Back to Vennlist

Vennlist Privacy Policy

Last updated:

This policy takes effect when it is first published.

Vennlist is based in the United States ("Vennlist," "we," "us," or "our"). For privacy questions or requests, contact support@vennlist.app.

This policy explains how information is handled when you use Vennlist to save movies, TV shows, books, audio, and links; organize a personal library; participate in shared groups; and use related account, subscription, support, and beta-testing features. It also explains which information stays in local app storage, which information goes to our services or other providers, and the choices available to you.

1. Privacy at a glance

  • Your private list is not a public profile. Connected private lists and personal star ratings are restricted to your account through our backend access controls. Authorized service operators may access data when needed to operate, secure, or support the service.
  • Shared groups are a deliberate sharing choice. Group members can see the content saved to their group and relevant membership information. Sharing a pick does not share your personal star rating.
  • Selected item covers are different from group images. Vennlist does not upload Photos or Files images chosen as individual item covers to its backend. A group image is uploaded as a reduced thumbnail when you save it.
  • Network requests can happen without an account. Catalog searches, artwork downloads, and shared-link title previews can contact outside services. Those services receive the request and ordinary connection information.
  • The native app has no advertising or third-party analytics SDK. Hosting logs and Apple's TestFlight diagnostics are separate and are explained below.
  • Signing out is not deletion. Account caches and pending changes are preserved for a later sign-in. Account deletion, subscription cancellation, exported files, and shared content have different consequences.

2. Accounts and sign-in

If you create or use a connected account, we process your email address, account identifier, display name, account creation information, and any country or region value saved with your profile. You can choose a display name that does not reveal your full legal name.

Email and password sign-in sends the credentials you enter to our authentication service, Supabase. Sign in with Apple sends Apple's sign-in credentials to our authentication services and can provide your name and either your email address or an Apple private relay address. The information available depends on Apple and your choices. Apple authorization codes and tokens are used for authentication and, when the authorization service is configured, revoking that authorization during deletion. They are not group-member information.

The app stores its saved sign-in session in the device Keychain. Server authentication and authorization records support account access and security. When Apple authorization-token storage is enabled, our server stores a token in encrypted form for the limited purpose of authorization revocation. This does not mean that Vennlist's library is end-to-end encrypted.

You can use a separate local personal library without signing in. Its library records are not synchronized to Vennlist's backend merely because you use the local library. Search, cover, link, operating-system backup, and beta-testing behavior described elsewhere in this policy can still apply.

3. Saved content and shared groups

Library records can include titles, authors or artists, media types, provider identifiers, saved URLs, notes, tags, formats, progress, chosen display information, personal star ratings, and changes waiting to be synchronized. Content you enter can itself contain personal information. Avoid putting passwords, confidential access links, or other people's sensitive information into a pick or shared note.

For connected accounts, private and shared library information is sent to Supabase-hosted services to provide synchronization, authorized access, conflict handling, and group features. The app also keeps account-scoped local copies so it can display saved information and preserve edits when a connection is interrupted.

Group information includes group names, images, member identifiers and display names, roles, invitations, join requests, and shared picks. Members can see the information available to their group; a viewer may read shared content without permission to edit it. Group membership does not expose another member's sign-in credentials or private personal ratings. Your account email is not included in the ordinary group-member snapshot. Group owners can change membership; people who join later can see existing group content. Review the group before putting personal information into it.

Putting a private pick into a shared group makes the group's copy, including its shared notes and progress, readable by that group's members. Removing one copy does not necessarily remove copies in other lists. Members may export, copy, or take screenshots of information they can read. Vennlist cannot recall copies that another person has already saved outside the service.

Invitations use codes or links, associated group and creator information, use or expiry limits, and revocation records. The backend stores invitation verification hashes and related records. An expired invitation is no longer usable, but expiry does not necessarily erase its stored record. Do not post a private invitation publicly unless you intend others to use it.

