Privacy Policy

listcrush ("the app", "we") is operated by Baan Bear, an independent software business based in France. For any question about this policy or your data, write to contact@baanbear.com.

• Account data — your email address, authentication credentials (managed by Supabase Auth; passwords are hashed and never visible to us), and an optional display name and avatar.
• Your content — the tasks, projects, notes, checklists, contexts, areas of focus, contacts, routines, and file attachments you create in the app.
• Email capture — if you email your personal capture address, we process the sender address, subject, and body to create a task, plus any additional sender addresses you register as aliases.
• Google Calendar data — described in detail below, only if you connect your Google account.

Connecting Google Calendar is optional. When you connect it, we request the following OAuth scopes:

• calendar.events — to read your events and to create or update the calendar events that mirror tasks you schedule in listcrush (two-way sync).
• calendar.readonly — to list your calendars so you can choose which ones are visible.
• userinfo.email — to identify which Google account is connected.

We cache a deliberately minimal subset of event data: title, start and end times, all-day and recurrence flags, the number of attendees, and the calendar's name and color. We do not store event descriptions, locations, meeting links, or attendee identities. OAuth tokens are stored encrypted (Supabase Vault) and are used only to call the Google Calendar API on your behalf.

listcrush's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never sell Google user data, never use it for advertising, and never use it to train machine-learning or AI models. No human reads this data except with your explicit consent for a support request, for security and abuse investigations, or where required by law.

You can disconnect Google Calendar at any time in Settings — this immediately deletes our cached copy of your events and your tokens. You can also revoke listcrush's access from your Google account permissions.

All application data is stored with Supabase in the European Union (AWS eu-west-1, Ireland). The app itself is served by Cloudflare. Inbound capture emails are processed through Resend. These providers act as processors on our behalf; we do not sell your data or share it with third parties for their own purposes. No personal data is transferred outside the European Union without appropriate legal safeguards (such as the European Commission's Standard Contractual Clauses).

listcrush contains no third-party analytics, no advertising, and no trackers. The only browser storage we use is what is strictly necessary to keep you signed in.

We keep your data for as long as your account exists. You can export everything as JSON at any time from Settings, and deleting your account from Settings permanently erases all of your data — content, cached calendar events, tokens, and files.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data. Most of these are self-service (export and account deletion in Settings); for anything else, email contact@baanbear.com. You may also lodge a complaint with the French supervisory authority, the CNIL.

We will update this page and its date when the policy changes, and notify you in the app of any material change.