Logo

Legal

Privacy Policy

Last updated: July 2026

1. Introduction

Ankorlist ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App"). By using Ankorlist, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account Information: If you sign up, we collect your email address (via Google, Apple, or magic link sign-in) to create and authenticate your account. You may also use the App as a Guest via anonymous sign-in, in which case no personal information is collected beyond a session identifier used to support your local/synced data.

Payment Information: Processed securely via RevenueCat for subscription management.

Usage Data: Analytics and usage statistics collected via Google Analytics, used solely to understand app usage and improve our services. We do not use this data for advertising or cross-app tracking.

Diagnostic and Crash Data: We use Firebase Crashlytics to collect crash logs, device model, operating system version, app version, and device identifiers when the App crashes or encounters errors, so we can diagnose and fix issues. This data is used solely for stability and debugging purposes, not advertising.

App Content (Tasks and Notes):

  • If you create a local task, its content — including any location stamp — is stored only on your device using local on-device storage and is never transmitted to our servers.
  • If you create a synced or collaborative task, its content — including any location stamp — is stored on our backend infrastructure (Firebase Firestore) so it can sync across your devices and be shared with collaborators you invite.

Location Data: With your permission, we collect your device's precise location (while the App is in use) to let you attach a location stamp to a task and to search for places using Google Places API and Google Maps SDK. Whether this location data is stored only on your device or synced to our servers depends on whether the associated task is local or synced, as described above.

Calendar Data: With your permission, we read your device calendar events so we can display them alongside your tasks in the "Upcoming" 2-week view. This is a read-only, one-way fetch: we do not write to, modify, or delete anything in your native calendar, and we do not save, store, or cache your calendar event data anywhere — not on your device (including local storage) and not on our servers. Calendar data is fetched fresh from your device each time you open the "Upcoming" feature and is not retained afterward.

Photos: With your permission, we access your device's photo library to let you:

  1. Set your account profile photo;
  2. Set a thumbnail photo for a list;
  3. Attach up to 3 screenshots to optional feedback you send us;
  4. Select background images for a local focus-mode slideshow feature.

Profile photos, list thumbnails, and feedback screenshots are uploaded to our secure cloud storage (Firebase Storage). Profile photos and list thumbnails are also made viewable to collaborators you share a list with. Focus-mode background images are used entirely on your device and are never uploaded to our servers.

Cloudflare Workers: We use Cloudflare Workers as backend infrastructure to support list sharing and invites, location search, link previews, and magic link sign-in.

Shared Content: If you share content (such as text, links, or images) into Ankorlist from another app via your device's native share function, we process that content to create a task from it.

Push Notification Data: If you use collaborative tasks, we register a device push token which our backend uses to notify you when a collaborator makes changes. Deadline reminder notifications are scheduled entirely on your device and do not involve sending any data to us.

3. How We Use Your Information

We use your information to:

  • Provide and maintain the core functionality of the App, including local and synced task management;
  • Manage your account and authenticate your identity;
  • Process payments and manage subscriptions;
  • Enable location-stamping and place search for tasks;
  • Display your device calendar events alongside your tasks in the "Upcoming" feature;
  • Notify you of changes to collaborative tasks;
  • Diagnose crashes and improve app stability;
  • Personalize your experience;
  • Analyze usage to improve our services.

During account creation, you provide explicit consent to our data processing by continuing with sign-up ("By continuing, you agree..."). You may withdraw your consent at any time by deleting your account (contact us at: [email protected]).

Location and calendar permissions are requested separately and are optional — you can decline or revoke them at any time via your device settings, though features that depend on them (location stamping, place search, viewing calendar events in "Upcoming") will not function without the relevant permission.

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

  • Your consent;
  • The necessity to perform a contract with you (e.g., subscription services, task syncing you request);
  • Compliance with legal obligations;
  • Our legitimate interests, such as improving the App, diagnosing crashes, and preventing fraud.

