Privacy Policy

_Last updated: 13 July 2026_

MightyList ("we", "us") builds a personal productivity app for the web, iOS, and

Android. This policy explains what we collect, why, and your choices. We do not

sell your data and we do not use it for advertising or cross-app tracking.

Information we collect

Account: your email address and a securely hashed password (argon2id — we

never store your password in plain text).

Your content: everything you create in the app — tasks, lists, notes,

bookmarks, habits, budgets, recipes, trips, contacts, photos, and file

attachments. This is stored so we can sync it across your devices.

Device tokens: if you enable notifications, a push token for your device.

Diagnostics (optional): if crash reporting is enabled, anonymized crash and

performance data to help us fix bugs. This is not linked to advertising and is

not used to track you.

We do not collect your location, contacts from your address book, or

advertising identifiers.

How we use it

To provide the app: authenticate you, store and sync your content, send the

notifications you ask for.

To keep the service secure: rate limiting and abuse prevention.

To improve reliability: diagnose crashes and errors (if diagnostics are on).

Subprocessors

We share data only with service providers that help us run MightyList, under

contract, for these purposes only:

Hosting & database: our servers and Postgres database store your account

and content.

Object storage: photos and file attachments (an S3-compatible provider).

Anthropic: when you use "Magic Capture", the text you enter is sent to

Anthropic's API to propose items. It is not used to train models.

Stripe: if you buy a marketplace template pack, payment is processed by

Stripe. Your card details go directly to Stripe and never touch our servers.

Resend: sends transactional emails (verification, password reset).

Crash reporting (optional): an error-monitoring provider, if enabled.

Data retention & your rights

Your content is kept until you delete it or delete your account.

Export: you can download all your data at any time (Settings → Export my

data, or `GET /auth/export`).

Deletion: you can permanently delete your account and all associated data

from within the app (Settings → Delete account). This is immediate and

irreversible.

Depending on where you live, you may have rights under the GDPR or CCPA to

access, correct, export, or delete your data — the export and deletion features

above satisfy these directly.

Security

Passwords are hashed with argon2id; sessions use short-lived access tokens with

rotating, reuse-detected refresh tokens; all traffic is encrypted in transit

(HTTPS). No system is perfectly secure, but we follow current best practices.

Children

MightyList is not directed to children under 13, and we do not knowingly collect

their data.

Changes

We'll update this page and the "last updated" date when this policy changes.

Contact

Questions or requests: privacy@example.com.