When you report shared content, we collect the selected group or pick, its relevant content and group context, your account identifier, the reason, your explanation, and review status and timestamps. Authorized Vennlist personnel use this private evidence to investigate and moderate the report. We do not copy your entire library into a report. Reporting hides the selected pick or group photo for you while it is under review; a moderation decision may affect visibility for other members. Blocking stores the account relationship and changes shared-group membership as shown in the confirmation. Unblocking does not automatically rejoin groups. New or changed shared text and cover links receive limited server checks; these checks cannot identify every harmful item. New uploaded group photos require human review.

4. Device storage, selected images, and permissions

Appearance, swipe choices, Home selections, preferred media destinations, streaming region, and local reminder settings are stored as app preferences. Some are specific to an account and others apply to the device. A manually selected streaming region is not a reading of your GPS location.

The current native app does not request your Contacts, precise location, microphone, or camera for its ordinary features. Selecting a photo or file gives the app the content you choose through the system picker, rather than permission to inspect your entire collection.

Individual item-cover images selected from Photos or Files are processed and kept in account-scoped local storage. They are not part of library synchronization or ordinary library exports. You can remove a selected cover through its controls. These files and local libraries may be included in operating-system or user-created device backups; therefore, "not uploaded to Vennlist" does not mean "can never leave this device."

A custom group image follows a different path: the app crops and reduces it, removes original image metadata, and submits the processed thumbnail to a private human-review queue. Authorized Vennlist personnel can inspect it. The existing group image remains visible until a new submission is approved; authorized group members receive an approved thumbnail. Duplicate image bytes in an approved, rejected, or superseded review submission are discarded. The original selected full-size image is not uploaded.

Home Screen widgets use a bounded local snapshot of eligible titles, media types, selected presentation information, theme, and cached thumbnails. The widget snapshot excludes sign-in credentials, notes, personal ratings, original media links, and pending edits. Widgets do not perform their own catalog or artwork network lookups. Titles and images may be visible wherever iOS displays the widget, or in the app switcher. You control widget placement and eligible lists through iOS and Settings → Preferences → Your next pick.

The weekly reminder is an optional local device notification with general reminder text. Group-notification preferences may be stored with your account. If remote notification registration is enabled and succeeds, the service receives an Apple push token and its environment to deliver notifications. Remote group delivery is not enabled in the current beta. We will update the relevant disclosures and controls before introducing it.

5. Catalog searches, artwork, and shared-link previews

Catalog searches are sent directly to public providers. If we enable an optional catalog that uses our backend, we will update this policy to describe that route. Search requests may include the words you enter, media category, page information, and selected country or region. Artwork matching may use a saved title, author or artist, release year, ISBN, media identifier, or publisher-feed URL. Vennlist does not deliberately add your private notes, ratings, sign-in session, or account credentials to public catalog and artwork requests.

Depending on the item and feature, current public sources include Wikidata and Wikimedia Commons, TVmaze, Open Library, Apple's public catalogs, Cover Art Archive and Internet Archive, Vimeo, podcast publishers, and the hosts of saved website or image URLs. These services or hosts receive the relevant query, identifier, feed or image request and ordinary connection information, which can include your IP address, request time, and user-agent information. Search text and saved URLs may reveal interests or contain information you supplied.

Look up missing covers is on by default. You can turn it off in Settings → Your library → Cover art. It controls discovery of missing artwork; turning it off does not stop downloads from existing or manually supplied cover URLs, explicit refresh or matching actions, link previews, or websites you choose to open. A cover refresh you explicitly start can continue in the background or resume later under the operating system's rules. A cover refresh changes presentation caches, not your private notes or ratings.

When you share a supported YouTube video link, the Share extension can request its title and channel name from YouTube before you press Save. It sends a standard YouTube video URL containing the video ID, without timestamps, tracking parameters, or other parts of the original link. The request does not include your Vennlist account credentials, group choices, notes, or library. YouTube can receive ordinary connection information such as your IP address; see Google’s Privacy Policy. The channel name is shown in the preview. If you choose to save, Vennlist keeps the editable title and original link, including its timestamp or query parameters. This lookup does not download the video or its thumbnail.

For other links, the Share extension may automatically contact the full shared HTTP or HTTPS URL before you press Save to obtain its title. Its path and query are part of that request. The extension does not ask to fetch page subresources for this title lookup. There is currently no separate title-preview opt-out. Treat private or signed URLs carefully when sharing them.

Public catalog and artwork helpers do not use Vennlist account credentials or persistent cookie storage. That statement does not cover the operating system's link-metadata service, your browser, or a destination app. Opening a link or provider search takes you to that provider under its own terms and privacy practices. A preference for a streaming service does not connect or verify your account with that service.

6. Imports, exports, and recovery backups

Vennlist parses the CSV or JSON file you select for import locally. Importing a file exported from another service does not log in to that service or give Vennlist access to that service's account. Once you save imported picks into a connected account or group, the corresponding records can synchronize or become shared like other saved content.

Ordinary JSON and CSV exports may include private notes, personal ratings, saved links, and shared entries you are authorized to read. Personal ratings can appear in your export even when the corresponding pick is in a shared group. Ordinary exports exclude sign-in credentials, group permission records, pending operations, and the bytes of your selected device-cover images.

Prepare recovery backup creates a broader copy of the cached library snapshot. It can include pending edits, cached group and membership information, group thumbnails, and changes that have not yet been accepted by the server, including changes for a list whose access was later revoked. It does not include the saved authentication session. Treat recovery files as private information.

You choose where an export or recovery file goes through the system share or file interface. A recipient or file-storage provider may receive its contents. Previously generated temporary exports are not currently tracked for automatic removal during account deletion. Delete unneeded copies from Files, cloud storage, email, or other places where you saved them.

7. Purchases and Apple services

Apple processes App Store payments. Vennlist does not receive your payment-card number from Apple.

When subscription verification is enabled, Vennlist processes signed transaction information, product and original transaction identifiers, subscription environment, purchase or expiry information, revocation information, and an account token associated with your Vennlist account. The server uses this information to check Premium access, handle changes or duplicate notifications, and prevent a purchase from being assigned to a different account. These account-linked identifiers are personal information, even when they do not contain your name.

Subscription features may be unavailable while beta purchase verification is being set up. TestFlight purchases use Apple's Sandbox. Apple manages the payment relationship, sign-in service, App Store, and TestFlight under its own terms and privacy notices, including Apple's Privacy Policy.

Deleting Vennlist's account and cancelling an Apple subscription are separate actions. Manage the subscription through Apple's subscription settings.

8. Security logs, diagnostics, TestFlight, and support

Hosting and authentication services process technical and security records to operate the service and investigate errors or abuse. These may include timestamps, account or request identifiers, IP addresses, user agents, authentication events, request or response information, errors, and performance information. The absence of an advertising or analytics SDK does not mean that hosting providers keep no logs. Do not put unnecessary secrets into saved links, notes, or support attachments.

TestFlight automatically collects crash logs and usage information and shares them with the app developer. Depending on the report, this can include tester identifiers, device or operating-system information, build, installation, session, and crash information. It is not an optional Vennlist analytics switch. Feedback you choose to send can include your message, email address, screenshots, and diagnostic context; a screenshot may reveal library content. We use beta data to investigate problems and improve Vennlist and do not share Apple's beta data with third parties. Apple's handling and retention are described in TestFlight & Privacy.

If you contact support@vennlist.app, we receive your address, message, and the attachments you choose to send. Contact us opens your email app; it does not automatically send a message or attach your library. Send only what is needed for the issue. We do not need your password, a complete payment-card number, or an unrelated library export for a routine support request.

