Privacy Policy covers the Persnickety Penguin apps, Shop (Shopping List), Pack, Spots, Count it! and Stash, and the website www.persnicketypenguin.com (together, the "Apps"). The Apps are made by Morgan Collective Group LLC, an Illinois limited liability company, doing business as Persnickety Penguin ("Persnickety Penguin", "we", "us"). Morgan Collective Group LLC is the controller of the personal data described here.
Effective Date: October 20, 2026 · www.persnicketypenguin.com · info@persnicketypenguin.com · Morgan Collective Group LLC · Chicago, Illinois
1. Our Data Covenant
Before anything else, the commitment that shapes this whole policy: we will never sell your personal data, and we will never use it to show you advertising. The Apps have no ads, no analytics, and no tracking. If Persnickety Penguin ever shuts down, nothing of yours is auctioned. If it is ever acquired, any personal data we hold transfers only to an owner who agrees in writing to these same commitments, and you get 30 days' notice first.
This is a binding term of our agreement with you, written into Section 13 of our Terms of Use. You pay for Pro, if you want it, precisely so that you are the customer and never the product.
2. The short version: your lists are not on our servers
The Apps are built so that we hold as little as possible.
- Count it! keeps everything on your phone and, if you connect Google Drive, in a file in your own Google Drive. Nothing else is sent anywhere.
- Shop, Pack, Spots and Stash keep your lists on your phone and, if you connect Google Drive, in files in your own Google Drive. We do not run a database of your lists, and we cannot open your Drive files.
- Stash can, if you turn it on, put the planned dates of your items on a Google Calendar you choose.
- A few features need a small helper on our web host to work: signing in to Google, confirming a Google Play purchase, and some Spots map features. Those helpers pass a request through and send the answer back. They do not save what passes through them.
The rest of this policy is the detail.
3. Information the Apps handle
3.1 On your phone
Each App saves its data in your phone's browser storage for that App: your lists, items, notes, photos you attach in Shop, places and ratings in Spots, counters and history in Count it!, the items and locations in Stash, your preferences, and, if you sign in, your Google sign-in tokens and the email address of your Google account. This data stays on your phone. Uninstalling the App, or clearing its site data, deletes it.
3.2 In your Google Drive (if you connect it)
If you connect Google Drive, the App saves your data in files it creates in your Drive: shopping_list_data.json for Shop, a folder called "Pack Lists" for Pack, spots_data.json for Spots, count_it_data.json for Count it!, and stash_data.json for Stash. These files belong to you, live in your Google account, and are covered by Google's own terms and privacy policy. You can see, download, or delete them in Google Drive at any time.
3.3 Google sign-in
To connect Drive, you sign in with Google. The Apps ask Google only for:
- See, edit, create and delete only the specific Google Drive files you use with this app (
drive.file). The App cannot see any other file in your Drive. - Your email address (Shop, Pack, Count it! and Stash,
userinfo.email). Spots reads the email address of your Drive account from Drive itself. - Stash only, and only if you turn on Google Calendar in Stash's Preferences: see your list of calendars (
calendar.calendarlist.readonly), so you can pick one, and add, change and delete calendar events (calendar.events). See Section 3.5.
The App uses your email address on your phone to show which account is connected, to show who a shared list belongs to, and to recognize accounts we have given Pro for free. It is not sent to us.
3.4 When you share a list
Shop, Pack, Spots and Stash let you share a list with someone by entering their email address. Count it! has no sharing. The App asks Google Drive to give that person access to the file, and Google emails them a link with a short note from the App. In Shop, Pack and Spots, the email addresses you share with are also saved in the shared Drive file, so everyone who can open that file can see who else it is shared with. Only share with people you are comfortable seeing each other's email address.
Shop also tells the other people on a shared list when an item is added, the way each of them chose in Settings, Notifications: a phone notification, an email, or not at all. Each person's choice is saved in the shared Drive file, along with the phone's notification address if they chose phone notifications, so everyone who can open that file can see it. Our Shop helper sends the message only to people the file is actually shared with. An email is sent through Resend, an email delivery service, from shop@persnicketypenguin.com; it contains the recipient's email address, the name of the item and the list, and the sender's first name, and replies go to the sender's email address. A phone notification is delivered by the phone's own notification service (for example Google's on Android); its content is encrypted so that service cannot read it. See Section 5.
