Privacy

Clear terms for the actual product.

List now includes accounts, saved lists, public sharing, image uploads, and authenticated MCP access. This page explains what information we collect, how we use it, and what becomes visible when you choose to share something publicly.

Create accountRead terms

Last updated: March 29, 2026

Summary

  • List offers user accounts, authenticated API access, saved lists, public sharing, and optional image uploads.
  • We collect the information needed to run those features, secure the service, and troubleshoot problems.
  • Public lists and public image URLs can be accessed by anyone who has the link until you make them private or remove them.
  • We do not sell your content or use it to train machine learning models.

1. Scope

This Privacy Policy applies to List, including the website, account system, saved-list features, public list pages, image uploads, the MCP endpoint at /api/mcp, and the OAuth flows used to authorize compatible clients.

2. Information we collect

  • Account and profile information. If you create an account or sign in, we may receive identifiers such as your email address, user ID, display name, and profile image from our authentication provider or identity provider.
  • Content you create or upload. This includes list titles, descriptions, items, categories, timer metadata, change context you submit, public/private status, and any images you attach to list items.
  • Sharing data. If you mark a list public, the shared list page, its metadata, and any public image URLs attached to that list may be accessible to anyone with the link.
  • OAuth and API authorization data. When MCP clients connect, we process OAuth client registration details, authorization requests, scopes, refresh tokens, and access-token validation data needed to authenticate that client.
  • Technical and usage information. Like most online services, we and our providers may receive IP address, user agent, referrer, timestamps, request logs, error logs, and similar diagnostic metadata.
  • Session data and cookies. We use cookies and similar session mechanisms to keep you signed in, complete auth flows, and protect the service from misuse.

3. How we use information

  • To create and manage accounts and keep you signed in.
  • To store, sync, render, and update your saved lists across the app and MCP tools.
  • To publish lists you explicitly choose to make public.
  • To accept and serve uploaded images you attach to your lists.
  • To authorize MCP clients and issue or verify OAuth credentials and tokens.
  • To detect abuse, investigate incidents, debug issues, and improve reliability.
  • To respond to support or legal requests.

4. How we share information

  • Service providers. We may share information with vendors that provide authentication, hosting, database, logging, and file-storage services so the product can operate.
  • Public sharing chosen by you. If you set a list to public, that list can be viewed by anyone with the URL. If a list item references a public image URL, that asset may also be publicly accessible.
  • Legal or security reasons. We may disclose information if required by law or when reasonably necessary to protect users, the service, or our rights.
  • Business transfer. If the service is reorganized, sold, or transferred, user data may be part of that transaction subject to applicable law.

5. Storage and retention

We retain account and saved-list data for as long as needed to operate the service, comply with legal obligations, resolve disputes, and enforce our agreements. Public sharing remains active until you change the list back to private or delete it. Uploaded files and log data may persist for a period of time in backups, caches, or provider systems.

6. Your choices

  • You can sign out of your account at any time.
  • You can edit or delete saved lists from the app.
  • You can turn public sharing on or off for supported lists.
  • You can block cookies in your browser, but some account and authorization features may stop working.
  • If you want account or data deletion help beyond in-product controls, contact us using the email below.

7. Security

We use reasonable administrative, technical, and organizational measures intended to protect the service and your information. No system is perfectly secure, so we cannot guarantee absolute security.

8. What we do not do

  • We do not sell your personal information.
  • We do not use the content you submit to List to train machine learning models.

9. Children’s privacy

List is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and address it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we may update this page, revise the date above, or provide additional notice where appropriate.

11. Contact

If you have questions about this Privacy Policy or your data, contact Salim Batlouni at info@unlokd.com.