Privacy Policy

You can use BitList without creating an account.

In guest mode, your list content is stored locally on your device and is not synced to your BitList account or backend. We cannot recover guest list content if you clear your browser or app storage, delete the app, lose the device, or otherwise remove that local data.

Using the BitList website or app may still generate limited technical information needed to deliver, secure, and operate the service.

The information we collect depends on how you use BitList.

Account information

If you create an account, we may process:

• your email address;
• your preferred name and profile photo, if provided;
• authentication information;
• your account creation and activity timestamps; and
• information about connected sign-in methods such as Google or Apple.

If you use email and password authentication, passwords are handled by our authentication provider and stored in hashed form. We do not store your password in plain text.

Your content

When you use a synced account, we store content needed to provide BitList, including:

• lists and list items;
• notes and other information you add;
• files and images;
• list settings and organization;
• sharing and collaboration information; and
• information needed to sync your content across devices.

Your content remains yours. Our Terms of Service explain the limited rights you give us to operate BitList.

Subscription information

If you purchase a paid plan, we may receive and store information such as:

• your subscription plan;
• subscription status;
• billing period;
• purchase or renewal dates; and
• transaction or payment-provider identifiers.

Payments are handled by our payment provider or by an app marketplace such as Apple's App Store. We do not store full payment card numbers on BitList servers.

Technical information

When you use BitList, our systems and service providers may process limited technical information needed to operate and secure the service, such as:

• IP address;
• browser, device, and operating-system information;
• request and error logs;
• approximate timestamps of activity; and
• security and fraud-prevention information.

We use Vercel Web Analytics on the website to measure aggregate visits, page views, referral sources, approximate location, and browser/device information without analytics cookies. We exclude private sharing, collaboration, account-confirmation, password-reset, and administration pages, and remove query parameters and fragments from measured page URLs. We do not send list contents, email addresses, or account identifiers to this analytics service. Native app usage is not measured by this website integration.

We do not use third-party advertising or cross-site behavioral-tracking SDKs.

BitList uses only the cookies and browser storage needed to run the service. We do not use advertising, analytics, or cross-site tracking cookies, so we do not show a cookie consent banner.

What is stored on your device:

• a cookie that remembers the language you chose;
• browser storage (localStorage) that holds your sign-in session, your guest lists, and interface preferences such as theme, sidebar state, and dismissed tips;
• a short-lived security cookie set by our bot-protection provider when the sign-in and sign-up forms run a bot check; and
• cookies set by our payment provider on its hosted checkout and billing pages, governed by that provider's own privacy policy.

You can clear these through your browser settings. Clearing storage signs you out and removes guest content.

We use information collected through BitList to:

• create and manage your account;
• store and sync your lists;
• provide sharing, collaboration, and Explore features;
• store and deliver files and images;
• manage subscriptions and plan limits;
• authenticate users and protect accounts;
• prevent fraud, abuse, spam, and security threats;
• investigate reports and enforce our Terms;
• provide customer support;
• maintain, troubleshoot, and improve the reliability of BitList; and
• comply with applicable legal obligations.

We do not sell your personal information. We do not use BitList to serve targeted advertising.

Files and images you upload while signed in are stored in cloud storage associated with your account. Plans may have different storage and per-file limits.

Files may be accessible through URLs generated by BitList. Anyone who obtains a working file URL may be able to access that file, so you should treat attachments included in shared or public lists as available to the people with whom that content is shared.

Do not upload sensitive information unless you're comfortable storing it in BitList and, where applicable, sharing it with other users.

When you create a share link, anyone with access to that link may be able to view the shared list until sharing is disabled.

BitList stores share-link credentials in a protected form, including hashed tokens where applicable.

People who receive a share link may forward it to others.

If you invite someone to collaborate, information necessary to manage access and collaboration is stored with the list. Other authorized collaborators may be able to view, add, edit, or remove shared content according to their permissions.

If you publish a list to Explore, that list becomes public.

The public information may include:

• the published list and its contents;
• the list title, description, and icon;
• your preferred profile name; and
• your profile photo, if set.

