Privacy Policy

The data controller responsible for your personal data is 201 Studio Ltd, a company registered in the United Kingdom. Our contact details are in the Contact us section below.

We collect the following, and only the following:

• Account identity. When you sign in with Google, we receive basic profile information from Google — typically your name, email address, and a unique account identifier — which we use to create and identify your account.
• Your saved lists. The curated lists you choose to save and pursue within the App.
• Your completions. The experiences you mark as done, which we use to show your progress and award medals.

To be clear about what Lifelist does not do:

• We do not use analytics or usage-tracking tools.
• We do not use advertising networks or share data with advertisers.
• We do not use cookies or similar tracking technologies for advertising.
• We do not collect your location, contacts, photos, or any data beyond what is listed in section 2.
• We do not sell or rent your personal data to anyone.

We use your information solely to provide and operate the App: to authenticate you, to save the lists you choose, to record the experiences you complete, and to show your progress and medals. We do not use your data for profiling, advertising, or any purpose unrelated to the features you use.

For users in the United Kingdom and the European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Performance of a contract — processing your account identity, saved lists, and completions is necessary to provide the App's functionality to you.
• Consent — you provide consent when you choose to sign in and use the App, and you may withdraw it at any time by deleting your account.

Your account and activity are stored in our backend, which is hosted by Supabase, a third-party cloud platform that provides our database and authentication. Our Supabase infrastructure is located in the European Union (Ireland). Data is transmitted over encrypted (HTTPS/TLS) connections, and access to your records is restricted so that only your authenticated account can read or change them.

While no method of electronic storage is completely secure, we take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse.

We keep your personal data for as long as your account remains active. If you delete your account, we delete your identity and all associated saved lists and completions. We may retain limited records where required to comply with legal obligations, after which they are securely deleted.

Lifelist relies on the following third-party services:

• Google Sign-In — used to authenticate you. Your use of Google Sign-In is also subject to Google's own privacy policy.
• Supabase — hosts our database and authentication infrastructure.

These providers process data on our behalf to deliver the App. We do not sell your personal data to them or anyone else.

Your personal data is hosted within the European Economic Area (in Ireland). For users in the United Kingdom, the EEA is covered by UK "adequacy" regulations, meaning it provides an equivalent level of data protection, so no additional transfer safeguards are required. Should we ever move data outside the United Kingdom or EEA, we would rely on appropriate safeguards — such as standard contractual clauses or an adequacy decision — to ensure your data continues to receive an equivalent level of protection.

Depending on your location, you have rights over your personal data, including the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data ("the right to erasure");
• restrict or object to how we process your data;
• request a copy of your data in a portable format.

To exercise any of these rights, contact us using the details below. UK and EEA users also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk.

You can delete your account and all associated data at any time directly in the App, from the Settings screen. Deleting your account immediately and permanently removes your identity and all of your saved lists and completions from our systems, and cannot be undone. If you would prefer, you can instead request deletion by emailing us at [email protected], and we will action your request within 30 days.

Lifelist is not directed at children under the age of 13 (or the minimum age required in your country), and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. Any changes will be reflected by the "Last updated" date at the top of this page, and material changes may be communicated through the App. Your continued use of the App after changes take effect indicates your acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your data, please contact us: