Your plans are personal. We treat them that way.

Scope and who we are

Tula Labs LLC, doing business as Made by Tula, is responsible for Zen List and the Tula-operated cloud services covered by this policy. This policy applies to the Zen List apps for iPhone, iPad, and Apple Watch, the Zen List app for Android when it becomes available, their widgets and extensions, and related cloud features.

The Made by Tula company website is covered by a separate Website Privacy Policy.

Using Zen List without an account

You can use Zen List without signing in. In this guest mode, your lists, tasks, and other app content are stored only on your device. They are not sent to our sync service, are not shared with anyone, and do not appear on your other devices. Like other app data, they may be included in your device's own backups, such as iCloud Backup, if you use them. Deleting the app removes guest data from your device.

Syncing and sharing need an Apple or Google sign-in, and our sync service refuses guest identities. If you buy Pro or use Cloud AI as a guest, Zen List uses an anonymous Firebase identity so our servers can verify the purchase and apply usage limits. That identity carries no name or email address.

Signing in

You can sign in with Apple or with Google. Google Firebase Authentication handles sign-in for Zen List. Signing in lets Zen List keep your data in sync across your devices and lets you share lists.

With Sign in with Apple, Apple gives Firebase a stable identifier for your Apple account. Zen List asks Apple for your name only, never your email address, and Apple lets you edit or hide the name before sharing it. With Google, Google shares your Google account identifier, name, email address, and profile photo link with Firebase. Firebase keeps these details in your sign-in record. To run and protect sign-in, Firebase also processes your IP address, device and app information, and sign-in times.

Our own servers recognize your account by its Firebase account identifier. They do not store your email address. When you sign in, our sync service stores the name from Google, or the name you share with Apple, as your display name. Members of the lists you share see it. You can change it at any time in Settings. If you have no name, Zen List asks you for one the first time you share a list.

An Apple sign-in and a Google sign-in are separate Zen List accounts, even when they use the same email address. Each has its own lists, sharing, and Pro. We do not link accounts by email.

When you sign in, anything you created as a guest on that device is added to the account and synced, and Pro you bought as a guest moves to the account.

Signing out

When you sign out, Zen List first tries to sync your remaining changes. It then erases that account's data from the device: its lists and tasks, photos, scheduled notifications, widget and Apple Watch data, and Siri and Spotlight entries. If some changes have not synced, the app warns you before erasing them. Your synced data stays in your account and downloads again when you sign back in. If a session ends on its own, for example because it expired, nothing is erased.

Information stored when you sign in

When you are signed in, Zen List saves every change on your device first and syncs it to our servers in the background. Our sync service runs on Cloudflare and stores, in the United States:

• lists, sections, tasks, and subtasks, including titles, notes, priorities, durations, focus levels, due dates and deadlines, repeat settings, completion, quantities, tags, order, a task's place (name, address, and coordinates) if you add one, and who created, completed, or is assigned each task;
• your reminders, including the place name, address, coordinates, and radius of location reminders;
• your smart lists, list order, templates, and preferences such as your streak goal, work hours, and planner and focus-timer settings;
• the activity behind your streaks and stats: completions, focus minutes, and rest days, with their dates and time zones;
• whether you accepted or dismissed a day plan, and the text of your weekly insights;
• photos you attach to tasks, as described below; and
• technical records needed to sync: your account identifier, when the account was created, a random identifier for each copy of Zen List's database, and version and timing information.

Some information never leaves your device: scheduled notifications and location monitoring, the search index, widget and Apple Watch snapshots, and appearance settings such as theme, sounds, and haptics.

While Zen List is open, it keeps a connection to our servers so changes from your other devices, and from people you share lists with, appear right away. The connection carries only changes you are allowed to see, and our servers keep no separate record of it. Our servers receive your IP address as part of each connection but do not store it with your synced data.

When you delete a task, list, or photo, it is first marked as deleted, so you can undo the deletion on any of your devices. 24 hours after the deletion, its content is erased from our servers, together with the items under it, such as subtasks, reminders, and photos. After that it can no longer be restored. What remains is a marker with no content, only an identifier and the deletion time, so your other devices and other list members remove the item too. The marker is removed 30 days after the deletion.

Sharing lists

When you are signed in, you can share any list except your Inbox. If you open an invite link as a guest, Zen List asks you to sign in first. The list's owner and editors can create invite links. A link can be used once, expires after 7 days, and can be revoked. Anyone signed in who has the link can see the list's name, the inviter's display name, and the role offered before joining, so share links only with people you intend to invite. The web page an invite link opens contains no details about the list. We store only a one-way hash of each link, never the link itself.

Everyone in a shared list sees its full content: the list's name and settings, sections, tasks, subtasks, notes, tags, places, photos, and who created, completed, or is assigned each task. They also see every member's display name and role. Owners and editors can change the content; viewers can only view it.

Your reminders, including location reminders, stay private to you even in a shared list. So do your activity and streaks, preferences, smart lists, templates, list order, day plans, and weekly insights.