Support and privacy requests are handled by authorized Vennlist personnel, which may include the operator or other staff. Your correspondence is private: we do not publish it, sell it, or share it for advertising. Access and disclosure are limited to handling your request, operating and securing the service, carrying out your instructions, or meeting applicable legal requirements, as explained in section 10. The separate restriction on sharing Apple's TestFlight beta data above continues to apply.

9. Purposes and privacy commitments

We process information to provide accounts, personal and shared libraries, synchronization, invitation permissions, imports and exports, requested artwork or catalog features, subscription verification when enabled, notifications, and support. Security and diagnostic information helps us prevent unauthorized access, make changes reliable, investigate failures, and address abuse. We also process information when required to meet applicable legal obligations or respond to a valid legal request.

Vennlist does not sell your personal information or use it for targeted advertising. The current native app does not include advertising SDKs, cross-app advertising identifiers, or a third-party analytics SDK. We do not make a private library public simply because someone buys Premium. We do not need optional photo selection or notification permission to provide unrelated library features.

Where a law requires a basis for processing, the basis depends on the purpose: providing a service you request, your consent where appropriate, necessary and proportionate service-security interests, or a legal obligation. Permission to use an optional feature is limited to that feature; it is not permission to sell your information or start an unrelated use. Withdrawing consent does not undo processing that was lawful before withdrawal.

10. Recipients, providers, and international processing

Information is received by authorized group members you choose to share with; Supabase for hosting, authentication, database and related operations; Apple for sign-in, purchases, TestFlight and operating-system services; the providers contacted by catalog, image, feed, or destination requests; and service providers needed to operate the service. Authorized Vennlist personnel may access information for service, security, and support purposes. We may disclose information when necessary to comply with applicable law, protect rights or safety, or carry out your instructions. These categories do not authorize sharing Apple's TestFlight beta data with third parties.

For service providers processing personal information on our behalf, we require purpose-limited processing, confidentiality, appropriate security, and protections consistent with this policy and applicable Apple and legal requirements. Supabase's Data Processing Addendum describes its processor obligations and safeguards for its subprocessors. Its subprocessor list identifies relevant categories of infrastructure and operational providers. A general subprocessor list does not mean that every provider receives every Vennlist record.

Public catalogs, websites, and destination apps can also act independently under their own privacy policies. We limit the information sent by the lookup to what the feature needs; we do not promise that a website you open adopts Vennlist's own retention practices. Our contracted-processor duties are separate from another person's use of an export or your independent use of an outside website.

The current beta account database is hosted in East US (North Virginia), United States, through Supabase. This does not establish the location of every support, logging, backup, or subprocessor operation. Depending on your location, processing may occur in a different country. Where applicable law requires safeguards for an international transfer, those safeguards must cover the relevant processing. The primary hosting location and transfer arrangements will be reviewed if the service moves to a different project or region.

11. Retention and security

We use the following retention principles; the current exceptions and unresolved periods are disclosed below:

  • Active account and library records: held to provide the account and content you keep. Removing a pick removes the relevant list copy; it does not necessarily erase a copy in a different private or shared list.
  • Local caches and pending edits: retained so work survives interruption and later sign-in. Disposable artwork caches are bounded and may be pruned. Signing out preserves the account's library and pending changes rather than erasing them.
  • Invitations, synchronization receipts, and deletion markers: retained to enforce permission, prevent duplicate changes, and support reliable synchronization. Expiry or revocation is not necessarily the same as deletion. The current backend has no general scheduled cleanup period for these records.
  • Subscription and purchase-ownership records: used to verify Premium and prevent the same purchase from being assigned to different accounts. When account deletion succeeds, current account-linked subscription and purchase-ownership records are removed. Earlier records that cannot reliably be associated with an account may require review; contact us about an account-associated concern. These identifiers are personal information even when a name is absent.
  • Support correspondence and reports: we may retain these to respond to requests, investigate recurring issues, maintain relevant service history, protect the service, and meet applicable legal requirements. No fixed retention period has been established; applicable privacy rights and account-associated deletion requirements still apply. Access remains limited to the purposes and recipients described in sections 8–10; reports are not made public, sold, or shared for advertising.
  • Apple-provided TestFlight beta data: used to investigate beta problems and improve Vennlist, subject to the restriction on third-party sharing in section 8. Apple keeps its own records under its applicable practices; Apple's retention is not a verified retention period for Vennlist's own copies. No fixed deletion period for those copies has been established.
  • Backups and security logs: may survive a deletion from the active database until the relevant retention or expiry process runs. An active-data deletion is not a promise that every backup is erased immediately.

