Privacy policy

Version 1.0 · Last updated 27 July 2026

PreciousList keeps the data it needs to run a notebook. Nothing is sold, nothing goes to advertisers, and your notes are not used to train AI models.

1. Who runs this

PreciousList is run by one person, who is the data controller. There is no support inbox. Every request reaches that person through the contact form, and is answered by that person.

2. Age

PreciousList is for people aged 18 and over. Accounts are not opened below that age. If an account is found to belong to a person under 18, it is closed and the data is deleted within 30 days. Use the contact form to report one.

3. What is collected

• Account. The account identifier returned by Google or Apple when you sign in, your email address, and the username you choose once.
• Notes. The text you type, the time it was written, and whether it is private or public.
• Receipt. Total typing time, number of keystrokes, number of corrections, and the record that nothing was pasted. These are totals. The timing of individual keys is not stored, and typing rhythm is not used to identify anyone.
• Following. The accounts you follow and the accounts that follow you.
• Reports. Reports you send, reports about your notes, and the reason given.
• Technical logs. IP address, browser type, and request records, kept for 30 days for security.

There are no payments yet. When ads and contributions open, a payment provider will handle the card details, they will not reach PreciousList, and this policy will be updated before that starts.

4. What is not collected

No analytics. No advertising trackers or pixels. No device fingerprinting. No location. No contacts. No profile of you. Personal data is not sold and is not shared for cross context behavioural advertising, under the California Consumer Privacy Act or any other law. Notes are not used to train AI models.

5. Why it is processed

• To run your account and publish your notes. Basis: the contract between you and PreciousList.
• To keep the service secure and act on reports. Basis: legitimate interests.
• To keep a username from being issued twice. Basis: legitimate interests. After deletion a one way hash of the username is kept. It cannot be read back as text, and it stops the name going to another person.

Marketing email is not sent. Nothing here makes an automated decision about you.

6. Public notes

A private note is read by you alone. A public note is visible to any member through Search and through the feed of the people who follow you. Returning a note to private removes it from those surfaces at once. It does not recall copies other people made while it was public.

Do not put another person's private information in a public note. If a note contains your personal data, use the contact form.

7. Who else sees the data

Google and Apple, for sign in. Lovable, which builds and hosts the app and stores the data on instruction under written terms. Authorities, where the law requires it. There are no advertisers and no data brokers.

Where personal data moves between countries, the transfer relies on the Standard Contractual Clauses.

8. How long it is kept

• Notes. Until you delete them or delete your account.
• Account data. Until you delete the account, then removed from live systems within 30 days and from backups within 90 days.
• Username hash. Kept after deletion, so the name is not reissued.
• Technical logs. 30 days.
• Reports and enforcement records. 12 months.

9. Your rights

Wherever you live, you can ask for a copy of your data, a correction, a portable export, deletion, a limit on how the data is used, or an end to processing based on legitimate interests. Export and Delete are in your account settings. For anything else, use the contact form. Answers come within 30 days, or 45 days for requests under United States state law.

Exercising a right costs nothing and changes nothing about your account. If you are in the European Union, the United Kingdom, or Switzerland, you can also complain to your national data protection authority.

10. Security

Traffic is encrypted in transit and data is encrypted at rest. Access to live data is limited to the person who runs PreciousList. If a breach puts your data at risk, the relevant authority is told within 72 hours where the law requires it, and you are told when the risk to you is high.

11. Changes

New versions are posted here with a date. If a change reduces your rights, a notice appears in the app at least 15 days before it takes effect.