Your account email address is not used as Explore attribution unless you choose to make it public yourself.

Public content may be viewed, copied, shared, indexed, or cached by other people, search engines, or other third parties.

Removing a list from Explore ends its public listing on BitList, but we cannot remove copies that others have independently saved or cached outside our control.

Users may report public lists for reasons such as illegal content, harassment, spam, or copyright concerns.

When you submit a report, we may process:

• your account information;
• the list being reported;
• the reason you selected;
• details you provide with the report; and
• information needed to investigate and resolve it.

We use this information to review reports, enforce our Terms, protect users, and comply with law.

We also use automated tools to help detect content that violates our Terms. Uploaded images and the text of lists you publish to Explore go through an automated moderation check run by a service provider. The content is used only for that check and is not kept by the provider afterwards.

We generally do not disclose the identity of the person who submitted a report to the reported user, except where disclosure is required by law or reasonably necessary for safety, fraud prevention, or legal process.

We do not sell personal information.

We may share information only when reasonably necessary with:

Service providers

Companies that help us operate BitList, such as providers of:

• cloud hosting and database services;
• authentication;
• file storage;
• payment processing;
• content moderation and safety;
• app distribution; and
• infrastructure and security.

We work with a small number of service providers for these functions. Each provider receives only the information its function needs and may not use it for its own purposes.

We require service providers that process personal information for BitList to provide protections consistent with this policy and applicable law.

Other users

Information is shared with other users when you choose to use features such as share links, collaboration, or Explore.

Legal and safety reasons

We may disclose information when reasonably necessary to:

• comply with applicable law, court orders, or valid legal requests;
• protect the rights, safety, or security of BitList, our users, or others;
• investigate fraud, abuse, or security incidents; or
• establish, exercise, or defend legal claims.

Business transfers

If Brocan LLC is involved in a merger, acquisition, financing, reorganization, or sale of all or part of the BitList business, information may be transferred as part of that transaction, subject to applicable law.

We keep personal information only for as long as reasonably necessary to provide BitList, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.

Typical retention periods: account data and content, until you delete your account; request and error logs, up to 30 days; sign-in protection records, 7 days; reports and account access audit records, one year; billing records, as long as tax and accounting law requires. Backups are rotated within 7 days.

You can delete your account from BitList account settings. Account deletion removes your account and associated synced content from active BitList systems, including your lists, uploaded files, and active share links, subject to technical processing time.

Limited information may remain temporarily in backups or be retained where reasonably necessary for security, fraud prevention, dispute resolution, financial recordkeeping, or legal obligations.

Information that other people independently copied or saved outside BitList cannot be deleted by us.

Guest content can be removed by clearing the relevant browser or app storage or deleting the app.

You can manage much of your information directly through BitList, including your profile, sharing settings, Explore publications, and account deletion.

Depending on where you live, privacy law may also give you rights to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion;
• obtain a copy of certain information;
• withdraw consent where processing is based on consent; or
• exercise other rights provided by applicable law.

To make a privacy request, contact hello@bitlist.app. We may need to verify your identity before completing a request.

We will not discriminate against you for exercising privacy rights provided by applicable law.

We use reasonable administrative, technical, and organizational safeguards designed to protect information handled by BitList.

However, no online service, transmission method, or storage system can be guaranteed to be completely secure.

You are responsible for keeping your account credentials secure and for using BitList on devices you trust.

BitList is not directed to children under 13. You must be at least 13 years old, or the minimum age required to consent to data processing in your country if that is higher, to create an account. We do not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13 without legally required authorization, we will take appropriate steps to delete it.

If you believe a child under 13 has provided personal information to BitList, contact us at hello@bitlist.app.

BitList and its service providers may process information in the United States and other countries where they operate.

If information is transferred across borders, we take measures required by applicable law for those transfers.

Your local privacy laws may provide additional rights that are not affected by this policy.

We may update this Privacy Policy as BitList evolves.

If we make material changes, we'll provide reasonable notice through BitList, by email, or through another appropriate method where required.

The date at the top of this page shows when the policy was last updated.