LISVARO PRIVACY POLICY

2. What information you enter

The only information the user provides are the addresses (URLs) of the product pages they choose to watch, together with what they want watched on them: a target price, a discount percentage or simply that the product comes back on sale. If the page offers several versions of the product, also which one is followed. That information is stored on the device and is not sent anywhere. An address can also be saved without watching it, in the Wishlist: it keeps whatever the page published the day you saved it and is never consulted again, so while it sits there it generates no request to the shop at all.

3. Requests leave your phone, and the shop sees your IP address

To find out a product's price, the app downloads that product's page. That request is made directly by your phone, from your own Internet connection. There is no intermediate server of ours. We want this to be clear because it has a consequence you should know about:

• The shop being queried sees your IP address, just as it would if you opened that same page with your phone's browser. It is a piece of data that leaves your device and you have a right to know it.
• The shop may also record the date and time of the request and the specific page requested, in accordance with its own policies, over which we have no control.
• The app identifies itself to the shop with the string LisvaroApp/1.0 (+https://acform.es/bot), which says who it is and links to a page explaining it. It sends no identifier of yours, no installation number, and nothing that would allow your device to be recognised between two requests.
• Some shops require a technical cookie to be accepted in order to serve the page. The app accepts them and sends them back only during that request, in memory: they are never written to disk and they disappear when it finishes. A stored cookie would be a persistent identifier, and that is why none is stored.
• At least one hour elapses between two requests for the same product, and out of the box three do, or more if the shop or the version you are using requires it. That floor cannot be switched off from the app, and it applies to shops read through the official API just as it does to the rest.
• If you would rather not expose your IP address to a particular shop, the way to avoid it is not to add products from that shop.

4. When the price comes from the shop's official interface

Some shops publish their prices through an interface meant for programs (an «API») instead of requiring the page to be read. Today that is the case with eBay. For eBay listings the app does not download the page: it asks eBay's interface server, api.ebay.com, for the figure. It is cleaner for both sides —a few pieces of data travel instead of a whole page, with its advertising and its images— but it is worth knowing how it differs from the above:

• The price request is made by your phone, from your own connection, just as in point 3. What changes is that a permission is needed first, and that permission is requested from a server of ours: it is explained in point 5.
• The address it connects to is not the one you pasted. You add a listing from ebay.es —or from any of eBay's other marketplaces— and the request goes to api.ebay.com. It is the same company, but it is a different server, and we tell you because it is not visible.
• eBay may record your IP address, the date and time, and the number of the listing requested, in accordance with its own policies, over which we have no control.
• No data of yours is sent. Not your eBay account if you have one —the app does not ask you to sign in and cannot access it—, nor an installation number, nor the phone's advertising identifier, nor anything that would allow you to be recognised between two requests. Besides the listing number, the only thing that travels is which eBay marketplace it is on, which is deduced from the address you added.
• To eBay, the app always identifies itself the same way, with a developer permission that is the same for everyone. eBay sees «the Lisvaro app», not «this user».
• Nothing from that connection is stored on your phone. The permission eBay grants lives in memory while the app works, expires on its own in about two hours and is never written to disk.
• There is no affiliate link and no commission. The app gains nothing from you looking at an eBay listing, and it adds no tag to the address.
• The minimum interval of one hour from point 3 applies here too. If you would rather not expose your IP address to eBay, the way to avoid it is not to add eBay listings.

5. The connection to acform.es

Reading eBay listings requires a permission granted by eBay, and that permission is requested from a server of ours at acform.es instead of being kept inside the app. It is safer for everyone: that way the credential does not travel in the installation file, where anyone could extract it.

• The only thing requested is the permission. That request carries no product address, no target prices of yours, no history and nothing about what you are watching. The server cannot know which products you follow, because we never send them to it.
• The price request is still made by your phone directly against eBay, using that permission. The server does not take part and does not see the result.
• To make sure that whoever asks for the permission is the app and not a program imitating it, the request is accompanied by a certificate issued by Google Play that our server checks. That certificate says the app is genuine and the device is real; it does not say who you are, it does not carry your Google account, and it holds no identifier that would follow you between two requests.
• Nothing personal is stored on the server. Its log records the date, whether the certificate was valid and where the permission came from. It stores neither the certificate, nor the permission, nor anything identifying a user.
• As on any web server, our hosting's access log records the IP address and the time of the request, and it is kept for the usual life of a technical log. It is cross-referenced with nothing, because there is nothing to cross it with.
• If you have eBay listings saved and acform.es is unavailable, only those stop updating. The other shops keep being read normally, because they do not go through any server of ours.

