Privacy Policy
Version 1.3.1 · Effective
Privacy Policy
Last Updated: 12 September 2026
Effective Date: September 12, 2026
1. Introduction
Eidos Vale Pty Ltd (ACN 700 845 978) ("we", "our", or "us"), an Australian proprietary limited company registered in Victoria, Australia, operates the ActionList platform and the ActionList.io domain under its registered business name ActionList. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our productivity application and related services (collectively, the "Service").
For the purposes of data protection laws that use these terms (including the EU and UK GDPR), Eidos Vale Pty Ltd is the data controller of personal information processed through the Service. Contact details are in Section 10.
2. Information We Collect
2.1 Information You Provide
- Account Information: Email address, name, password (stored only as a salted hash), and profile information you choose to provide.
- User Content: Tasks, habits, reminders, notes, goals, routines, focus sessions, and messages you send to the AI assistant.
- Communications: Feedback, support requests, and other communications you send to us.
2.2 Automatically Collected Information
- Device & Usage Data: Device type, operating system, features used, actions taken, and interaction patterns.
- Log Data: IP address, access times, and referring URLs.
3. How We Use Your Information
- Provide, maintain, and improve the Service;
- Send you technical notices, updates, and support messages;
- Detect technical errors and crashes to maintain the Service; with your consent, measure product usage and enable optional diagnostics;
- Detect and prevent fraud or abuse;
- Comply with legal obligations.
4. AI Features and Content Processing
The Service includes AI-assisted features. When you use them, the content you submit — which may include your task, habit, reminder, note, and chat content — is transmitted to our AI sub-processors, Anthropic and OpenAI, so they can generate a response for you. These providers process your content on our behalf under contractual data-processing terms and do not use your content to train their models. If you do not want your content sent to an AI provider, do not use the AI features.
5. Sub-processors
We share data with vendors who process it on our behalf to run the Service. Each acts as a sub-processor under contractual data-processing obligations and may only use your data to provide their service to us. We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.
| Purpose | Current provider |
|---|---|
| Database hosting, authentication, and file storage | Supabase |
| Product analytics and usage measurement | Mixpanel * |
| Error monitoring, logging, and performance diagnostics | Sentry * |
| AI assistant and AI-assisted features | Anthropic, OpenAI |
| Transactional and marketing email delivery | Resend |
| Payment and subscription processing | Stripe |
| Calendar integration and Sign in with Google | |
| Sign in with Apple and App Store billing | Apple |
* Essential Sentry crash reporting is enabled separately from consent-based analytics, performance tracing and session replay. Section 6 explains the distinction. The current providers are listed here and in our Cookie Policy.
6. Cookies, Analytics, and Consent
We use cookies and similar technologies to keep you signed in and to store your preferences. These are strictly necessary for the Service to work and are always active.
Essential crash reporting: Sentry receives technical error and crash reports to help us detect failures and keep the Service reliable. This reporting is enabled without an analytics opt-in. In this essential mode we do not deliberately attach your account identity, and session replay and performance tracing are disabled. Reports may contain technical device, app and error details. We configure default personal-information collection off and remove request cookies; this is not a guarantee that every error message contains no personal information. We do not use these reports for advertising.
Optional analytics and diagnostics: Product analytics, performance tracing, session replay and attaching your account ID to diagnostics remain off until you consent. You may withdraw that consent in Settings > Privacy & Security. Withdrawal stops product analytics and session replay and clears diagnostic account identity. Performance tracing already initialised for the current app session may continue until you restart the app. Essential crash reporting remains enabled. Session replay is configured to mask text and input content.
The cookies we set, what each one is for, how long it lasts, and the current providers we use for analytics and diagnostics are listed in our Cookie Policy.
7. Data Minimization
We limit collection to what the Service needs. Essential crash reports do not deliberately include account identity. With analytics consent, diagnostics may include your account ID; email and name are not deliberately attached. Session replay masks text and input content.
8. Your Rights
- Access & Portability: You can download a complete, machine-readable copy of your data from Settings > Export Data.
- Erasure: You can permanently delete your account and all associated personal data — including your authentication record and marketing-email records — from Settings > Delete Account.
- Marketing: Marketing email is opt-in. You can change preferences or unsubscribe at any time using the secure link in any marketing email.
- Withdraw Consent: You can withdraw analytics/tracking consent at any time.
9. Data Location and International Transfers
Your account data — your profile, tasks, habits, reminders, focus sessions, and the other content you create — is stored in Singapore, in the Asia-Pacific (Southeast) region of our database provider infrastructure.
Some of our other sub-processors operate elsewhere, so your information may also be processed in Australia, the United States, and the European Union. We are an Australian company: where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles (APP 8). Where we transfer personal information from a jurisdiction that restricts international transfers (such as the EU/EEA or UK), we rely on adequacy decisions, standard contractual clauses entered into by our sub-processors, or another mechanism recognised by applicable law.
10. Contact
Data Controller: Eidos Vale Pty Ltd (ACN 700 845 978)
Business name: ActionList (ActionList.io)
Registered in: Victoria, Australia
For privacy questions or to exercise your rights, contact us at privacy@actionlist.io.
Privacy complaints (Australia): Office of the Australian Information Commissioner — oaic.gov.au