Privacy Policy

Effective date: June 9, 2026

bundlist ("we", "us", or "our") operates the bundlist service, accessible at bundlist.app. This policy explains what information we collect, how we use it, and your rights with respect to it. By using bundlist, you agree to this policy.

1. Information We Collect

We collect the following categories of information:

• Account information. When you sign in with Google, Apple, or Facebook, we receive your name, email address, and profile image from that provider when available. We use this to create and identify your account, and to display your profile in the app. We do not receive your password.
• Content you create. Lists, field definitions, and items you create within bundlist are stored on our servers on your behalf. This content belongs to you. We do not review or screen the content of your lists. bundlist is not designed or certified for storing sensitive information such as passwords, payment credentials, Social Security numbers, health records, or private API keys — please do not store such information here. See our Terms of Use for details.
• Usage data. We log standard request metadata — timestamps, HTTP method, path, response status, and latency — for operational monitoring and debugging. These logs do not include the content of your lists or items.

2. How We Use Your Information

• To provide, operate, and maintain the bundlist service.
• To authenticate you and associate your content with your account.
• To display your profile name and image in connection with shared lists and collaboration features.
• To monitor service health, diagnose errors, and improve reliability.
• To respond to your requests or support inquiries.

We do not use your content to train machine learning models. We do not sell your personal information or content to third parties.

3. Information Sharing

We share your information only in the following circumstances:

• Service providers. We use Supabase (supabase.com) to store your account data and list content. Supabase processes this data on our behalf under their own privacy and security controls. We use Google, Apple, and Facebook OAuth for authentication; each provider's privacy policy governs how they handle your information during sign-in.
• Shared lists. If you share a list with other users, we disclose the list content, your display name, and your profile image to the people you choose to share with so they can identify the source of the shared content and collaborate on it. If you share a list by link, recipients may forward that link to other users, and anyone who receives a valid link may be able to access the list until access is revoked by the owner. List owners can remove collaborators at any time. Recipients may also see the display name and profile image associated with their own access to the shared list.
• Legal requirements. We may disclose information if required to do so by law, court order, or governmental authority.
• Business transfers. If bundlist is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.

We do not share your information with advertisers or data brokers.

4. Data Storage and Security

Your data is stored on servers in the United States. We use industry-standard measures to protect it, including TLS encryption in transit and access controls at rest. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we take reasonable precautions.

5. Data Retention

We retain your account information and content for as long as your account is active. If you delete your account, we will delete your personal information and content within 30 days, except where retention is required by law or for legitimate operational purposes such as fraud prevention.

6. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data.
• Export your list data at any time using the export feature in the app.

To exercise any of these rights, email us at privacy@bundlist.app. We will respond within 30 days.

7. Children's Privacy

bundlist is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with their information, please contact us and we will delete it promptly.

8. Third-Party Links

bundlist may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any information.

9. Changes to This Policy

We may update this policy from time to time. When we do, we will update the effective date above. For material changes, we will notify you by email or by a prominent notice in the app before the change takes effect.

10. Contact

Questions about this policy? Email us at privacy@bundlist.app.