Requests to Vennlist's backend use HTTPS. Saved authentication uses the device Keychain, and access to connected libraries is restricted by authenticated account and group permissions. Public metadata, artwork, and local storage have bounded processing safeguards. The synchronized library is not end-to-end encrypted: the service must process information to provide its features. User-opened sites and shared-link metadata may use the protocol in the supplied URL, including HTTP.

No system can guarantee perfect security. Your device access, exported files, backups, and group-sharing choices also affect who can see information. Contact support if you suspect unauthorized account access. We will investigate security incidents and provide any notices required by applicable law.

Safety-report evidence can remain after the reporter or reported author deletes an account when needed to investigate abuse, protect other users, handle a dispute, or meet a legal requirement. Deleting an account removes its live account records and associated shared content through the deletion flow; it does not automatically erase an already submitted private safety report. Access and use of retained evidence remain restricted to these purposes. Contact support@vennlist.app about report evidence associated with you or to exercise an applicable privacy right.

12. Your controls

  • Choose account or local use. A local library does not require a connected account. Sign out to end the current signed-in session, while understanding that cached account data remains on the device.
  • Edit and remove content. Manage picks, notes, tags, progress, and personal ratings through their ordinary controls. Group actions depend on your role.
  • Choose sharing. Select the lists and groups that receive a pick, manage memberships or invitations where authorized, and leave groups you no longer want to participate in. Offline copies cannot learn a permission change until they reconnect.
  • Control optional images and artwork. Choose or remove a device cover or group thumbnail. Turn off missing-cover discovery in Cover art; other download and preview behavior is explained in section 5.
  • Control notifications and widgets. Change Vennlist's settings and the relevant iOS notification, widget, and device controls.
  • Export a copy. Use Settings → Your library → Import & export for ordinary exports or a separate recovery backup. Store the result securely.
  • Request deletion or other privacy help. Use the account-deletion flow below or email support@vennlist.app.

We do not penalize you for exercising a privacy right. A feature may become unavailable when its necessary data, permission, account, or group membership is removed; that is separate from a penalty for making a request.

13. Account deletion and group continuity

You can request account deletion in Settings → Your account → Account actions. Older app versions may need to be updated first. During beta testing, account deletion and subscription features may be limited while their setup is completed. If an in-app deletion request cannot be completed, contact support@vennlist.app for help with your account and associated data.

Start deletion at Settings → Your account → Account actions. The confirmation explains permanent private-library loss, shared-content cleanup and the groups affected, and suggests backing up first. Deleting a group and deleting your account are different actions.

Before deleting your account, you can offer a group’s ownership to an existing member. The nominated member must accept and have verified Premium access. If you delete your account while still owning a group, the group becomes read-only for seven days. Remaining members can save a private copy or export their picks during that period. A nominated member has the first opportunity to accept ownership; if there is no nominee, or the nominee declines, another remaining member can accept with Premium. Acceptance keeps the group open. Without an accepted Premium successor, access closes at the deadline and the group enters permanent cleanup. Database access enforcement does not depend on an app staying open. Expired group records are removed through scheduled cleanup. Existing members do not otherwise need Premium merely to participate in an active group.

