LystBot - Last updated: October 7, 2026
TourAround UG (haftungsbeschränkt)
Menzelstr. 18
55127 Mainz, Germany
Email: support@lystbot.com
Website: www.touraround.io
Managing director: Alexander Iyimen. Please use the contact details above for privacy requests.
LystBot provides lists, synchronization, shared content, reminders and optional access through agents, CLI/MCP, ChatGPT and Alexa. The app does not require a separate user account; access is associated with a device. We receive data from you and your device, through actions of shared-list members and, for connected services, from the respective providers.
We process the randomly generated device UUID and API keys, device name and model, operating system, app version and build, display name and signature emoji, language and time zone. The device UUID is a personal, pseudonymous identifier because it associates activities and content with your device.
List data includes identifiers, titles, types, categories, items, quantities, units, order, checked status, memberships and share codes. Other data includes favourites, change history and synchronization data, reminders with title, time, time zone, recurrence and delivery method, uploaded images, thumbnails, attachment metadata and saved links. API access involves agent names, emojis and actions.
Push services process registration tokens and notification content. Website and API requests generate connection and server-log data including IP address, time, requested URL, status code and browser/client information. When you contact us, we process contact details and correspondence.
A real name, email address and telephone number are not required for ordinary list use. Content may contain personal or sensitive information. GPS location is not requested for list use. Data for optional connections and crash reports is described in section 7.
Members of shared lists receive their content, attachments and member information. Agents and services you authorize receive data within their access rights, including accessible shared lists. Authorized operators and technical providers receive data as necessary for operation, support and security. Email providers process correspondence when you contact us. Further recipients are listed in section 7.
You have no legal obligation to provide data to use LystBot. Device identifiers, access credentials and content required for an action are necessary for that function; without them it cannot be performed. Display name, images, visible push notifications and third-party connections are optional. Camera or photo access is required for the respective image function. Without third-party connections, the app's list functions remain available.
There are no solely automated decisions producing legal or similarly significant effects under Art. 22 GDPR. AI interprets requested commands and may execute list or reminder actions; please check the results.
Our processor is DigitalOcean, LLC (USA). The backend database and uploaded files are stored in the Frankfurt am Main data centre. The processing agreement under Art. 28 GDPR, the DigitalOcean DPA, has been accepted.
Due to the US connection, access from the USA may occur, particularly for support. Safeguards are the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and the standard contractual clauses in the DPA (Art. 46(2)(c) GDPR). Google LLC is also certified under the EU-U.S. Data Privacy Framework. For optional connections, providers listed in section 7 may process data in the USA or other countries outside the EEA. Provider notices describe their processing and transfer bases. Information and copies of applicable safeguards are available via support@lystbot.com.
The app uses HTTPS for API connections. Device credentials are kept locally in secure platform storage; database access requires credentials. List content is not end-to-end encrypted.
We use Firebase Cloud Messaging (Google Ireland Ltd. and Google LLC, USA) for synchronization and notifications; on iOS, delivery also uses Apple Push Notification service (Apple Distribution International Ltd. and Apple Inc., USA). Data includes Firebase installation identifiers, FCM/APNs tokens and delivery data. Depending on the event, the payload includes list, item or reminder identifiers, action type, navigation target, timestamp, notification title and body; these can contain list and item text, reminder titles, and the acting user's display name and emoji. Silent synchronization messages may also contain such data. Legal bases are described in section 4. Further information: Firebase privacy information and Apple privacy information.
Amazon processes your voice input under its privacy notice. LystBot receives command text, language and Alexa user identifier, but no voice recordings. For linking we store a hash of the Alexa user ID, device association and linking and usage timestamps. Amazon receives response text that may contain list, item or reminder content. Amazon recipients include Amazon Europe Core S.à r.l. and affiliated Amazon companies, including in the USA.
To interpret free-form Alexa commands, the spoken command as text, language, time zone, current time and titles and types of accessible lists are sent to OpenRouter, Inc. (USA) and the provider of the model configured there. Processing, including possible storage, is also governed by these providers' terms; further information is available in the OpenRouter privacy policy. The legal basis for the requested Alexa connection and command processing is Art. 6(1)(b) GDPR. You can disconnect in settings.
