Privacy policy
Last updated 13 September 2026. This policy covers the Die Lys Android app and the dielys.com website.
The short version. We keep your email address and the lists you make, so they can sync between your devices and the people you share them with. There are no ads, no analytics and no tracking, and we don't sell or share your information for marketing. You can delete your account at any time, in the app or at dielys.com/account/delete.
Who we are
Die Lys is run by Invisionsoft (Pty) Ltd (registration number 2026/488645/07), Prince Alfred Hamlet, Western Cape, 6835, South Africa. We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA).
Information Officer: Gerhard Combrinck, support@invisionsoft.co.za.
What we keep, and why
| Information | Why | How long |
|---|---|---|
| Your email address | It is your account: we send your sign-in links to it, and it is how people you share a list with see who is on it. | Until you delete your account. |
| Your lists and what is on them (names, items, colours, order, ticked and starred state) | To sync them between your devices and with everyone on the same list. | For as long as someone is still on the list. Things you remove are hidden everywhere straight away; the server keeps a record that they were removed, so a phone that was offline removes them too. |
| Which lists you are on, and your role on each | To decide who may see and change a list. | Until you leave the list, are removed from it, or delete your account. |
| A random device identifier created by the app, and sign-in session tokens (stored only as one-way hashes) | To keep you signed in on each device and tell your devices apart when they sync. | Sessions end 30 days after a device was last used, or when you delete your account. |
| A push notification token issued by Google for your device | To wake the app so it syncs when a list you are on changes. The notification itself carries no list content. | Until someone else signs in on that device, or you delete your account. |
| Pending sign-in and account deletion links (a hash of the link, with your email address or account) | To sign you in, or to delete your account, when you use the link we emailed you. | 15 minutes, or until the link is used. |
| Email addresses you invite to a list | To send that person the invitation you asked us to send. | Not kept after sending. The invitation link itself expires after 7 days. |
| Keyed hashes of IP addresses and email addresses (never the addresses themselves) | To limit how often sign-in and invitation requests can be made, so the service cannot be abused. | About a day. |
Your lists are also stored on your own phone so the app works offline.
What we don't do
- No advertising, and no advertising identifiers.
- No analytics or tracking in the app or on this website.
- We don't sell your information or share it with anyone for their own marketing.
- We don't read your lists except where you ask us to help with a problem, or where the law requires it.
Who else handles your information
We use a small number of service providers (operators, in POPIA's terms) who process information only on our instructions:
- Cloudflare, Inc. hosts the service and stores your account and lists. Cloudflare also processes connection details such as your IP address to deliver and protect the service.
- Brevo (Sendinblue SAS) sends our emails: sign-in links and list invitations.
- Google LLC delivers push notifications through Firebase Cloud Messaging, and distributes the app through Google Play.
These providers may store or process information outside South Africa, including in the United States and the European Union. Where that happens, we rely on their contractual commitments to protect it to a standard comparable to POPIA.
Shared lists
When you share a list, everyone on it can see the list's contents and the email addresses of the other people on it. Anything you add to a shared list is visible to them and stays part of that list for as long as they are on it, including after you leave it.
How we protect it
Everything between the app and our servers is encrypted in transit. Sign-in links and session tokens are stored only as one-way hashes, so a copy of our database could not be used to sign in as you. Access to production systems is limited to the people who run Die Lys.
Deleting your account
You can delete your account in the app under Settings → Delete account, or on the web at dielys.com/account/delete. When you do:
- Your email address, sessions, device records and push tokens are erased.
- Lists that only you are on are erased.
- Lists you share with others stay with them. If you own one, ownership passes to the person who has been on it the longest. What you added to those lists stays on them.
Deletion takes effect straight away and cannot be undone. Copies in our hosting provider's backups are overwritten in the normal course of their operation.
Your rights
Under POPIA you may ask us what personal information we hold about you, ask us to correct or delete it, and object to how we process it. Write to support@invisionsoft.co.za and we will respond within 30 days. If you are unhappy with our response, you may complain to the Information Regulator of South Africa at inforegulator.org.za.
Children
Die Lys is not aimed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If we change how we handle your information, we will update this page and the date at the top. For significant changes, we will also tell you in the app or by email before they take effect.