3.5 Google Calendar (Stash)
Google Calendar is off until you turn it on in Stash's Preferences and pick a calendar. Then, for each item with a Planned for date, Stash adds an all-day event to that calendar, named after the item and its location (for example "Chili (Freezer)"), and moves or removes the event when the date changes or the item is removed. Stash reads back only the events it made itself, and reads your list of calendars only so you can choose one. It does not read your other events. The events live in your Google Calendar, under Google's terms; anyone who can see that calendar can see them. Turning the option off removes Stash's events from the calendar.
3.6 Photos (Shop)
You can attach a photo to an item in Shop. The photo is saved with the item on your phone and in your Drive file. Photos are often saved exactly as your camera made them, so if your camera adds the location where a photo was taken, that information can stay inside the photo. Anyone you share the list with can see the photo.
3.7 Your location (Spots)
Spots asks your phone for your location, with your permission, so it can show you on the map, find places near you, sort search results by distance, and show travel times. You can say no and still use Spots; it then works without distances and nearby search. Your location is used while the App is open and is never saved in your lists or your Google Drive. So that it does not have to look travel times up again, Spots remembers the last times on your phone, together with the point they were measured from, for up to 6 hours. To do these jobs it is sent to the map and search services listed in Section 5:
- to Geoapify, through our helper, to work out walking and driving times from where you are to your spots (Spots Pro; without Pro, Spots shows the straight-line distance, worked out on your phone);
- to Photon and to Nominatim, to favor search results near you, and to look up the address of where you are when you tap Nearby;
- to Google, through our helper, for Google search and nearby places (Spots Pro).
The other places you search for, and the addresses and map areas you look at, are sent to those same services so they can answer.
3.8 Google Play purchases
When you buy Pro in the Android app, Google Play takes the payment. We never see your card or payment details. Google gives the App a purchase token, which the App sends to our helper so that we can confirm the purchase with Google and unlock Pro. Google also gives us the order record that every Play seller receives: order number, product, price, date and country. The App keeps a note of the purchase on your phone so Pro stays unlocked.
3.9 The website and our web host
The website and the Apps are served by Netlify, our web host. Like any web host, Netlify receives the standard information your browser sends with every request (IP address, browser type, the page or helper requested, and the time) and may keep it in short-lived logs for running and securing the service. We do not add analytics to those logs or use them to track you.
3.10 What we do not collect
We do not use analytics, advertising, cookies for tracking, or tracking pixels. We do not collect biometric identifiers or biometric information, as those terms are defined in the Illinois Biometric Information Privacy Act (740 ILCS 14) or any other biometric privacy law, and we never run facial recognition on photos. We do not collect government identification numbers or payment card numbers. We do not build a profile of you. Please do not put sensitive personal information in your lists or notes; if you share a list, the people you share it with will see it.
3.11 If you write to us
If you email us, we keep your message and our reply so that we can help you.
4. How we use information
Each purpose uses only the information it needs. The table lists each purpose, the data it uses, and, for people in the EEA, the UK and Switzerland, the legal basis under the GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Run the App on your phone and save your lists | Your lists and preferences, kept on your phone | Contract (our Terms) |
| Save and sync your lists in your own Google Drive | Your lists, your Google sign-in tokens | Contract |
| Put planned dates from Stash on the Google Calendar you choose | Item and location names, planned dates, your list of calendars | Contract; your choice to turn it on |
| Share a list with the people you choose | The email addresses you enter, the shared file | Contract |
| Tell the people on a shared Shop list that an item was added | Their email addresses, the item and list name, the first part of your email address | Contract; legitimate interest in keeping a shared list in step |
| Show your location, nearby places, travel times and search results in Spots | Your location while the App is open, what you search for, your spots' addresses and map positions | Contract; your permission on your phone |
| Show Google place details and the Google map in Spots Pro | Your searches, place IDs, your location for nearby search | Contract |
| Confirm a Google Play purchase and keep Pro unlocked | Purchase token, product, order record | Contract; legal obligation (tax and accounting) |
| Recognise accounts given Pro for free | Your Google email address, checked on your phone | Legitimate interest in giving free Pro to the accounts we choose |
| Keep the website and the helpers running and secure | Standard request information kept by our web host | Legitimate interest in security |
| Answer your emails | What you send us | Legitimate interest in helping you |
| Meet legal obligations and respond to lawful requests | Whatever the obligation or request requires | Legal obligation |
We do not sell your personal data. We do not use it for advertising. We do not make automated decisions about you that have legal or similarly significant effects.
