Privacy Policy
Last updated: October 11, 2026
Punch List ("we", "the app") is a task list at mypunchlist.ai that you can use on your own or share with the people in your household. This page explains what information the app handles and why.
What we collect
- Account information: your email address and a password (stored only as a secure hash by our authentication provider).
- Your content: the tasks, notes, categories, due dates and household details you enter.
- Settings: preferences such as your default sort and your reminder times.
- Reminder devices (optional): if you turn on reminders, a push address for each device you choose, so we can send notifications to it. You can turn this off per device in Settings.
Google Calendar (optional)
If you choose to connect Google Calendar, Punch List asks Google for permission to create a separate calendar called "Punch List" in your Google account and to create, change and delete events on that calendar only. We do not read your other calendars or events.
- We use this access only to show your Punch List tasks that have due dates as events on that calendar, and to keep the two in step.
- Your Google access token is stored encrypted on our server and is never exposed to your browser.
- You can disconnect at any time in Settings, which deletes the stored token. You can also remove access at myaccount.google.com/permissions.
- Punch List's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use information
- To run the app: store and show your tasks, sync them across your devices, and share them with the people you choose.
- To send you email you ask for, such as account confirmation, password reset and household invitations.
- To power optional AI features (such as summaries and "Ask Punch List"): the text of your tasks is sent to an AI provider to generate a response for you. It is not used to advertise to you.
- To turn photos into tasks (optional "Scan to tasks"): a photo you choose to scan is sent to an AI provider to read it. We do not store the photo unless you choose to attach it to a task; only the tasks you review and choose to add are saved.
- To keep files with a task (optional attachments): photos and files you attach are stored privately on our storage provider and are visible only to you, or to your household if the task is shared. Deleting a task deletes its files.
- To run and improve the service: the dashboard we use shows account details (such as your email and sign-up date), usage counts (such as how many tasks were added) and technical error reports. It does not show the text of your tasks, your notes or your file names.
- To send reminders (optional): on the mornings tasks are due we send a notification that includes the names of those tasks. Notifications are delivered through your device maker's push service (Apple, Google or Mozilla), which sees the notification while it is delivered.
- To turn emails into tasks (optional "Email to task"): an email you forward to your private Punch List address is read by an AI provider, including any photo or PDF attached to it, to find tasks. We keep the tasks it creates and, for a bill, letter or similar, the attached file on that task. We do not keep the rest of the email.
Who we share it with
We do not sell your information. We use these service providers to run the app, and they process data on our behalf: Supabase (database and sign-in), Netlify (hosting), Resend (email delivery) and Anthropic (AI features). If you use Google Calendar, the events we create are stored by Google.
Tasks and categories you place in a shared household category are visible to the other members of that household. Private ones are visible only to you.
Your choices
- Edit or delete your tasks any time.
- Leave a household, or have a household head remove you.
- Disconnect Google Calendar any time.
- Ask us to delete your account and data by emailing the address below.
Retention and security
We keep your data while your account exists. Data is transmitted over HTTPS and access is restricted by account. No system is perfectly secure, but we work to protect your information.
Children
Punch List is not directed to children under 13.
Changes
If we change this policy we will update the date above.
Contact
Questions or deletion requests: privacy@mypunchlist.ai