If you leave a list or are removed from it, it is removed from your devices. Tasks you added stay in the list for its other members. How many people a list can include depends on its owner's plan, so our sync service checks whether the owner has Pro.

Photos

Adding photos to tasks requires Pro. Viewing them is free, including for members of a shared list. Before a photo is uploaded, Zen List resizes it and removes location information, such as GPS coordinates, from the image. A photo appears on your device right away and uploads when you are online.

Photos are stored in private Cloudflare R2 storage and are available only through our servers, to you and to members of the list the task belongs to. When you delete a photo or its task, the photo is erased from our storage 24 hours later, as described above. All your photos are erased when you delete your account. If your Pro plan lapses, existing photos stay. A guest's photos stay on the device and upload after sign-in only if the account has Pro.

Voice, scans, calendar, location, and notifications

Voice recordings are transcribed on your device and are not uploaded by Zen List. Scanning uses Cloud AI to read an image and suggest tasks. When you scan, Zen List sends a resized copy of the image, no larger than 1,200 pixels on its longest side, to our AI service, which passes it to OpenAI to extract the text, as described in the Cloud AI section. Our AI service does not store the image.

Calendar access is optional. Zen List uses calendar information on your device to show availability and help plan your day, and does not sync it to our servers. Cloud AI day planning may receive occupied time ranges, but not calendar event names or event locations.

Location access is optional. It supports reminders when you arrive at or leave a place. Your device watches for those places using its own location services, and Zen List does not send your current location to our servers. The places you save in reminders sync with your account and stay private to you. A place you add to a task is shared with the task's list. On Apple devices, map and address search use Apple Maps. Zen List does not send your location or saved places to Cloud AI.

Reminders and due-date alerts are scheduled as notifications on your device. Zen List does not send push notifications from its servers.

Optional Cloud AI

Cloud AI features are part of Pro. They can turn typed text, a reviewed voice transcript, or a scan into tasks; plan your day; and write a weekly insight. Cloud AI is off until you choose to enable it, and you can use Zen List without it. Before the first request, the app explains what will be sent and asks for your permission.

Depending on the feature, a request may include text you submit; a reviewed voice transcript; a resized copy of an image you scan; task titles, durations, priorities, focus levels, due status, work hours, and busy-time ranges; the current date, time, time zone, and language; or weekly summary values such as completed-task count, focus hours, streak, and completion rate.

Requests go to our AI service on Cloudflare, which sends them through Cloudflare AI Gateway to OpenAI for processing. With each request we include a pseudonymous identifier, created with a one-way function, that OpenAI can use for safety and abuse monitoring; it does not reveal your name, email address, or account identifier. We turn off OpenAI's response storage for these requests and keep gateway logging of request content off. OpenAI may keep limited information for abuse monitoring or legal reasons under the API terms that apply to our account.

Our AI service does not store your prompts, images, or AI responses after returning the result. Results you keep, such as tasks you accept or a weekly insight, are saved like the rest of your app content, on your device and, when you are signed in, in your synced data. Tula Labs does not use your content to train AI models, sell it, or use it for advertising. We choose service providers whose terms and safeguards protect app data consistently with this policy.

AI output can be incomplete or wrong. Review suggestions before relying on them. Do not submit highly sensitive information such as government identifiers, financial account credentials, medical records, or information you are not authorized to share.

You can turn Cloud AI off in Zen List at any time. Doing so stops new requests and erases the AI usage records linked to you. It does not affect your Pro purchase.

Pro purchases

Apple processes purchases made in the App Store, and Google processes purchases made in Google Play. We do not receive your name, email address, or payment details from them.

To confirm that you have Pro, our servers check your purchase with Apple or Google and store the purchase and transaction identifiers, the product, its status, expiry and grace-period dates, whether it will renew, whether it has been acknowledged, and whether it was refunded or revoked, along with when we last checked it. For Google Play purchases, this includes the purchase token Google issues, because Google requires it for every check. These records are linked to a pseudonymous account identifier created with a one-way keyed function, not to your name or email address. Apple and Google also notify our servers about renewals, refunds, and cancellations.

A purchase made while signed in is tagged with a token derived from your Zen List account, so Pro works on all of that account's signed-in devices. Pro belongs to the account that bought it and does not move to another signed-in account. You manage or cancel a subscription in the store where you bought it.

App integrity and abuse prevention

Firebase App Check, using Apple App Attest on Apple devices and Google Play Integrity on Android, helps confirm that requests come from a genuine Zen List app. These services process device attestation data and app information. Our servers also limit how many requests an account can make in a short time.

