← Back to Punch List

Privacy Policy

Last updated: October 6, 2026

Punch List ("we", "the app") is a task list at mypunchlist.ai that you can use on your own or share with the people in your household. This page explains what information the app handles and why.

What we collect

• Account information: your email address and a password (stored only as a secure hash by our authentication provider).
• Your content: the tasks, notes, categories, due dates and household details you enter.
• Settings: preferences such as your default sort and your reminder times.
• Reminder devices (optional): if you turn on reminders, a push address for each device you choose, so we can send notifications to it. You can turn this off per device in Settings.

Website and app analytics

We use Google Analytics to understand how the website and the app are used, for example which pages are visited and which features people try. It sees page names and a few event names (such as that a task was added), never the text of your tasks, notes, names or email address. We do not use it for advertising. Visitors in the European Union, the United Kingdom and Switzerland are not measured, and browsers that send a Do Not Track signal are not measured.

Information we get from Google (optional)

Everything in this section is optional. You can use Punch List without connecting any Google service.

Sign in with Google

If you choose "Continue with Google", Google tells us your email address and a Google account identifier so we can sign you in and link it to your Punch List account. We do not receive your contacts, mail, files or any other Google data from this.

Google Calendar

If you connect Google Calendar, Punch List asks Google for permission to create a separate calendar called "Punch List" in your Google account and to see, create, change and delete events on that calendar only. We do not read your other calendars or events.

• We use this access only to show your Punch List tasks that have due dates as events on that calendar, and to keep the two in step (moving an event moves the task's date).
• When you disconnect, we delete the "Punch List" calendar we created and remove the stored access.

Google Tasks

If you connect Google Tasks, Punch List asks Google for permission to see your tasks in Google Tasks and to update them (mark them complete, or change their date or title). You choose which of your task lists to sync, and we read only those lists. We never create or delete tasks in your Google Tasks.

• We use this access only to bring the tasks from the lists you chose into Punch List (title, notes, due date and whether it is done), and to keep them in step: completing a task, or changing its date or title, in either place updates the other. Google Tasks stores dates but not times.
• Nothing is ever deleted in either app because of the other.
• When you disconnect, we stop syncing and remove the stored access. Tasks already imported stay in Punch List as your own tasks until you delete them.

How we protect and use Google data

• Your Google access token is stored encrypted on our server and is never exposed to your browser. You can disconnect any time in Settings, or remove access at myaccount.google.com/permissions.
• We use data from Google only to provide the features described above. We do not sell it, use it for advertising or credit decisions, or let people read it unless you ask us to, it is needed for security or support you request, or the law requires it.
• Imported tasks are part of your Punch List. If you use optional AI features (such as "Ask Punch List" or the Monday plan email), task titles can be sent to our AI provider only to write the response for you. Data from Google is never used to train AI models.
• Deleting your account deletes everything we hold about you, including imported tasks and Google connections.
• Punch List's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign-in suggestions

If you use "Want a different way to sign in?" on the sign-in page, we record the option you chose (and any text you type under Other) with the date. It is not linked to an account or email address. We keep a one-way scrambled form of your network address for about a day's worth of rate limiting to stop abuse.

How we use information

• To run the app: store and show your tasks, sync them across your devices, and share them with the people you choose.
• To send you email you ask for, such as account confirmation, password reset and household invitations.
• To power optional AI features (such as summaries and "Ask Punch List"): the text of your tasks is sent to an AI provider to generate a response for you. It is not used to advertise to you.
• To turn photos into tasks (optional "Scan to tasks"): a photo you choose to scan is sent to an AI provider to read it. We do not store the photo unless you choose to attach it to a task; only the tasks you review and choose to add are saved.
• To keep files with a task (optional attachments): photos and files you attach are stored privately on our storage provider and are visible only to you, or to your household if the task is shared. Deleting a task deletes its files.
• To run and improve the service: the dashboard we use shows account details (such as your email and sign-up date), usage counts (such as how many tasks were added) and technical error reports. It does not show the text of your tasks, your notes or your file names.
• To send reminders (optional): on the mornings tasks are due we send a notification that includes the names of those tasks. Notifications are delivered through your device maker's push service (Apple, Google or Mozilla), which sees the notification while it is delivered.
• To turn emails into tasks (optional "Email to task"): an email you forward to your private Punch List address is read by an AI provider, including any photo or PDF attached to it, to find tasks. We keep the tasks it creates and, for a bill, letter or similar, the attached file on that task. We do not keep the rest of the email.
• To write your optional Monday plan email: a short list of your task names and counts is sent to an AI provider to write the opening lines, and the email is sent to your account address. You can turn it off in Settings or with the link in the email.

Who we share it with

We do not sell your information. We use these service providers to run the app, and they process data on our behalf: Supabase (database and sign-in), Netlify (hosting), Resend (email delivery) and Anthropic (AI features). If you use Google Calendar or Google Tasks, the events and tasks we create are stored by Google.

Tasks and categories you place in a shared household category are visible to the other members of that household. Private ones are visible only to you.

Your choices

• Edit or delete your tasks any time.
• Leave a household, or have a household head remove you.
• Disconnect Google Calendar or Google Tasks any time.
• Delete your account yourself in Settings, Account, Delete my account. That deletes everything private to you; lists and tasks you shared with your household stay with them and are handed to another head of household. You can also ask us to do it by emailing the address below.

Retention and security

We keep your data while your account exists. Data is transmitted over HTTPS and access is restricted by account. No system is perfectly secure, but we work to protect your information.

Children

Punch List is not directed to children under 13.

Changes

If we change this policy we will update the date above.

Contact

Questions or deletion requests: privacy@mypunchlist.ai

More from us: Second Summit, finds jobs, scores them against your resume and writes the tailored resume and cover letter · BookWard, a book tracker that learns why you like what you like