6. When the app uses the phone's browser

Some shops do not publish the price in the page's code: their JavaScript writes it after loading. For those —and only for those, after the normal route has been tried— the app opens the page in the operating system's own browser (the WebView component that Android already has installed), reads the price and closes it. No window is opened and you are not interrupted.

This has consequences you should know about, and they are the same as if you opened that page yourself:

• The system browser identifies itself with its own identity, the usual one for your phone, not with the app's. We do not falsify that string in any way.
• When the page loads, the shop's code runs, and therefore its cookies, its measurement tags and any third-party resources it includes may act, in accordance with that shop's policies and not ours. It is exactly what happens when you visit their website.
• Images are always blocked in those loads, without exception and regardless of any setting. It greatly reduces the data you use and the load the shop has to bear.
• That browsing session is not kept: no cookies on disk, no history, no local storage of ours. The only thing saved out of the whole process is the data in the next section.
• If a shop shows a verification wall (“confirm you are not a robot”), the app does not solve it on its own: it shows it to you so that you decide.

The site's robots.txt file is always requested on behalf of LisvaroApp, including when the page is going to be loaded by the browser, so that the exclusion any shop can request works on both routes.

7. What is stored on your device

Everything that follows is stored in the local database on your phone and nowhere else.

For each product you add: the name, the page address, the shop's domain, the currency, the image address if the page publishes one, the chosen variant if the listing has several, your target price or percentage, the checking frequency, the date it was added, the category you have put it in, which of the two lists it is on —tracking, Wishlist or both—, whether you have pinned it to the top and the position you have left it in. And a few technical items: its identifier at the shop if the price comes from an official interface, the second image address when the page publishes two, and how many checks in a row have failed, which is what decides when to try again.

For each price reading: the price, the currency, the availability and the date. If the page publishes a struck-through or previous price, that is stored too, so the discount can be calculated.

When a check fails, the reason for the last failure and a technical detail are also stored —for example “the shop did not respond” or “the price was not found on the page”— so that we can explain to you what happened.

Of each alert you set up: what kind it is —price, percentage or back on sale—, the figure you set, what the discount is calculated against, whether it is active and the date it last fired. That date exists so as not to repeat the same alert to you every day while the condition keeps being met, and it is deleted with the alert.

For each listing, what the shop publishes openly about the product is stored as well: its description, if it publishes one, and its average rating together with the number of opinions behind it. It is there so that you can recognise a listing months after saving it —above all in the Wishlist, where the name alone is not enough—, it is refreshed along with the shop and it is not used for anything automatic. No other page content is stored: neither the written reviews, nor the comments, nor the rest of the text.

And one thing of yours, if you want

In Settings you can write how you prefer the app to address you. It is used only to greet you at the top of your list.

• You write it. The app does not take it from your Google account, nor from your contacts, nor from anywhere else on the phone: it does not ask for —and will not ask for— the permissions that would be needed for that.
• You are never asked. The field is in Settings and comes empty. If you leave it blank, the app says “Hello” and never mentions it again.
• It does not leave the app. It is not sent to any shop, it does not appear in the alerts you receive and it never reaches any server of ours.
• You delete it whenever you like, by clearing that same field.

And whatever you write about a product

Each listing takes a note of yours, written with the pencil on the listing itself. It is there to help you recognise a product whose published name means nothing to you: the shop calls it “House on Calle Altozano” and you think of it as “the one in Fuensanta with a garden”.

• You write it and only you see it. It is not sent to any shop, it does not appear in the alerts you receive and it does not reach any server of ours.
• It is not used for anything automatic: it is not compared, it is not searched and it plays no part in any decision the app makes.
• It does not replace the product name, which is the one the shop publishes and cannot be changed. Each field says one thing only.
• You delete it whenever you want, by emptying that same field, and it goes with the listing when you delete it.

Your phone's backup

Android may include the app's data in the backup you have set up in your Google account, just as it does with every other app. That copy is yours and goes to your Drive: we do not see it, we do not receive it and we cannot access it. If you would rather it did not happen, you can turn it off in Android's backup settings.