Copying into Just me is subject to the recipient’s private-library allowance, currently 100 picks for Free accounts. Existing private copies keep their own notes and progress. If the whole copy does not fit, it fails without a partial copy; an export remains available. Moving picks into your own private collection does not preserve them if you then delete that same account. Export before deletion to keep a copy outside the account. Photos or Files images selected as individual covers need their own backup.

Successful server deletion removes the authentication account, profile, private-list entries, personal ratings, memberships, account-linked subscription and purchase-ownership records, and other records handled by that flow. Apple authorization revocation must succeed where applicable. The database cleanup is transactional: if final account deletion fails, those database changes roll back. A started request is not proof of successful deletion.

Shared-content cleanup occurs when account deletion succeeds. The service removes the departing person’s tracked contributions and uncertain older personal fields in associated groups, including relevant notes, tags, custom links, titles and images. Known independently authored content from other members can remain. A field with mixed or uncertain authorship may be cleared even if another member also wrote it. Public catalog information is kept only when verified against the service’s trusted catalog; otherwise the pick may remain as “Saved pick” with uncertain metadata removed. Account deletion is not a guarantee that every original title or link remains available to the group. The app rejects older pending shared edits that could restore fields removed through this cleanup.

After successful account deletion, the app attempts to remove the matching account’s local library, pending edits, device covers, artwork cache, widget and Share-extension data, and account-scoped preferences. Failed local cleanup is shown with a retry. Deletion does not remove the separate local personal library, every device-wide preference, every other device’s offline copy, or previously exported files. Other devices must reconnect to learn the change.

Earlier private copies, imports or exports saved by another member may remain under that person’s control. Some older contributions, particularly edits made before attribution existed by a person who later left a group without a retained association, may not be reliably traceable. These historical cases need review and cannot be treated as erased merely by removing an account name. Contact support for an associated-content concern. Applicable privacy rights and deletion obligations still apply.

Backup and log limitations are described in section 11. Deleting a Vennlist account does not cancel an Apple subscription.

14. Privacy requests and regional rights

Email support@vennlist.app with the account email or identifier involved and the action you want. Authorized Vennlist personnel handle these requests. Examples include obtaining a copy, correcting inaccurate information, deleting data, withdrawing a consent, or asking how data is used. Do not send a password or unnecessary identity documents. We may need proportionate verification so that information is not disclosed or deleted for the wrong person.

Depending on the law that applies, rights can include access, correction, deletion, portability, restriction or objection to processing, withdrawal of consent, a legally recognized opt-out, and a complaint to the relevant privacy authority. An authorized representative may submit a request where the law allows. We will respond under the applicable requirements and explain any lawful limit, refusal, verification need, or available appeal. This policy does not remove rights or legal deadlines that apply to you.

Where sale or sharing for cross-context advertising is regulated, Vennlist's own practice is not to undertake those activities. That does not disable the independent practices of a website you visit. We do not currently make automated decisions producing legal or similarly significant effects about users; artwork suggestions and random next-pick selections are app presentation features.

15. Users aged 13 and older

Vennlist is intended for people 13 years or older, and is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided information, contact support@vennlist.app so we can investigate and arrange the appropriate deletion or other legally required response.

If you are 13 or older but a local law requires a parent or guardian's authorization for a particular use or processing activity, that requirement still applies. Please involve a parent or guardian where required. Thirteen is not a universal age for independent consent in every country.

The current app does not collect a date of birth or provide a verified parental-consent flow. Stating an intended audience does not itself verify age or parental permission. Certain features or uses may need to be restricted where legally required consent cannot be obtained. Apple's content age rating is separate from this privacy and intended-audience policy.

16. Changes and contact

We will update the revision and effective dates when this policy changes. For a material change to the way personal information is handled, we will provide the additional notice or obtain the consent required by the law that applies before using information for that new purpose. A policy update is not retroactive permission for an unrelated use of personal information.

Privacy contact: support@vennlist.app. Support and privacy requests may be handled by other authorized Vennlist personnel.