Privacy Policy

Account: your email address, an encrypted form of your password (we cannot read it), and anything you add to your profile, such as a name and profile picture. We also keep your timezone so reminder emails arrive in the morning.

Your content: the boards, lists, cards, comments, labels, checklists and files you create or upload.

Email to board: if you turn on a board's email address, mail sent to it is received by Cloudflare Email Routing and passed to us. From mail sent from your account address we store the subject, text and attachments as a card; other mail is refused and not stored.

Technical data: when you use the service, our providers handle your IP address and browser details to deliver pages, keep the service secure and stop abuse.

Messages: when you use the contact form, your name, email address, message and IP address (the address is used to limit spam).

Shared boards: when someone enters a wrong password on a shared board link, we store a scrambled (hashed) form of their IP address for one day to stop password guessing.

We use your data only to:

• Run the service you signed up for: store and show your boards, sign you in, and send account emails (confirmations, password resets) and, if you keep them on, daily due-date summaries. This is needed to provide the service to you.
• Keep the service secure and stop abuse, such as automated sign-ups and password guessing. This is our legitimate interest in a safe service.
• Answer your messages.
• Count visits without identifying anyone (see section 6), to see which pages are used.
• Meet legal obligations.

We do not sell your data, use it for advertising, or train AI models on it.

Your account and boards are stored in a Supabase database in the United States (Ohio). Your files are stored in Cloudflare R2 in the European Union. The website runs on our own server in Germany, and emails are sent through our mail provider, MXroute. If you are in the European Union, this means your data is also processed outside the EU; our providers offer standard contractual clauses for such transfers.

All connections are encrypted (HTTPS), database rules make sure each account can only reach its own boards, passwords and share-link passwords are stored only in encrypted form, and attachments can only be opened through short-lived private links. No system is completely secure, but we will tell you without undue delay if a breach affects your data.

Your boards are private. Others only see a board when you turn on its share link, and then only the board, without your name and without attachments. If you also turn on "Show images inside cards", public copies of the images inside your cards are made so visitors can see them; these copies are deleted when you turn the option or the link off. Besides that, we share data only:

• With the providers that run the service for us: Supabase (database and sign-in), Cloudflare (file storage, receiving mail sent to board email addresses, the Turnstile check that keeps bots out, and the automatic check of publicly visible images against known child sexual abuse material), MXroute (email) and our server host in Germany. They may only use the data to provide their service to us.
• With apps and AI assistants you connect yourself with an API token. They can read, and if you allowed it change, your boards as you, under their own terms. Revoking the token in Settings stops this.
• When the law requires it, or to protect people or the service from harm.
• With your consent.

We keep your account and content until you delete them or your account. When you delete your account, we delete your profile, boards, lists, cards and uploaded files; copies in backups disappear in the normal backup cycle. Contact messages are kept as long as needed to handle them, and hashed IP addresses from share-link password attempts for one day.

If we close the service, we delete the accounts and their data. If we introduce paid plans, payments will go through a payment provider and we will update this policy before collecting any payment details.

ListSpace uses no tracking or advertising cookies. To keep you signed in, your session is stored in your browser's local storage; clearing it signs you out.

We count visits with Umami, an open-source tool on our own server in Germany. Umami uses no cookies and stores nothing that identifies you: only which pages are viewed, the site you came from, and your approximate country, browser and device type.

The sign-in, sign-up and password-reset forms use Cloudflare Turnstile, which processes technical data such as your IP address and browser details to tell people from bots. Background photos you pick for a board are loaded from Pexels, which then sees your IP address. The tour video on our homepage only loads from YouTube (in its privacy-enhanced mode) when you press play.

Depending on where you live, you can ask us to:

• Give you a copy of your personal data
• Correct it
• Delete it (you can also delete your account yourself in your settings)
• Limit or stop certain uses of it
• Give it to you in a format you can take elsewhere

Write to hello@listspace.app; we answer within one month. You can also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens) or to the authority in the country where you live.

ListSpace is not meant for anyone under 16, unless the law of their country allows a lower age with the consent of a parent or guardian. We do not knowingly collect data from children; if you believe a child has given us personal data without the required consent, contact us and we will delete it.

We may update this policy. We will tell you about important changes by email or in the app, and the date at the top always shows the latest version.