5. Who receives information
The list below is the whole list. Each service receives only what it needs for the job described, and none of them is given your data for its own marketing. See the Data Covenant in Section 1.
| Service | What it does | What it receives |
|---|---|---|
| Google (sign-in, Drive, Picker, and Calendar for Stash) | Signs you in, stores your lists in your own Drive, and, if you turn it on, puts Stash's planned dates on your calendar | Your Google account, your App files, the email addresses you share with, Stash's calendar events |
| Google Play | Sells and confirms Pro purchases in the Android apps | Your purchase, under Google Play's own terms |
| Google Maps Platform (Spots Pro) | Google search, nearby places, place details and the Google map | Searches, your location for nearby search, place IDs, the map area you view |
| Netlify | Hosts the website, the Apps and our helpers | Standard request information; requests passing through the helpers |
| Resend (Shop) | Sends the "item added" email to people on a shared list | Recipient email address, item and list name, the sender's first name and email address (for replies) |
| Phone notification services, such as Google's on Android (Shop) | Deliver "item added" phone notifications to people who chose them | The phone's notification address and an encrypted message they cannot read |
| Geoapify, run by Keptago Ltd in Cyprus (Spots Pro) | Works out walking and driving times | Your location and your spots' map positions |
| Photon, run by Komoot in Germany (Spots) | Place and address search, Nearby | What you search for, your location |
| Nominatim and OpenStreetMap map tiles, run by the OpenStreetMap Foundation in the UK (Spots) | Address search and the standard map | What you search for, addresses, your location as a search hint, the map area you view |
| Google Fonts, jsDelivr and unpkg | Deliver the fonts and code libraries the pages use | Standard request information |
Google's privacy policy is at policies.google.com/privacy. Each other service publishes its own.
5.1 Google user data
The Apps' use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the features you see in the App, we do not transfer it to anyone except as described in this policy, we never use it for advertising, and no person at Persnickety Penguin reads it unless you ask us to for support, it is needed for security, or the law requires it.
5.2 Legal disclosures
We may disclose information we hold when required by law, subpoena, court order, or government request. Where the law allows, we will tell you before we do. Because we hold so little, there is usually little to disclose.
5.3 Business transfers
Only as the Data Covenant permits: to a successor that agrees in writing to be bound by Section 13 of the Terms, with 30 days' notice. Never as a standalone asset.
6. How long information is kept
| Category | How long |
|---|---|
| Data on your phone | Until you delete it, clear the App's data, or uninstall the App |
| Your Google Drive files | Until you delete them; they are yours and in your control |
| Google Play order records | 7 years (tax and legal compliance) |
| Purchase token (our helper) | Not kept; used once to confirm the purchase |
| Requests passing through our helpers | Not kept by us; our web host's standard logs are short-lived |
| Emails you send us | 2 years after the conversation ends |
| Records of a security incident | 3 years after the incident is closed |
Services in Section 5 keep what they receive under their own policies.
7. Your rights and choices
7.1 Everyone
Wherever you live, you can: see, change and delete your lists in the App and in your Google Drive at any time; disconnect Google Drive in the App's settings; turn off Google Calendar in Stash's Preferences; remove the App's access to your Google account at myaccount.google.com/permissions; turn off location for Spots in your phone's settings; and ask us for a copy of, a correction to, or the deletion of any personal data we hold about you. Write to info@persnicketypenguin.com. We may need to confirm it is really you. We respond within 30 days, or within the shorter period your local law requires, and we do not charge for a request unless the law allows it for repeated or excessive ones. We will never treat you differently for exercising a right.