You connect ChatGPT using a six-digit app code and approve access on LystBot's OAuth page. OAuth with PKCE associates the connection with your device. LystBot stores device authorization, client identifier, scopes and hashes of access and refresh tokens. Hashed IP-based attempt counters and a global counter limit pairing attempts within a ten-minute window. A technically necessary OAuth security cookie is described in section 8.
OpenAI (OpenAI Ireland Ltd. and OpenAI OpCo, LLC, USA) receives tool results with identifiers, titles, types and membership role of accessible lists including shared lists, item text, quantities, units, order and checked status, and reminders with title, time, time zone, recurrence, enabled status and delivery method. Write tools send requested list, item and reminder data to LystBot. Access is limited to your device memberships and authorized scopes (lists:read, lists:write, reminders:read, reminders:write). The legal basis is Art. 6(1)(b) GDPR.
OpenAI processes transmitted data under its privacy policy and your ChatGPT settings, including outside the EU. Disconnecting under Settings → ChatGPT, in ChatGPT or through token revocation immediately withdraws access but deletes neither your lists nor data already transmitted to OpenAI. Retention periods are in section 9.
Crashlytics (Google Ireland Ltd. and Google LLC, USA, EU-U.S. Data Privacy Framework) processes stack traces, error type, device model, operating system, app version, crash timestamp, Crashlytics installation ID, Firebase installation and session identifiers and technical diagnostic information. No list content, LystBot device UUID or personal custom keys are transmitted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is app stability and correcting errors. Google retains crash reports and associated identifiers for 90 days by default, then starts removing them from live and backup systems.
Objection under Art. 21 GDPR: You can turn off crash reports at any time in the app under Settings → App → "Send crash reports" or object to the processing by emailing support@lystbot.com. Sending is enabled by default. Further information: Google/Firebase privacy information.
The OAuth approval page sets the security cookie __Host-lystbot-oauth-csrf to prevent forged approvals. It lasts no more than ten minutes (Max-Age=600) and is removed on completion; it is Secure, HttpOnly and SameSite=Lax. It serves only the connection you requested.
The app stores UUID and API key, device and profile settings in secure platform storage, and onboarding, version and display settings in local preferences. Lists and reminder data are stored locally for app functions; diagnostic output remains in a local in-memory buffer of no more than 500 lines and in the platform console. It is not transmitted to Crashlytics as an app log. iOS Keychain data may survive uninstallation.
Technically necessary cookies and local storage for explicitly requested functions are based on Section 25(2) No. 2 TDDDG. Subsequent personal-data processing uses the bases in section 4. Local fonts on the website, blog and in the app do not cause font requests to Google. The objection option in section 7.5 applies to crash reports.
You can request deletion at support@lystbot.com. Statutory exceptions, other members' rights and independently stored copies at connected services must be considered. We respond without undue delay, generally within one month; if a permitted extension of up to two further months is needed, we inform you within the first month and explain why.
Subject to the legal conditions, you have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), information about recipients following rectification, erasure or restriction (Art. 19), and portability for automated processing based on consent or contract (Art. 20 GDPR). You may withdraw consent at any time for the future (Art. 7(3)); previous processing remains lawful.
Objection under Art. 21 GDPR: For processing based on legitimate interests, you may object on grounds relating to your particular situation. We will then stop processing unless compelling legitimate grounds or the establishment, exercise or defence of legal claims justify continuation. You may object to direct marketing at any time without giving reasons. You may object to the processing of crash reports by emailing support@lystbot.com or turn them off under Settings → App → "Send crash reports".
To exercise these rights, contact support@lystbot.com. We may request information necessary to verify identity and securely associate your request.
You may complain to a data protection supervisory authority (Art. 77 GDPR), particularly where you habitually live, work or where the alleged infringement occurred. Our competent authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Postfach 30 40
55020 Mainz, Germany
www.datenschutz.rlp.de
The current privacy policy is available through the app and at this URL. We provide required additional information about processing changes in accordance with legal requirements.