Privacy Policy

1. Information we collect & why

Account information

When you create an account we collect your email address and a display name. You sign in with Sign in with Apple or Google Sign-In; we receive a basic identifier and email from those services to create and secure your account. We use Supabase (a hosted Postgres database and storage provider) as our authentication and data backend.

Content you create

We store the content you put into the app so it works and syncs across your devices, including: lists and list items, tasks, calendar events, pantry items, notes, and note attachments (images, files, and audio, stored in Supabase Storage), and your focus session history.

Health-related content (medications & wellness)

Some features let you record health-adjacent information — for example medication names, doses, and schedules you add to a medication reminder, and habit and mood check-ins. Bespoke is an organizing and reminder tool, not a medical device and not medical advice. This content is stored and synced like any other content you create, and — if you choose to share the list or household it lives in — is visible to the people you share it with. We never sell it, and never use it for advertising. You can edit or delete it at any time, and photos of medication labels are processed on-device only and are not uploaded.

Location

With your permission, we use your precise location to find the nearest stores and route you through the aisles. If you save a home location, its label and coordinates are synced with your account so your saved places are available across your devices. We do not use your location for advertising or tracking, and you can turn location access off in iOS Settings at any time.

Shared lists & households

If you share a list or join a household, we store your membership and the collaboration data needed to keep everyone in sync (see Section 4).

Notifications

To send reminders and share notifications, we collect a device push token through Apple Push Notification service (APNs). You can turn off notifications in iOS Settings at any time.

AI features

Bespoke’s intelligent features are primarily on-device, using Apple’s on-device Foundation Models — that data stays on your device and is not sent to us. Some features offer optional, opt-in cloud assistance, processed through our backend using Google’s Gemini models. When you use a cloud AI feature (including opt-in photo/receipt scanning), only the content needed for that request is sent; image EXIF metadata is stripped before any upload, and our usage analytics for these features are content-free. Cloud AI is never required to use the app.

Focus & Screen Time

Focus sessions use Apple’s Family Controls / Screen Time framework to block distracting apps. The app-selection and blocking data stays on your device and is not transmitted to us.

Optional school sync

If you connect a school account, we import the assignment and calendar data you choose to connect — via OAuth with Canvas, Schoology, or Google Classroom, or via a personal .ics calendar feed — so it can appear in your schedule.

Store linking

When you ask for directions to a store, we open Apple Maps. Aisle-ordering data may be crowd-sourced from users to improve in-store routing.

Retailer hand-off (Walmart / Amazon)

When you choose “Add to Walmart order” (or open an Amazon link), we use the relevant item names / search terms to build a cart or search link, then hand you off to Walmart or Amazon to complete the purchase. We do not store Walmart’s or Amazon’s product catalog in the app, and we never receive your Walmart/Amazon login or payment details. See the Affiliate Disclosure.

Usage analytics

We collect content-free, aggregated usage analytics (e.g., which features are used and whether they succeed) to fix bugs and improve the app. These analytics do not include the contents of your lists, tasks, or notes.

2. How we use information

• To provide and sync the app’s features across your devices.
• To enable sharing and household collaboration that you initiate.
• To send the notifications and reminders you’ve enabled.
• To perform AI tasks you request (on-device by default; cloud only when you opt in).
• To import the school/calendar data you connect.
• To build retailer cart/search links when you choose to shop at Walmart or Amazon.
• To maintain security, prevent abuse, and debug and improve the app using content-free analytics.
• To comply with legal obligations.

We do not sell your personal information, and we do not use your lists, tasks, or notes to serve advertising. We do not use your content to train our own machine-learning models.

3. How we share information

We share information only as described here. Our key service providers and partners (“processors/third parties”) are:

• Apple — Sign in with Apple (authentication), Apple Push Notification service (notifications), on-device Foundation Models (on-device AI), Family Controls / Screen Time (focus), and Apple Maps (directions).
• Google — Google Sign-In (authentication), Google Classroom (optional school sync you connect), and Google Gemini (optional, opt-in cloud AI processing).
• Supabase — our backend processor for account authentication, database, and file/attachment storage.
• Walmart (via the Impact affiliate network) and Amazon — when you choose to shop, we hand you off to the retailer and may earn an affiliate commission.

