anonylist

Privacy

Plain language, no lawyering. Last updated 26 August 2026.

An ordinary anonylist list needs no account and asks nothing about you — no name, no email, no sign-up. That is still the whole product for most people, and it isn't going to change.

There is one exception, and it's opt-in: anonylist pro has accounts, because owning a list means something has to know it's yours. If you never sign in, nothing below about accounts applies to you. This page explains what happens to the things you type either way.

What's stored

  • Your lists — titles, items, and sections — are stored on our server in plaintext so they can sync between everyone who has the link. This is not end-to-end encrypted: the server can read list contents.
  • A list password, if you set one, is stored hashed and acts as a gate for new visitors. It is a speed bump, not privacy — don't put secrets in a list.
  • Which lists you've opened is remembered in your own browser (local storage), so your list drawer works. If you have an account, it can also follow you between devices: we store the ADDRESSES of the lists in your drawer against your account, so signing in on a new phone brings them with you. That is on by default for accounts made from 29 August 2026, off for accounts that already existed, and you can switch it either way under Your drawer on other devices on your account page. A list's address is the only key it has, so switching it off deletes our copy. The password for a locked list is never included — a synced list asks for its password once on each new device. Without an account, or with this off, the drawer never leaves your device unless you export it.
  • Your account, if you make one. Signing in with Google tells us your email address and Google's own id for you, and nothing else — no contacts, no profile, no access to anything in your Google account. We store that email, which lists you own, and who you've added as an admin. Sign-in sessions are stored as a one-way hash, so a stolen backup contains no usable cookie. If we've issued you a password instead of Google sign-in, it is stored hashed and we cannot read it.
  • Payment details never reach us. Card numbers go to Stripe, who process the payment. We keep only their customer reference, which plan you're on, and when the period ends — enough to know whether your lists are paid for.

What's collected

  • IP addresses of visits to a list are logged, to protect against abuse of anonymous storage. A count of visits — never an address, and never who — is shown at the bottom of the list to everyone who has its link. One person opening a list repeatedly counts once an hour.
  • Google Analytics measures aggregate traffic. List links are redacted before they reach Analytics — your unguessable list URLs are never sent to Google.
  • Crash reports. When something goes wrong — in the app on your screen or on our server — the error is sent to Sentry, who store it so we can find and fix it. A list's address is stripped out and replaced with a placeholder before it is sent, the same way it is for Analytics, and a report that still looks like it carries one is thrown away rather than sent. List contents, cookies and sign-in sessions are never attached, and nothing records what is on your screen.
  • The AI assistant, photo import, and background generator, when you use them, send your command, photo, or list contents to Anthropic to produce a result. Imported photos are kept on our server for a while to review misreads and abuse. Don't use these on anything sensitive.
  • Apps you connect, such as ChatGPT or Claude. Connecting one lets it read and change the lists you point it at, so the contents of those lists go to whoever runs that app, under their privacy policy rather than ours — we can't see what they keep or for how long. On our side we record which app connected, what it was allowed to do, which tools it used and on which list, and a short summary of each result, which can include list contents. That log is how a change made by an app can be explained afterwards. You can see every connected app on your account page and disconnect it there; disconnecting stops it immediately, everywhere.
  • Debug info, only if you tick the box on the support form. It sends what your browser has stored for anonylist — including the links to your lists, which can be used to open and edit them. It's off unless you turn it on, it's only sent with that one message, and it's only read by us while we look into what you reported.

When we look at a list

We don't read lists routinely, and nothing scans them automatically. We open a list when someone reports it, when we're looking into a problem you've told us about, or when we're investigating abuse of the service. If we find something illegal we keep a copy and pass it to the authorities where the law requires it. A list removed for breaking the terms of use may be kept for a while afterwards rather than deleted straight away.

Keeping and removing

Lists may be removed after long inactivity. A list without an account exists only at its link — there's nothing to delete but the list itself. To remove its contents, empty it. To forget a list on your device, use “Forget this list” in the drawer.

With an account: disconnect any app from your account page, and email us to close the account itself. Releasing a list turns it back into an ordinary link-only list rather than deleting it, so the people using it keep it.

Don't store sensitive information

Because storage is plaintext, the server can read lists, links can be shared, and a connected app sends list contents to whoever runs it, anonylist is not the place for passwords, financial details, medical information, or anything you'd be harmed by others seeing.

Questions, or to report a list: use the support form.