Privacy Policy
Version 1.3.0 · Effective
Privacy Policy
Last Updated: August 5, 2026
Effective Date: August 5, 2026
1. Introduction
Eidos Vale Pty Ltd (ACN 700 845 978) ("we", "our", or "us"), an Australian proprietary limited company registered in Victoria, Australia, operates the ActionList platform and the ActionList.io domain under its registered business name ActionList. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our productivity application and related services (collectively, the "Service").
For the purposes of data protection laws that use these terms (including the EU and UK GDPR), Eidos Vale Pty Ltd is the data controller of personal information processed through the Service. Contact details are in Section 10.
2. Information We Collect
2.1 Information You Provide
- Account Information: Email address, name, password (stored only as a salted hash), and profile information you choose to provide.
- User Content: Tasks, habits, reminders, notes, goals, routines, focus sessions, and messages you send to the AI assistant.
- Communications: Feedback, support requests, and other communications you send to us.
2.2 Automatically Collected Information
- Device & Usage Data: Device type, operating system, features used, actions taken, and interaction patterns.
- Log Data: IP address, access times, and referring URLs.
3. How We Use Your Information
- Provide, maintain, and improve the Service;
- Send you technical notices, updates, and support messages;
- With your consent, measure product usage and diagnose errors;
- Detect and prevent fraud or abuse;
- Comply with legal obligations.
4. AI Features and Content Processing
The Service includes AI-assisted features. When you use them, the content you submit — which may include your task, habit, reminder, note, and chat content — is transmitted to our AI sub-processors, Anthropic and OpenAI, so they can generate a response for you. These providers process your content on our behalf under contractual data-processing terms and do not use your content to train their models. If you do not want your content sent to an AI provider, do not use the AI features.
5. Sub-processors
We share data with vendors who process it on our behalf to run the Service. Each acts as a sub-processor under contractual data-processing obligations and may only use your data to provide their service to us. We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.
| Purpose | Current provider |
|---|---|
| Database hosting, authentication, and file storage | Supabase |
| Product analytics and usage measurement | Mixpanel * |
| Error monitoring, logging, and performance diagnostics | Sentry * |
| AI assistant and AI-assisted features | Anthropic, OpenAI |
| Transactional and marketing email delivery | Resend |
| Payment and subscription processing | Stripe |
| Calendar integration and Sign in with Google | |
| Sign in with Apple and App Store billing | Apple |
* Analytics and diagnostics are non-essential and do not run until you consent (Section 6). We may change the providers we use for them from time to time; the current list is the one published here and in our Cookie Policy.
6. Cookies, Analytics, and Consent
We use cookies and similar technologies to keep you signed in and to store your preferences. These are strictly necessary for the Service to work and are always active.
We also collect analytics and diagnostic data — which features are used, how the app performs, and technical error reports — to understand and improve the Service. This is non-essential and is not collected until you consent. Where required by law (including in the EU/EEA and UK) we ask before loading any such tool, and you may withdraw consent at any time in Settings > Privacy & Security or by declining the consent banner.
The cookies we set, what each one is for, how long it lasts, and the current providers we use for analytics and diagnostics are listed in our Cookie Policy.
7. Data Minimization
We limit collection to what the Service needs. Error monitoring is configured to exclude personal identifiers (we do not send default PII), and session replays mask text and input content.
8. Your Rights
- Access & Portability: You can download a complete, machine-readable copy of your data from Settings > Export Data.
- Erasure: You can permanently delete your account and all associated personal data — including your authentication record and marketing-email records — from Settings > Delete Account.
- Marketing: Marketing email is opt-in. You can change preferences or unsubscribe at any time using the secure link in any marketing email.
- Withdraw Consent: You can withdraw analytics/tracking consent at any time.
9. Data Location and International Transfers
Your account data — your profile, tasks, habits, reminders, focus sessions, and the other content you create — is stored in Singapore, in the Asia-Pacific (Southeast) region of our database provider infrastructure.
Some of our other sub-processors operate elsewhere, so your information may also be processed in Australia, the United States, and the European Union. We are an Australian company: where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles (APP 8). Where we transfer personal information from a jurisdiction that restricts international transfers (such as the EU/EEA or UK), we rely on adequacy decisions, standard contractual clauses entered into by our sub-processors, or another mechanism recognised by applicable law.
10. Contact
Data Controller: Eidos Vale Pty Ltd (ACN 700 845 978)
Business name: ActionList (ActionList.io)
Registered in: Victoria, Australia
For privacy questions or to exercise your rights, contact us at privacy@actionlist.io.
Privacy complaints (Australia): Office of the Australian Information Commissioner — oaic.gov.au