Your own backup

In Settings you can save a file with everything the app stores about you —your products, their history, your alerts, your categories, your notes and the technical log of point 9— and choose where to put it: your Drive, this phone or wherever you prefer. The app does not enter your Drive and does not ask you for any account: it simply hands the file to Android's picker and you decide.

That file is yours and is not encrypted, so that you can open it or take it wherever you want. If you leave it in a shared place, anyone with access to that place will be able to see which products you follow.

It does not carry your settings —neither the name you may have written, nor the switches, nor the purchase—. Restoring a backup replaces your products and their history, and nothing else.

8. Product images

The app stores the address of the image that the page itself declares, not the image as part of your data. Display is switched off by default and you can turn it on or off whenever you like from the app's Settings.

• With the option switched off —the factory state— no request is made to any image server.
• If you switch it on, when an image is shown your device requests it from the shop's image server, with the same IP address implications described in point 3.
• Once downloaded, a copy is kept in the device's own image cache, so it does not have to be requested again every time you open the list. That copy is local, managed by the system, and is deleted when you clear the app's data or uninstall it.
• In the price readings performed with the system browser (point 6) images are always blocked, regardless of this setting.

9. The app's log

The app keeps an internal technical log of what it does: when it has checked, which products it reviewed, how long it took and what failed. You can read all of it in Settings › App log.

• It is stored only on your device and is not sent anywhere automatically.
• It contains product addresses and error messages. It contains no personal data about you: not your name, not your email, not device identifiers.
• It is the same log the app offers to let you copy if you write to us to report a problem. Sending it is your decision and your action: if you send it to us, we process it solely to diagnose the incident and we keep it in the mailbox for as long as is needed to resolve it, as explained in the website privacy policy. You can review it and trim it before sending.
• It is deleted when you clear the app's data or uninstall it, and old lines are discarded on their own.

10. Notifications

The alerts —both price-drop alerts and alerts that a product is back on sale— are local notifications, generated by your own device when the condition you set is met. No push notification service is used, neither Firebase Cloud Messaging nor any equivalent external service. No server knows which products you watch or when you have been alerted.

11. Data the app does NOT collect

So that there is no doubt whatsoever, Lisvaro does not collect, does not transmit and does not share:

• Email address, telephone number or any identifying data. The app does not ask you for your name and does not take it from the phone; if you write one in Settings for the greeting, it stays on the device and does not leave it (point 7).
• Location or GPS data.
• Contacts, photos, calendar or any other content on the device.
• Advertising identifiers or user profiles.
• Payment data: the app does not process any charge and receives no payment data. If it is purchased from an app store, the transaction is handled entirely by that store, in accordance with its own policies.
• Nothing that happens inside the system browser when it is used to read a price (point 6) reaches us: we do not read its storage, we do not keep it and we do not transmit it. Whatever that shop records on its own account is governed by its own policy.

12. Advertising and analytics

The app contains no advertising and includes no analytics or tracking SDK that records your activity.

This refers to the app. The shop pages that the app reads have their own analytics, which act when the page loads —just as if you opened it yourself— and over which we have no control.

13. Data retention and deletion

As all the data resides solely on your device, you have complete control over it:

• You can delete any product and its history from the app itself, at any time.
• When you uninstall the app, or clear its data from the operating system settings, all the information disappears permanently from the device.
• The deletion covers everything: the products, the price history, the app log and the image cache. Nothing is left on the device. Off it, a copy of yours may remain —Android's, or one you saved yourself—, and that one you delete wherever you keep it: point 7 explains both.
• The developer keeps no copy, because it was never received in the first place.

14. Minors

Lisvaro is not specifically aimed at minors and does not knowingly collect data from them. Since the app collects no personal data from any user, no differentiated processing is carried out on the basis of age.

15. Your rights

The General Data Protection Regulation (GDPR) grants you the rights of access, rectification, erasure, restriction, portability and objection. Since the developer does not receive, does not store and does not process any personal data of yours, these rights are guaranteed by default: you exercise them directly from your device, by deleting the data or uninstalling the app. If you would nonetheless like to contact the data controller, you may do so through the contact form or at the address given at the foot of this document.

16. About the Lisvaro crawler

If you are responsible for a shop or a website and want to know exactly what the app does when it reads a page, or you want to exclude your domain, the full information is on the acform.es/bot page.

17. Changes to this policy

This policy may be updated to reflect changes in the app or in applicable legislation. The version in force is always the one published at this address, and the date of the last update appears at the foot.