Privacy Policy
Last updated: 28 September 2026
This explains what Shortlist collects, why, and what you can do about it. The operator of Shortlist is the data controller; contact us at privacy@shortlist.social.
What we collect
- Account details: your name, username, email address, and a securely hashed password (we never see your password).
- What you post: lists, items, notes, photos, comments, tags and profile details.
- What you do: upvotes, saves, follows, friends, lists you send and receive, items you tick off, reports you make, and people you block.
- Technical data: your IP address and browser details, used briefly to keep the service secure (for example rate limits against password guessing) and in short-lived server logs.
We don't sell your data, show ads, or use advertising trackers.
Why we use it
- To run Shortlist and show your content to the people you choose (performing our contract with you).
- To keep accounts and the community safe, prevent abuse, and handle reports (our legitimate interest).
- To send account emails you need: email confirmation and password resets. We don't send marketing email.
Who can see what
Public lists, your profile, and public activity like upvote counts can be seen by anyone. Link-only lists can be seen by anyone with the link, friends-only lists by your friends, and private lists by you and people you invite to edit them.
Cookies
We use only necessary cookies: one that keeps you logged in and one that remembers whether you prefer the phone or desktop layout. No analytics or advertising cookies.
Services we use
- Fly.io hosts the app and database, in Stockholm, Sweden (EU).
- Cloudflare runs our domain's DNS.
- Resend delivers account emails.
When you add a link, our server visits that page to fetch its title and picture. Searches for books, music, films and places are sent to Open Library, Apple (iTunes) and Wikipedia without your personal details.
How long we keep it
We keep your data while your account exists. When you delete your account, your content is removed immediately; copies in backups disappear within 14 days.
Your rights
You can see and correct your details in Settings, download a copy of your data (Settings, Download my data), and delete your account at any time. Depending on where you live, you may also have rights to object, restrict processing, or complain to a data protection authority. Email privacy@shortlist.social for anything else.
Children
Shortlist isn't for children under 13, and we don't knowingly collect their data. If you think a child under 13 has an account, tell us and we'll delete it.
Changes
We'll post any changes here and tell you on the site if they're significant.