7.2 Deleting your data
Delete your lists in the App, or delete the App's files from your Google Drive, and they are gone. Uninstalling the App deletes what is on your phone. Lists someone else shared with you belong to them and stay in their Drive. Google Play order records are kept as Section 6 says.
7.3 United States: state privacy rights
If you live in California, Colorado, Connecticut, Texas, Virginia, or another US state with a comprehensive privacy law, you have the right to know what personal data we collect and how we use and share it, to access it, to correct it, to delete it, and to receive a portable copy. Exercise these under Section 7.1.
These laws also give you the right to opt out of the sale of personal data, of sharing for targeted (cross-context behavioral) advertising, and of profiling that produces legal or similarly significant effects. Those rights need no request here, because the practices they regulate do not exist in the Apps: we do not sell personal data, we do not share it for targeted advertising, and we do not profile you in that way. We honor Global Privacy Control signals from your browser as an opt-out request where one applies. We do not respond to Do Not Track signals because there is no cross-site tracking to turn off.
If we decline a request, you may appeal by replying to our answer and we will review it again within 45 days; if you are still unsatisfied you may contact your state attorney general. An authorized agent may make a request for you if they show us your written permission, and we will verify it with you. California residents: we have not sold or shared personal information in the preceding 12 months, and the categories we handle are listed in Section 3. Your location in Spots is used only to provide the features you ask for, as Section 3.7 describes.
7.4 European Economic Area, United Kingdom and Switzerland
The controller is Morgan Collective Group LLC, Chicago, Illinois, reachable at info@persnicketypenguin.com. We process your data on the legal bases shown purpose by purpose in Section 4: performance of our contract with you; our legitimate interests; your consent, where we ask for it; and compliance with legal obligations. Where we rely on legitimate interests, we have checked that they are not outweighed by your interests and rights, and you can ask us to explain the balance. You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to receive it in a portable form, to withdraw consent at any time without affecting what was done before, and not to be subject to a solely automated decision with legal or similarly significant effects. Exercise them under Section 7.1. You also have the right to complain to a supervisory authority, in particular in the country where you live or work; in the UK that is the Information Commissioner's Office. We are based in the United States, and some of the services in Section 5 are in the United States; using the Apps from the EEA, the UK or Switzerland means your data is transferred there.
8. Security
- Every connection the Apps make is encrypted (HTTPS/TLS).
- Sign-in uses Google's secure sign-in flow (OAuth with PKCE); we never see your Google password.
- The Apps can reach only the Drive files they created or that you picked.
- Stash can reach your calendars only if you turn on Google Calendar, and then changes only the events it made.
- Our helpers keep their keys on the server, not in the Apps, and do not store what passes through them.
Your phone's own lock is what protects the data saved on it, so keep it locked.
8.1 If there is a breach
If we learn that personal data we are responsible for has been accessed or taken without authorization, we will tell the people affected without unreasonable delay, and in any case within the time the law requires, including the Illinois Personal Information Protection Act (815 ILCS 530) and the breach notification laws of the other places our users live. We will say what happened, what data was involved, what we are doing about it, and what you can do. We will also notify regulators where the law requires it.
9. Children
The Apps are for people 13 and older, and are not directed at children under 13. We do not knowingly collect personal information from a child under 13 as defined by the Children's Online Privacy Protection Act. If you are a parent or guardian and believe a child under 13 has given us personal information, write to info@persnicketypenguin.com and we will delete it.
10. Changes to this policy
When we make a material change, we will say so in the Apps or on the website before it takes effect, and update the effective date at the top. Changes that weaken the Data Covenant need at least 30 days' notice and never apply to data collected before they take effect. Earlier versions are available on request.
11. Contact us
Persnickety Penguin · Morgan Collective Group LLC
201 W Lake St STE 40769, Chicago, IL 60606-1803
info@persnicketypenguin.com · www.persnicketypenguin.com
Illinois residents may ask us by email for the name, address and contact details of the operator of the Apps, and we will provide them.