5. App Permissions

Our App may request the following device permissions:

  • Notifications - to send deadline reminders (scheduled locally on your device) and updates about collaborative task changes.
  • Location (When In Use) - to attach a location stamp to a task and to search for places. Only requested when you use a location-related feature.
  • Calendar - to display your device calendar events alongside your tasks in the "Upcoming" feature. This is read-only: we do not modify your calendar or store your calendar data. Only requested when you navigate to the "Upcoming" screen.
  • Photo Library - to set a profile photo, set a list thumbnail, attach screenshots to feedback, or choose focus-mode background images. Only requested when you use one of these features.

All permissions are optional and can be managed or revoked at any time via your device settings. Declining a permission will limit the corresponding feature but will not prevent use of the rest of the App.

6. Your Rights (GDPR and Other Laws)

Depending on your location, you may have the following rights regarding your personal data:

  • The right to access the data we hold about you;
  • The right to correct or update your data;
  • The right to request deletion of your data;
  • The right to restrict or object to certain processing activities;
  • The right to data portability;
  • The right to withdraw consent where applicable;
  • The right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work, or the place of the alleged infringement, if you believe our processing of your personal data violates applicable law.

To exercise these rights, please contact us at [email protected]. We will respond within the timeframe required by applicable law (generally within 30 days, which may be extended where permitted).

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended:

  • The categories of personal information we collect include identifiers (e.g., email), commercial information (subscription/payment status), internet/network activity (usage analytics), precise geolocation (treated as sensitive personal information), and content you provide (tasks, photos). We also briefly access, but do not store, your device calendar events to display them in the App.
  • We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
  • You have the right to know what personal information we collect, to request deletion or correction, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights.
  • We only collect and use precise geolocation (a category of sensitive personal information) to provide the location-stamping and place search features you actively choose to use, and not for any other purpose such as profiling or advertising. Because this use falls within the purposes permitted under the CCPA/CPRA without requiring an opt-out, we do not provide a separate "Limit the Use of My Sensitive Personal Information" link; however, you may still contact us at any time to object to or limit this use.
  • To exercise these rights, contact us at [email protected].

8. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

Service providers who assist us in operating the App, including:

Legal authorities if required by law or to protect our rights.

All third-party service providers are obligated to protect your data and use it only for the purposes we specify.

9. Data Security

Local task data is stored on your device. Synced and collaborative task data, along with account and diagnostic data, is stored on Firebase infrastructure. Data transmitted between the App and our backend is encrypted in transit (TLS), and data at rest is encrypted by our infrastructure provider (Google Cloud / Firebase). We rely on Firebase's security practices and infrastructure-level safeguards to protect your information.

10. Data Retention

We retain your personal data as long as necessary to provide the services and for legal, regulatory, tax, or accounting purposes:

  • Local task data is retained on your device until you delete it or uninstall the App.
  • Synced/collaborative task data is retained until you delete the task or your account.
  • Crash and diagnostic data is retained for 90 days.
  • Account information (including authentication data and synced content stored in Firebase Authentication and Firestore) is permanently and immediately deleted when you delete your account.
  • Subscription and payment records may continue to be retained by RevenueCat and/or the App Store/Google Play, independent of your account deletion, as required for their own accounting, tax, and legal compliance purposes.

If you wish to delete your data, please contact us at [email protected], or delete your account directly within the App, via Settings > Account > Delete Account.

11. International Data Transfers

Your data may be transferred to and maintained on servers located outside your country, including Hong Kong and the United States. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses provided by our service providers.

12. Children's Privacy

Our App is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be posted at ankorlist.com/privacy-policy, accessible via a link in the App's Settings page, which opens in your device's default browser. We do not send in-app pop-up notifications of changes, so we encourage you to review this page periodically. Your continued use of the App after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or your data, please contact us at: [email protected].

By using Ankorlist, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.