Privacy & security

• Your account: your email, username, profile and settings (language, time zone), when you created it and when you first and last signed in. If you arrived through a campaign link, also which campaign it was.
• What you create: lists, items (with their links, dates, images and location), tags, statuses, comments, and who you shared each list with.

All of that is kept for as long as you have an account. When you delete a list or an item it disappears from view but isn't erased: there is no automatic purge today. If you want it gone for good, email hola@lizt.app.

• Chat with the lizt assistant: we keep the last 30 messages of the chat; older ones are deleted automatically. We also keep a log of what the assistant did (which tool it used and with what data), with no expiry.
• Activity: your lists' activity feed and, if you set up webhooks, a log of each delivery. Neither expires.
• Images and audio: images you upload and read-aloud audio are stored as files at a public, unguessable address: anyone with the link can open them. Today, deleting an item or a list doesn't delete those files; if you need them removed, email us.
• Voice dictation: the audio is not stored. It's transcribed and only the text is kept.
• Feedback: if you send us a note from the app, we keep the message, any screenshots you attach, your username and email, the page you were on and details about your device (full browser string and screen size).
• Sign-in: the code we email you is stored as a hash and is valid for 10 minutes. To stop abuse, we count how many codes you've requested.
• Usage analytics: we use PostHog to see which pages are visited, where visits come from (campaign links included) and which features get used — signing up, creating a list, using the assistant. Before you sign in it's an anonymous id; after, it's tied to your account id. It never gets your email or what your lists say, and we don't record your screen.

We don't process payments. Our own cookies are your session, your language, the campaign you came from and the usage-analytics one. To measure our ads, the Meta Pixel and the Google Ads tag also set their cookies: they learn that a page was viewed and, once, that an account was created — never your email or what your lists say.

• Vercel: hosts the app and stores images and audio.
• Neon: the database (Postgres) where everything above lives.
• Resend: sends our emails (sign-in codes, invites, reminders, the daily recap and, if you send feedback, the note to our team with your message, email and browser).
• Anthropic (Claude), through Vercel AI Gateway, with OpenAI as a fallback if it fails: they answer the lizt assistant's chat.
• OpenAI: transcribes voice dictation and generates read-aloud audio.
• PostHog (United States): usage analytics, reached through lizt's own domain.
• OpenStreetMap (Nominatim) looks up the address you type to place an item, and CARTO serves the maps your browser loads.

When you paste a link, lizt’s server visits that page to build the preview, and the preview image is loaded from the original site by the browser of whoever views the list. If you set up a webhook, lizt sends your lists’ changes to the address you chose.

We don't sell your data. Meta and Google only get the ad measurement described above.

There are two ways to use AI with lizt, and different data travels in each.

• The lizt assistant, inside the app. To answer you, lizt sends the model (Claude, or OpenAI if Claude fails) your name or email, your time zone and language, the conversation, and whatever its tools read from your lists.
• Your own Claude, ChatGPT or other assistant connected over MCP. The assistant receives whatever its tools ask for: your lists, items, tags, comments, reminders and webhooks, lists others shared with you, and other people's public or link-only lists. lizt only stores the changes it makes and when the connection was last used; the conversation doesn't go through lizt.

What Anthropic or OpenAI do with that information afterwards is governed by their terms, not lizt's. For the lizt assistant we haven't enabled any special "zero retention" option with those providers.

You connect an assistant by pasting lizt’s MCP URL, with no keys to create by hand. Once connected, it gets access to all of lizt’s tools, with the same access you have:

• Read: your lists, items, tags, comments, reminders and webhooks.
• Create: lists, items, tags, statuses, comments, webhooks and feedback.
• Modify: edit lists and items, change a list’s visibility (public, link-only or private), change statuses and tags, reorder, edit comments and restore deleted lists.
• Delete: lists and items (not fully erased, see above), tags, statuses, comments and webhooks.

Each tool comes labelled, as the MCP standard defines: whether it only reads, or whether it changes or deletes data. Your client (Claude, ChatGPT or another) can use those labels to tell reads from changes, for example to ask you to confirm before an action that deletes.

An assistant connected over MCP can’t invite people to a list or change your profile, but it can change a list’s visibility (public, link-only or private) and create webhooks that send changes to another address. To cut its access, disconnect it (see below).

• Assistants connected with the URL: in Settings → Connections → Connected apps, tap "Disconnect". It loses access immediately.
• Personal token: tap "Regenerate personal token" and the old one stops working immediately. You can also turn off "Enable MCP access": while it's off, no connection works.
• Sessions: "Sign out" only signs you out on that device, and each session lasts 30 days. There's no way yet to see your open sessions or close them all at once. If you're worried about a lost device, email hola@lizt.app.

• You sign in with a one-time code sent to your email: there are no passwords. The code is valid for 10 minutes and attempts are limited.
• Your session lives in a cookie the page's code can't read (HttpOnly), that only travels over HTTPS (Secure), with SameSite=Lax.
• Connections made with the URL use OAuth 2.1 with PKCE. The assistant gets an access token that lasts 1 hour and a refresh token that lasts 90 days and changes on every use; if an already-used refresh token shows up again after a minute, we cut the whole connection.
• For those tokens and for sign-in codes we only store a hash (SHA-256), never the value.
• The personal token is different: it doesn't expire, it travels inside the connection URL, and it's stored encrypted (AES-256-GCM) so you can view it again in Settings. If your assistant supports it, connect with the URL instead of the personal token.
• Webhooks sent by lizt are signed (HMAC-SHA256) and, in production, only to HTTPS addresses.

You can delete lists, items and comments in the app at any time.

There's no button to delete your account yet. To delete it, email hola@lizt.app from your account's address with the subject "Delete my account": we do it by hand. More detail in Data Deletion.

There's no automatic data download either: if you want a copy, ask at the same address.

For any question about privacy or security, or to report a problem: hola@lizt.app.