How long we keep information

• Synced app content and photos are kept while your account exists and are erased when you delete your account.
• The content of a deleted task, list, or photo is erased 24 hours after the deletion. The content-free marker left behind is removed after 30 days.
• Invite records are deleted 30 days after the invite was used, revoked, or expired.
• When an account deletion finishes, we keep the account identifier and deletion time for one day, so a device still signed in cannot save new data for it, and then delete them.
• Pseudonymous AI usage records, which contain the feature and model used, status, timing, and quota counts but no request content, are deleted after 30 days. Short-lived records that prevent duplicate requests normally expire within about 24 hours, and usage counters expire shortly after their daily or monthly period ends.
• When Cloud AI is used, we also create identity-free service metrics to measure reliability, speed, errors, resource use, caching, and quota health. They contain no prompt or response text, task or calendar content, dates, locations, IP addresses, or user, account, subscription, device, or installation identifiers. They have no key that lets us find or delete one person's metrics and are retained for up to three months.
• Purchase records are kept while a purchase is active. Records of purchases that expired, were revoked, or failed to renew are deleted about 190 days after they ended, and store notifications about 190 days after we received them. Records prepared for a purchase that was never completed are deleted after 30 days.
• After an account is deleted, we keep a minimal marker: a one-way hash of the account identifier, the deletion time, and a keyed digest of the account's purchase token. It stops stale credentials from recreating the account and lets its purchases be restored to a new account.
• Our servers keep short-lived technical logs for errors and security. Our AI service's logs never contain prompt or response content, sign-in tokens, or account identifiers.

Deleting your account

You can delete your account in Zen List. You may be asked to sign in again first. Deletion removes from our servers the lists you own, with everything in them, including for the people you shared them with; your membership in other people's lists; your reminders, activity, preferences, smart lists, templates, and other private data; your photos; your display name; the links between your account and your purchases; and your AI usage records. The app then deletes your Firebase sign-in account and the account's data on your device.

Deletion starts right away, and from that moment our servers store nothing new for the account. Each deletion request works for up to about 10 seconds. If anything remains, the app sends the request again, and an hourly background job finishes any deletion left unfinished.

Tasks you added to or completed in lists owned by other people stay in those lists as part of their content, but your display name is removed. Deleting your account does not cancel a subscription. Cancel it in the App Store or Google Play, wherever you bought it.

How we use information

We use information to provide the features you request, sync and share your content, verify purchases, secure the service, enforce limits, prevent fraud and abuse, diagnose failures, respond to support requests, and comply with law. We do not sell personal information, show behavioral advertising, or track you across other companies' apps or websites. The Zen List app does not include advertising or third-party analytics tools.

Cloud AI suggestions assist with organizing and planning. They do not make decisions that determine employment, credit, healthcare, education admission, legal rights, or similarly significant interests.

Service providers and international processing

We use these service providers to run Zen List: Cloudflare, which hosts our sync, sharing, photo, and AI services and protects our network; Google Firebase, for sign-in and app integrity; Apple, for Sign in with Apple, App Store purchases, App Attest, and Apple Maps; Google, for Google sign-in, Google Play purchases, and Play Integrity; and OpenAI, for Cloud AI processing.

Tula Labs is based in the United States. The account data our cloud services keep is stored in the United States on Cloudflare: the sync database, photos, and the purchase and Cloud AI usage records. Requests are handled on Cloudflare's global network, so they may be processed in the Cloudflare data center nearest you. The connections that deliver live updates keep no stored data. Short-lived records that limit Cloud AI use and prevent duplicate requests, identity-free service metrics, and technical logs are kept by Cloudflare in locations it selects. Our other service providers, including Google Firebase and OpenAI, may process information in the United States and in other countries where they operate. We use contractual, technical, and organizational safeguards appropriate to each service.

Your controls and requests

You control permissions for calendar, camera, microphone, notifications, and location in your device settings. You can turn Cloud AI off in Zen List, delete app content, leave or remove people from shared lists according to your role, sign out, and delete your account. You manage subscriptions through the App Store or Google Play.

You may also ask us to access, correct, or delete personal information we hold. We may verify your request and retain information when law permits or requires it.

Children and age-related restrictions

Zen List is a general productivity app and is not designed as a child-directed service. Some cloud features may be restricted by age, region, platform controls, or provider terms. We do not use Cloud AI to profile children or show advertising. A parent or guardian should review the app's data practices and permissions when local law requires their involvement.

Security and data breaches

We use reasonable administrative and technical safeguards, including encrypted connections, verified sign-in tokens, app-integrity checks, permission checks on our servers for every change to a shared list, one-way hashes for invite links and pseudonymous identifiers, private photo storage, data minimization, bounded retention, and privacy-safe logging. No system is perfectly secure. We maintain an incident response process and will notify affected people and regulators when applicable law requires it.

Privacy complaints

Send a written complaint to help@madebytula.com with enough detail for us to investigate. We will acknowledge it and aim to provide a substantive response within 30 days. If you are in Australia and remain dissatisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner. Other local privacy authorities may also be available.

Changes and contact

We may update this policy as Zen List evolves. We will update the date above and provide additional notice when a change is significant.

For privacy questions or requests, contact Tula Labs LLC, doing business as Made by Tula, at help@madebytula.com.