Privacy Policy

1. Information We Collect

Account Data: When you register, we collect your name, email address, and password (stored using industry-standard one-way encryption). You may optionally provide a display name, bio, avatar, and website URL for your public creator profile.

Content: We store the lists, items, comments, and other content you create on the platform. Published lists are visible to all users; private lists are only accessible to you and anyone you explicitly share them with.

Usage Data: We collect basic usage information such as pages viewed, features used, timestamps, and device/browser type. We use this data to improve the service and diagnose technical issues.

AI Interaction Data: When you use AI-powered features (the Alyn assistant), we process your messages to generate responses. See Section 5 for details on how AI interactions are handled.

2. How We Use Information

We use your information to:

Operate, maintain, and improve the Listry platform
Display your published content and creator profile to other users
Enable the saving, sharing, and collaboration features
Provide AI-powered features (list suggestions, Q&A, organization assistance)
Send account-related notifications (security alerts, feature updates)
Detect and prevent misuse, fraud, and policy violations
Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data for targeted advertising. If we introduce advertising, it will be contextual (based on list category, not your personal data).

3. Information Sharing

We share your information only in the following circumstances:

Published content: Lists you publish and your creator profile are publicly visible
Service providers: We use third-party providers for hosting, email delivery, AI processing, and analytics. These providers process data on our behalf under contractual obligations to protect your information
AI providers: Your AI interactions are processed by third-party AI service providers (see Section 5). We apply PII scrubbing before data is sent to these providers
Legal requirements: We may disclose information if required by law, subpoena, court order, or government request, or to protect the rights, property, or safety of Suitethink, our users, or the public
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify you of any such transfer

4. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Specific retention periods:

Account data: Retained until you delete your account
Private lists and items: Deleted within 30 days of account deletion
Published content: Saved copies of your published lists remain as independent copies in other users' accounts after deletion. The original published listing is removed
AI interaction logs: Retained for up to 90 days for service improvement, then permanently deleted. PII is scrubbed from logs at the time of processing
Content moderation records: Retained for up to 1 year for enforcement consistency and legal compliance
Legal holds: Data subject to legal proceedings or regulatory requirements may be retained longer as required by law

5. AI Features & Data Processing

Listry includes AI-powered features that process your data to provide intelligent assistance. Here is how we handle your data in AI interactions:

PII Protection: Before any data is sent to our AI providers, we apply automated privacy-protection measures to detect and scrub personally identifiable information (PII). This includes detection of names, email addresses, phone numbers, social security numbers, credit card numbers, addresses, and other sensitive identifiers. We use multiple detection layers (pattern matching, natural language processing, and cloud-based entity recognition) to maximize accuracy.

What is scrubbed: Your conversation history and stored interaction logs have PII replaced with anonymous tokens before processing. Your current message in an active conversation is processed as-is to ensure accurate AI responses (scrubbing the current message would corrupt the AI's ability to understand and respond to your request).

AI provider data handling: Our AI providers do not use your data to train their models. Data sent to AI providers is retained by them for up to 30 days for safety monitoring purposes, then deleted. We do not send your data to AI providers for any purpose other than generating responses to your requests.

Limitations: No automated PII detection system is 100% accurate. We strongly recommend that you do not include highly sensitive information such as financial account numbers, government-issued identification numbers, passwords, or detailed medical records in your AI interactions or list content.

6. Security

We implement industry-standard security measures to protect your data:

Passwords stored using one-way cryptographic hashing (never stored in plaintext)
All data transmitted over HTTPS/TLS encryption
Short-lived authentication tokens (15-minute JWT) with server-side session management
Multi-tenant data isolation (your data is logically separated from other users' data)
Automated PII detection and scrubbing for AI interactions and stored logs
Access controls limiting employee access to production data

While we take reasonable measures to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

You have the following rights regarding your personal data:

Access: You can access your personal data through your account settings and data export features
Correction: You can update or correct your personal data at any time through your account settings
Deletion: You can request deletion of your account and associated data. We will process deletion requests within 30 days
Export: You can export your list data in multiple formats (JSON, CSV, Text) through the platform
Restriction: You can request that we restrict processing of your data in certain circumstances
Objection: You can object to processing of your data for certain purposes

To exercise any of these rights, contact us at [email protected]. We will respond to data access and deletion requests within 30 days.

8. Affiliate Links & Click Tracking

Certain lists on Listry contain affiliate links to third-party retailers (such as Amazon). When you click an affiliate link, we record an anonymous click event (the link identifier and a timestamp) for analytics purposes. We do not track your activity on the retailer's website, and we do not receive personal information about any purchases you make.

Affiliate links include a tracking identifier that allows the retailer to attribute referrals to Listry. This tracking is managed entirely by the retailer's affiliate program and is subject to their privacy policy, not ours. For more details, see our Affiliate Disclosure.

9. Cookies & Local Storage

Listry uses minimal browser storage. We store your authentication token and user preferences (such as workspace mode, pinned lists, and layout customization) in localStorage for session management. We do not use third-party tracking cookies, advertising cookies, or analytics cookies. If we introduce cookies in the future, we will update this policy and provide appropriate consent mechanisms.

10. Children's Privacy

Listry is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete it. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

11. International Data Transfers

Suitethink is based in Canada. Your data may be processed in Canada, the United States, or other countries where our service providers operate. By using Listry, you consent to the transfer of your data to these jurisdictions. We ensure that appropriate safeguards are in place for international data transfers in compliance with applicable privacy laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the date at the top of this page and, for significant changes, by email notification to registered users at least 14 days before the changes take effect. Your continued use of Listry after the effective date constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions, data access requests, or concerns, please contact us at [email protected].