We may also disclose information to comply with the law or a valid legal request, to enforce our terms, or to protect the rights, safety, and security of our users or the public. If we’re involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction; we’ll notify you of any change in how your information is handled.

Each third party processes data under its own privacy policy. Links you follow to Walmart, Amazon, Apple Maps, or a school service take you to those companies’ own services, which we don’t control.

4. Sharing with other users

Collaboration is something you choose. When you share a list or join a household:

• People you share with can see the shared list’s contents and updates in real time.
• Collaborators can see each other’s display name and email, and who added or changed an item, so it’s clear who did what.
• Household members share household membership and any lists/chores assigned within the household.

Only share with people you trust. You can leave a household or stop sharing a list to end that access going forward.

5. Affiliate disclosure

6. Data retention & deletion

We keep your account and content for as long as your account is active, or as needed to provide the app. You can delete your data at any time:

• Delete content: remove individual lists, items, notes, or attachments in the app.
• Delete your account: use the account-deletion option in the app’s Settings, or email us at bespoke@elimounts.com. Deleting your account removes your account record and associated content from our active systems. Residual copies may persist briefly in routine encrypted backups, which expire on a rolling basis, and we may retain limited information where required by law.

7. Security

We protect your data with measures including encryption in transit (TLS/HTTPS), authentication through Apple and Google, and database Row-Level Security (RLS) so that records are only accessible to you and the people you’ve shared them with. No method of transmission or storage is 100% secure, but we work to protect your information and continually improve our safeguards.

8. Your rights & choices

You can:

• Access & correct your information by viewing and editing it in the app.
• Delete your content or your entire account (see Section 6).
• Control optional features: opt in/out of cloud AI, turn off notifications in iOS Settings, and disconnect school sync.

To make a request you can’t complete in the app, email bespoke@elimounts.com. We may need to verify your identity before acting on a request.

9. California privacy (CCPA/CPRA)

If you’re a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising your rights.

The categories of personal information we collect are described in Section 1 (identifiers such as email; your user content; and content-free usage/analytics data). We collect this information to provide the app as described in Section 2 and disclose it to the service providers listed in Section 3.

We do not sell your personal information and do not share it for cross-context behavioral advertising. To exercise your rights, email bespoke@elimounts.com.

10. EEA/UK privacy (GDPR)

If you’re in the European Economic Area or the United Kingdom, the data controller is Eli Mounts d/b/a Bespoke Lists. We process your personal data on these legal bases:

• Performance of a contract — to provide the app’s core features you sign up for.
• Consent — for optional features such as cloud AI, notifications, and school sync (you can withdraw consent at any time).
• Legitimate interests — to secure the app and improve it with content-free analytics.
• Legal obligation — where the law requires.

You have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. To exercise these rights, email bespoke@elimounts.com. You also have the right to lodge a complaint with your local supervisory authority. For international transfers, see Section 12.

11. Children’s privacy

Bespoke is a general-audience family organizer. It is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 (consistent with COPPA). The account holder must be old enough to consent under their local law. In the EEA/UK, the app is not intended for users below the age required for consent in their country (generally 16).

Families and shared households. An adult account holder may add family members to a household or share lists, and may enter or import information that relates to their own child — for example a chore assignment, a school assignment or due date brought in through optional school sync, or a reminder. When you add information about your child, you confirm you are the parent or guardian and are doing so for your family’s use. That content is treated like any other content you create: synced to your account and visible only to the household or list members you choose. We do not build advertising profiles of anyone, and we do not knowingly use children’s information for any purpose other than providing the feature you asked for.

If you believe a child has provided us personal information directly, or you want a child’s information removed, contact bespoke@elimounts.com and we’ll delete it.

12. International data transfers

We and our service providers (including Supabase and Google) may process and store information on infrastructure located in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for transfers of personal data out of the EEA/UK. By using the app, you understand your information may be processed in countries other than the one you live in.

13. Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the app after an update means you accept the revised policy.

14. Contact us

Questions or requests about this policy or your data? Contact us at bespoke@elimounts.com — Eli Mounts d/b/a Bespoke Lists. This policy is governed by the laws of State of Idaho, United States.