Privacy Policy
Last updated: July 17, 2026
Your privacy is important to us. This Privacy Policy explains how Alivelists ("we", "us", "our") collects, uses, discloses, and safeguards your information when you use our Service — the website, the browser extension, and the mobile app. Please read this policy carefully.
1. Information We Collect
1.1 Personal Information You Provide
When you register for an account or use our Service, we may collect:
- Account Information: Name, email address, password (stored only as a one-way bcrypt hash — we never store your actual password)
- Profile Information: Any additional information you choose to add to your profile
- User Content: Lists, items, notes, descriptions, sources, tags, AI-generation prompts, and other content you create
- Collaboration Invites: When you invite someone to collaborate on a list by email, we store that email address in order to deliver and manage the invitation. If you were invited, we hold your email for this purpose until the invitation is accepted, declined, or withdrawn
- Waitlist Signups: If you join a product waitlist (e.g. for our mobile app or Pro plan), we store the email address you provide, solely to notify you about that launch
- Communications: Information you provide when contacting us for support
1.2 Information Collected Automatically
When you access our Service, we automatically collect:
- Log Data: IP address, browser type, pages visited, time spent, referring URL
- Device Information: Device type, operating system, unique device identifiers
- Push Notification Tokens: If you enable push notifications in our mobile app, we store a device token issued by Google Firebase Cloud Messaging so we can deliver notifications to your device. Tokens are deleted from our servers when you log out of the app
- Crash & Diagnostics Data (mobile app): If the mobile app crashes, technical details about the failure (device model, operating system version, app version, and a technical stack trace) are sent to Google Firebase Crashlytics so we can find and fix stability problems. Crash reports do not include your lists, prompts, or account credentials
- Usage Analytics: When lists are viewed or shared we record aggregate, privacy-minimised statistics. IP addresses used for view counting are one-way hashed with a secret key and cannot be reversed to identify you; our analytics reporting uses anonymised or pseudonymised aggregates, never your name or email
- Cookies: See our Cookie Policy section below
1.3 Information We Do NOT Collect
We do NOT collect: payment/financial information, Social Security numbers, government-issued IDs, biometric data, health information, or precise geolocation data.
2. How We Use Your Information
We use your information only for the following purposes:
- Provide the Service: Create and manage your account, enable features, display your content
- Improve the Service: Analyze usage patterns, fix bugs, develop new features
- Communicate: Send service-related notifications, respond to inquiries, provide support
- Security: Detect and prevent fraud, abuse, and unauthorized access
- Legal Compliance: Comply with applicable laws and regulations
We do NOT sell, rent, or trade your personal information to third parties for marketing purposes. We never have and never will.
3. Data Sharing and Disclosure
We may share your information only in the following limited circumstances:
With Your Consent
When you explicitly authorize us to share your information.
Public Content
Lists you mark as "Public" are visible to other users and may be indexed by search engines. You control this visibility.
Service Providers (Sub-processors)
We share limited data with trusted third parties who process it on our behalf under confidentiality and data-processing agreements:
- Google — sign-in (OAuth), link-safety checks (URLs you save may be sent to the Google Safe Browsing API), push notification delivery (Firebase Cloud Messaging device tokens), crash reporting for the mobile app (Firebase Crashlytics), and YouTube playlist import. The playlist import feature uses YouTube API Services; by using it you also agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.
- Perplexity AI — when you use AI list generation, the prompt text you enter is sent to Perplexity to produce suggestions. Do not include sensitive personal information in prompts. AI-generated content is machine-produced and may be inaccurate — see the AI-Generated Content section of our Terms of Service.
- Link preview / price providers — when enabled, URLs you save may be sent to third-party fetching services to retrieve titles, thumbnails, and prices.
- Hosting & email — infrastructure and transactional email delivery.
Some of these providers operate outside your country; see "International Data Transfers" below.
Legal Requirements
We may disclose information if required by law, court order, or government request, or to protect our rights, safety, or property.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. You will be notified of any such change.
4. Data Security
We implement industry-standard security measures to protect your information:
- Encryption: Data transmitted via HTTPS/TLS encryption; passwords are hashed using bcrypt
- Access Controls: Strict access controls limit who can access user data
- Regular Audits: We regularly review our security practices
- Secure Infrastructure: Our servers are hosted on secure, reputable platforms
Important: While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
5. Data Retention
We retain your information for as long as:
- Your account remains active
- Needed to provide you with the Service
- Required by law (e.g., for tax, legal, or audit purposes)
When you delete your account:
- Your personal data will be deleted or anonymized within 30 days
- Backup copies may persist for up to 90 days before being purged
- Some information may be retained as required by law
6. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Right to Access
Request a copy of your personal data we hold.
Right to Rectification
Request correction of inaccurate data.
Right to Erasure
Request deletion of your personal data ("Right to be Forgotten").
Right to Portability
Request your data in a portable format.
Right to Restrict Processing
Request limitation of how we use your data.
Right to Withdraw Consent
Withdraw consent at any time where applicable.
To exercise any of these rights, please contact us at privacy@alivelists.com or use the data management tools in your account settings.
GDPR Users (EEA): You have additional rights under GDPR. We will respond to requests within 30 days.
CCPA Users (California): You have the right to know what data we collect, request deletion, and opt-out of data sales (we do not sell data).
6A. Users in India — Digital Personal Data Protection Act, 2023
Alivelists is operated from India. If you are in India, we process your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). As a Data Principal you have the right to:
- Access a summary of the personal data we process about you and the processing activities undertaken
- Correction and erasure of your personal data (use the tools in Profile → Privacy, or contact us)
- Grievance redressal through the readily available means described below
- Nominate another individual to exercise your rights in the event of death or incapacity
We process your personal data on the basis of your consent, given when you create an account and accept this policy, and for the legitimate uses permitted by the DPDP Act (such as voluntary provision of data for a specified purpose). You may withdraw consent at any time by deleting your account; withdrawal does not affect the lawfulness of processing already carried out.
Grievance Redressal
If you have a grievance about how your data has been handled, or about content on the Service, contact our Grievance Officer at legal@alivelists.com with the subject line "Grievance". We will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt, in line with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. If you remain unsatisfied, you may approach the Data Protection Board of India.
8. Children's Privacy
Our Service is not intended for children under 13 years of age.
We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information.
Users in India: under the DPDP Act, 2023 a "child" is anyone under 18. If you are under 18 and in India, you may only use the Service with the verifiable consent of a parent or lawful guardian. We do not carry out behavioural tracking of, or serve targeted advertising to, any user — including children.
9. International Data Transfers
Your information may be transferred to and maintained on servers located outside of your country, where data protection laws may differ.
By using the Service, you consent to the transfer of your information to India and other countries where we operate. We take appropriate safeguards to ensure your data remains protected.
10. Data Breach Notification
In the event of a data breach that compromises your personal information, we will:
- Notify affected users within 72 hours of becoming aware of the breach
- Provide details about what data was affected
- Describe steps we are taking to address the breach
- Offer guidance on steps you can take to protect yourself
- Report to relevant authorities as required by law
11. Third-Party Links
Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the new Privacy Policy on this page
- Updating the "Last updated" date
- Sending you an email notification (for material changes)
We encourage you to review this Privacy Policy periodically for any changes.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
- By email: privacy@alivelists.com
- For legal inquiries: legal@alivelists.com