Your plans are personal. We treat them that way.

Scope and who we are

Tula Labs LLC, doing business as Made by Tula, is responsible for Zen List and the Tula-operated cloud services covered by this policy. This policy applies to the Zen List iPhone and Apple Watch apps, their extensions, and related cloud features.

The Made by Tula company website is covered by a separate Website Privacy Policy.

Information kept on your devices and Apple services

Tasks, lists, and app content

Zen List stores tasks, lists, subtasks, notes, reminders, focus records, saved places, preferences, and related app content on your device. When iCloud synchronization is available, Apple CloudKit processes and stores supported app content for your iCloud account. Tula Labs does not operate CloudKit and does not routinely have access to your private iCloud database.

When you share a list, Apple CloudKit makes the shared content and collaboration activity available to the people you invite. Those participants can view and change shared content according to the permissions presented in the app.

Voice, scans, calendar, and location

Voice recordings are transcribed on your device and are not uploaded by Zen List. Scanned images are processed to extract text; the source image is not sent to Cloud AI. If you choose a Cloud AI feature after reviewing a transcript or scan, the resulting text you submit may be sent as described below.

Calendar access is optional. Zen List uses calendar information to show availability and help plan a day. Cloud AI day planning may receive occupied time ranges, but not calendar event names or event locations.

Location access is optional and supports saved places and arrival or departure reminders. Precise location, saved place names, addresses, and coordinates may be processed on your device and through Apple services needed for maps, iCloud synchronization, and location notifications. Zen List does not send your cached device location or saved place details to Cloud AI.

Optional Cloud AI

Cloud AI is off until you choose to enable it. You can continue to use Zen List without Cloud AI. Before the first request, the app explains what will be sent and asks for your permission.

Depending on the feature, a request may include task text you submit; reviewed voice transcripts or scanned text; task duration, priority, focus level, due status, work hours, and busy-time ranges; current date, time, timezone, and language; or weekly summary values such as completed-task count, focus hours, streak, and completion rate.

Requests pass through Tula-operated cloud systems to service providers that host, secure, route, and process Cloud AI requests. We review their terms, security, data use, and age or regional restrictions before public use. We may change providers while keeping the purposes and protections described in this policy.

Tula Labs does not use your task content to train a model it owns or sell it for advertising. We select service providers whose terms and safeguards protect app data consistently with this policy. They process content under the commercial service terms applicable to our account and may retain limited information for security, abuse prevention, legal obligations, or service operation.

AI output can be incomplete or wrong. Review suggestions before relying on them. Do not submit highly sensitive information such as government identifiers, financial account credentials, medical records, or information you are not authorized to share.

Authentication, security, and subscriptions

Third-party authentication and app-integrity services help confirm that requests come from a genuine Zen List installation. These services and our cloud systems may process an anonymous installation identifier, IP address, app and device information, integrity signals, request status, and other security data. We use one-way pseudonymous identifiers in our operational systems rather than storing the service's installation identifier in ordinary logs.

Apple processes purchases and subscriptions. To verify Pro access, Zen List sends signed Apple transaction proofs to our Worker. We process product, purchase, expiration, revocation, environment, and entitlement information needed to validate access, prevent fraud, restore purchases, and respond to subscription changes. We do not receive your full payment-card information.

Information Tula Labs retains

Our application databases do not store Cloud AI prompt or response bodies after returning the result. Generated output, such as a weekly insight, may be cached on your device.

We retain limited pseudonymous operational metadata for security, reliability, abuse prevention, and usage limits. This can include the operation and model used, status, timing, and numeric token or quota counts. Production operational records are generally kept for no more than 30 days. Short-lived security and idempotency records normally expire sooner, while aggregate quota counters may remain through the relevant quota period.

When Cloud AI is used, we also create identity-free service metrics to measure reliability, speed, errors, resource use, caching, and quota health. These metrics do not contain prompt or response text, task or calendar content, dates, locations, IP addresses, or user, account, subscription, device, or installation identifiers. They contain no persistent key that lets us retrieve or delete metrics for one person and are retained for up to three months. We restrict access and do not use these metrics for advertising, tracking, or profiling.

Subscription entitlement and pseudonymous account-binding records are kept while needed to verify access, prevent misuse, meet legal obligations, or until the applicable deletion and lifecycle rules remove them. A minimal one-way deletion marker may remain to stop stale credentials from recreating deleted cloud records.

How we use information

We use information to provide features you request, synchronize and share content through Apple services, verify subscriptions, secure the service, enforce limits, prevent fraud and abuse, diagnose failures, respond to support, and comply with law. We do not sell personal information, show behavioral advertising, or track you across other companies' apps or websites.

Cloud AI suggestions assist with organizing and planning. They do not make decisions that determine employment, credit, healthcare, education admission, legal rights, or similarly significant interests.

Service providers and international processing

We use service providers for Apple platform services such as iCloud and the App Store; cloud hosting, security, and storage; anonymous authentication and app integrity; and AI processing. Tula Labs is based in the United States. Information may be processed in the United States and in other countries where these providers operate, including locations selected dynamically to deliver and protect their services. We use contractual, technical, and organizational safeguards appropriate to each service.

Your controls and requests

You control iOS permissions for calendar, camera, microphone, notifications, and location in Settings. You can turn Cloud AI off in Zen List. Doing so stops new AI requests and new service metrics and starts deletion of eligible Tula-operated cloud account, entitlement, and usage data for that anonymous installation. If deletion cannot finish immediately, the app preserves the pending request and retries it. Existing identity-free service metrics cannot be retrieved or deleted for one person because they contain no per-person key; they expire within three months.

You can delete app content in Zen List, manage iCloud data through Apple, leave or remove shared content subject to collaboration rules, and manage subscriptions through your Apple Account. You may also ask us to access, correct, or delete personal information we hold. We may verify your request and retain information when law permits or requires it.

Children and age-related restrictions

Zen List is a general productivity app and is not designed as a child-directed service. Some cloud features may be restricted by age, region, Apple controls, or processor terms. We do not use Cloud AI to profile children or show advertising. A parent or guardian should review the app's data practices and permissions when local law requires their involvement.

Security and data breaches

We use reasonable administrative and technical safeguards, including encrypted transport, app-integrity checks, signed Apple proofs, data minimization, bounded retention, and privacy-safe logging. No system is perfectly secure. We maintain an incident response process and will notify affected people and regulators when applicable law requires it.

Privacy complaints

Send a written complaint to help@madebytula.com with enough detail for us to investigate. We will acknowledge it and aim to provide a substantive response within 30 days. If you are in Australia and remain dissatisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner. Other local privacy authorities may also be available.

Changes and contact

We may update this policy as Zen List evolves. We will update the date above and provide additional notice when a change is significant.

For privacy questions or requests, contact Tula Labs LLC, doing business as Made by Tula, at help@madebytula.com.