Privacy Policy for Bulletlist
Last updated: 26 August 2026
Bulletlist is an outliner. This policy describes what it stores, where, and who can see it. It is short because the app does little.
What is collected
- Your email address, when you sign in. It is the only identifier the account has, and it is used to send you a sign-in code and to tell your outline apart from anybody else's.
- The content you write — your outline. It is stored so that it is there on your other devices.
- Your display preferences — colour scheme, light or dark, and a couple of view toggles.
- How the app is used — described in full in the next section. Counts and settings, never anything you wrote.
That is the complete list of what your account holds. Bulletlist contains no advertising and does not track you across other apps or sites. It does not read your location, contacts, photos, calendar, or any other data on your device.
Analytics
The website and the iOS and Android apps all use Google Analytics, to find out how the app is actually used. Until 26 August 2026 the two store apps contained none and this section said so; they now measure the same things the website does, which is the change this version of the policy is about.
It records:
- Which pages and screens were opened, and which of the three — website, iOS app, Android app — you are using.
- Counts of what you did: how many bullets were added, completed, moved or deleted, how many times you zoomed or searched, whether you exported or imported a file, whether syncing failed. These are numbers. The text of a bullet, a note, a document or a search box is never sent, and never has been.
- Settings and context: your colour scheme and palette, roughly how large your outline is as a band rather than a number, the version of the app, the sort of browser or device you are on, and a rough location worked out from your IP address.
- A random identifier — in a cookie on the website, and in the app's own storage on a phone, where a cookie would not survive.
While you are signed in it is joined to your account, by the random account number Amazon issues you, so that using the app on a laptop and a phone counts as one person rather than two. That number is not your email address and cannot be turned back into it by anyone who does not already hold the account. Your email address is never sent to Google, and neither is anything you wrote.
It is measurement, never advertising. There is no advertising identifier, no advertising profile, no audience built from this, and nothing that follows you to another app or website. The tag is configured to refuse all three of Google's advertising purposes and its cross-site signals, in every one of the three places the app runs.
On the website any content blocker stops it, as does Google's own opt-out add-on. In the apps, deleting your account removes the link to you (see How long it is kept), and uninstalling discards the random identifier. If you would rather it recorded nothing at all, write to the address at the bottom of this page and it will be removed.
Where it is stored
Your outline is stored in Amazon Web Services (Amazon S3), under an identity issued to you by Amazon Cognito. A copy is also kept on your own device so the app works offline. AWS acts as a processor and does not use your content for its own purposes.
Without an account, it never leaves the device. The demo — bulletlist.org/demo, and "Continue without an account" in the apps — keeps what you write in your browser's own storage, so that closing the tab does not lose it. Nothing is sent anywhere, and there is nothing for us to look at: if you sign in later, that outline becomes your account's and the copy in the browser is deleted. Clearing your browser's site data removes it, and so does deleting your account.
Who it is shared with
Nobody, apart from the measurement described above, which goes to Google and to nowhere else. Your outline is not sold, not shared with advertisers or data brokers, and not used to train anything. It is not read by us in the ordinary course of running the service; access is restricted to your own identity by AWS IAM policy, which means the storage itself refuses requests made on behalf of anyone else.
How long it is kept
As long as your account exists — and ending it is something you do yourself, in the app, in about ten seconds. Open Settings → Account → Delete account, confirm, and your outline, your preferences and your sign-in are deleted. There is no grace period and nothing to ask anyone for.
The measurement records are the one exception, and it is worth being exact about it. They hold no outline text and no email address — counts, settings and the random account number — but they sit in Google Analytics rather than in your storage, so the delete button cannot reach them. They expire on their own after fourteen months, which is the shortest retention Google Analytics offers. If you want them gone sooner, write to the address below and they will be deleted by hand; that is a request we can act on, and the only part of ending an account that is.
Your rights
Both of the things you are most likely to want are controls in the app rather than requests to us. You can export your entire outline as an OPML file at any time, and you can delete your account and everything in it at any time, without asking anyone. If you would like a copy of what is held about you in some other form, ask at the address below. If you are in the UK, EU, or a jurisdiction with comparable law, the usual rights of access, rectification, erasure, restriction, portability and objection apply, and the lawful basis for processing is the performance of the contract by which the app is provided to you.
Children
Bulletlist is not directed at children and collects no information about age.
Changes
If this policy changes, the date at the top changes with it.