Listy — Privacy Policy

Last updated: 13 June 2026

Listy ("we", "us", the "App") is a personal task and weekly-planning app available at https://listy.day. This policy explains what data we access, why, how we store it, and the choices you have. We collect only what the App needs to function and we do not sell your data.

1. Information we collect

Google account profile. When you sign in with Google we receive your name, email address, profile picture, and your Google account identifier (the stable sub claim). We use these solely to authenticate you and to identify your data within the App.
Your Listy content. The tasks, lists, projects, contexts, schedules, and settings you create in the App.
Google Calendar data (only if you connect it). If you explicitly choose to connect Google Calendar, we request read-only access (the https://www.googleapis.com/auth/calendar.readonly scope) to read your calendar list and calendar events. This is used only to display your calendars and recurring events inside the App. We never create, edit, or delete anything in your Google Calendar.

2. How we use Google user data

Profile information is used to sign you in and label your account.
Calendar data is read on demand to render your calendars and recurring events within the App's interface. It is not used for advertising, not used to train any machine-learning or AI models, and not transferred to others except as required to provide the feature you requested.

3. Limited Use disclosure

Listy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it except to provide or improve the App's features, comply with applicable law, or as part of a merger or acquisition with appropriate safeguards.

4. How data is stored and secured

Your account data and Listy content are stored in Amazon DynamoDB on AWS infrastructure.
Connecting Google Calendar stores an OAuth access token and refresh token for your account so the connection can be maintained and refreshed. These tokens are stored server-side and are never written to application logs.
Access is protected by signed session tokens and transport is encrypted over HTTPS.

5. Sharing

We do not sell your personal data and do not share it with third parties for their own purposes. Data is processed by our infrastructure provider (Amazon Web Services) and by Google to provide sign-in and calendar features.

6. Your choices and controls

Disconnect Google Calendar at any time using the "Disconnect" control in the App. This revokes the App's access and deletes the stored calendar tokens.
You can also revoke Listy's access from your Google Account at myaccount.google.com/permissions.
To request deletion of your Listy account data, contact us at the address below.

7. Data retention

We retain your account data and Listy content for as long as your account is active. Calendar tokens are deleted when you disconnect Google Calendar or revoke access. Account-deletion requests are honored within a reasonable period.

8. Children

Listy is not directed to children under 13 and we do not knowingly collect their data.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions about this policy or your data? Email dewsbury@gmail.com.