Privacy

Microlist stores a to-do list and the names people type so the other people on that list can see who added, edited, or checked an item. There is no account, no email address, and no ad or analytics tracker.

When someone creates a link, the list is saved with:

• the items, including whether each one is done
• the name attached to each add, edit, and check, plus the time
• the name of the person who created the link
• an unguessable token that is the list’s address

Anyone with the link can open that list. The database is hosted by Supabase. Writes go through this app. The list is shared-link data, not a private vault.

Before you share, the draft list and your name stay in this browser’s local storage. After you share, this browser may also keep a copy of the list so edits can retry if the connection drops.

This site sets four kinds of cookies. They are not used for advertising.

Your name, so you don’t have to type it again. A cookie that remembers the last list this browser opened. A cookie that remembers you created a particular list. A random id used only to slow down abuse. They stay on this site, can’t be read by page scripts, and last about 400 days.

A shared list is deleted automatically 30 days after the link is created. The names on it go with the list. Clearing this browser removes the local draft, the saved name, and the cookies on this phone. It does not delete a shared list for everyone else who still has the link.

You can connect an assistant at the Microlist connection address. That step asks for an email, then sends a code and a link. We store that email address, a hash of the connection, and when the connection expires. The email is not written on the list. The connection can create public lists and change items on lists it can open. It lasts about 30 days, and then we delete it.

Creating lists and changing items is rate limited. We keep a short-lived counter for that random id and a hash of the network address, then delete the counter after a few days. An assistant connection is limited the same way, using a hash of the email instead of a browser id. It is not used to build a profile or to recognize you later.

We don’t sell the list. The to-do list doesn’t ask for a contact address. Connecting an assistant does, and that email stays with the connection, not on the list. We don’t use the list to build an ad profile. We don’t knowingly run Microlist as a service for children, so don’t put a child’s full name or other personal details on a list.

You choose the name and the items. You choose who receives the link. You can clear this site’s cookies and local storage in the browser. The terms say what the list is for, and what to leave off it.