Privacy Policy

Who we are

Quick Checklist (quickchecklist.app) is built and operated by an individual developer based in Indonesia. There is no company behind it — it is one person, which is worth saying plainly because it tells you what to expect from the support and response times below.

For anything in this policy — access, correction, deletion, complaints — write to wwcolaborationprojects@gmail.com. Please allow up to 30 days for a substantive reply.

If you use the app without an account

This is the default, and it is the design the whole app is built around. In this mode we do not collect your notes at all, because there is no mechanism by which we could.

• Your notes, checklists, colours, attachments, and reminders are written to your browser's own storage (IndexedDB) and never transmitted anywhere.
• Photos you attach are processed entirely inside your browser. Location data and other camera metadata (EXIF) are stripped before the image is saved, so a photo you attach does not carry where it was taken — even locally.
• The phrases behind quick-capture suggestions are counted on your device and stay there. You can clear that history at any time in Settings.
• Because there is no server copy, we cannot recover your notes if you clear your browser data or lose the device. Exporting a backup from Settings is the only recovery path, and we would rather say so than let you find out later.

If you create an account

Signing in is optional and unlocks subscriptions and, on a paid plan, sync. Accounts are handled by Google Firebase Authentication; we never see or store your password, and we never receive it even momentarily.

What we store on our own server for an account:

• Your Firebase user ID, which is how we recognise you.
• Your email address, used to identify your account and to match a payment to it.
• Your display name, if your sign-in method supplies one.
• Your subscription status and the identifiers our payment provider uses for you.

If you subscribe (sync)

A paid subscription copies your notes to our server so they can reach your other devices. This is the only circumstance in which your notes leave your device.

Note content — the title, the body, the checklist items, and the text used for searching — is encrypted before it is written to our database. Some information is deliberately not encrypted, because the server needs to be able to sort, filter, and merge on it: the note's colour, whether it is pinned or archived, its labels, its reminder schedule, when it was created and last changed, and a short history of which fields changed in recent revisions.

Read the security section below before assuming what "encrypted" means here. It is important, and it is the thing most easily misunderstood.

Advertising

Free accounts see ads supplied by Google AdSense while online. Premium accounts see none, and the ad code is not loaded at all for them.

When ads load, Google receives your IP address and sets its own cookies or similar identifiers, and may use them to personalise what you are shown. Google acts as an independent controller of that data — we do not receive it, and we cannot delete it on your behalf. You can review and change what Google does at myadcenter.google.com and adssettings.google.com.

Ads are never placed inside a note, and never interrupt you with a full-screen unit. We do not send Google anything you write.

Who else handles your data

We use as few outside services as the product allows. These are all of them:

Analytics

We do not currently run any analytics — no Google Analytics, no tracking pixels, no session recording. If that changes we will update this policy and say so here before switching anything on.

Why we are allowed to process this

If you are in the UK or the European Economic Area, the UK GDPR and GDPR require us to name a legal basis for each purpose:

• Performance of a contract — running your account, syncing your notes, and taking payment. Without this we cannot provide the service you paid for.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing faults. We keep this to the minimum that actually serves those ends.
• Consent — advertising personalisation and anything you volunteer by writing to us. You can withdraw consent at any time, and doing so does not affect processing that already happened.
• Legal obligation — retaining payment records where tax or accounting law requires it.

How long we keep things

• Notes you delete go to Trash and are removed permanently 30 days later. That deletion also reaches our server the next time you open the app — so if you stop using the app entirely, a deleted note may remain on our server until you return or ask us to delete your account.
• Choosing "Delete forever" removes the note's content from our server as soon as your device can reach it. A record that the note existed and was deleted remains, so your other devices learn about the deletion.
• Account records are kept while your account exists, and deleted within 30 days of you asking us to close it.
• Payment records are kept as long as tax and accounting rules require, which is longer than the account itself.
• Data held by Google and Paddle is kept under their own policies, not ours.

Your rights

Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, where they apply to you, the GDPR and UK GDPR, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your data and close your account.
• Export your data in a portable format. You do not need to ask us for this one — Settings → Backup exports everything on your device as a file, at any time, without an account.
• Restrict or object to particular processing, including advertising.
• Withdraw consent you previously gave.

Security, stated precisely

Traffic between your device and our server is encrypted in transit. Synced note content is also encrypted where it is stored, using AES-256-GCM.

This is not end-to-end encryption, and we will not describe it as such. We hold the decryption key on our server, which means we are technically capable of reading your synced notes. We do not, and nothing in the app is built to — but you are entitled to know the difference between "they cannot read it" and "they say they do not", and this is the second one.

If you want the first one, do not subscribe to sync: notes on a free account never leave your device, which is a stronger guarantee than any promise we could make about our own server.

We never see your password — Firebase handles sign-in — and we never see your card details, which go directly to our payment provider.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Where your data goes

Our own server is a virtual private server rented from a commercial hosting provider. Google, Polar, and Cloudflare operate internationally and process data in countries that may differ from your own, including the United States. Where the GDPR applies, those providers rely on their own approved transfer mechanisms, such as the European Commission's standard contractual clauses.

Children

Quick Checklist is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

If we change how the app handles your data, we will update this page and change the date at the top. For changes that materially affect you — a new category of data, a new third party, a new purpose — we will tell you in the app rather than relying on you to re-read this page.

Contact and complaints

Write to wwcolaborationprojects@gmail.com for anything in this policy.

If you are in the EEA or UK and are not satisfied with our response, you have the right to complain to your national data protection authority. If you are in Indonesia, you may raise the matter with the authority designated under Law No. 27 of 2022.