Privacy Policy

• We collect what we need to run your account and the features you use, and nothing for advertising.
• We don't sell your data, and we don't run ads or analytics trackers.
• Your email address is never shown to other members.
• Your private visit notes are only ever shown to you.
• You can download your data or delete your account yourself, any time, from Profile → Account.
• BucketList is for people who are 16 or older.

BucketList is a small, independent project. When this page says “we”, that's who it means, and we are the controller of the personal data described here. You can reach us about privacy via the contact form.

• Account details. Your email address, a password (we never see it in readable form; our sign-in provider stores it hashed) and the display name you choose. We use these to create and secure your account and to send the emails you ask for, like confirming your address or resetting a password.
• Your profile. An optional profile photo link, your home country if you set one, and your “let friends find me by name” choice, which is off until you turn it on.
• Your travels. The places you rate, save, rank, skip in the swipe deck or mark as visited, including any visit dates and private notes. This is the heart of the app.
• What you share. Posts with photos and captions, comments, likes, the places or edits you suggest (name, description, photo and map pin), reports you file about content, and your friends, friend requests and invite links.
• Notifications. A record that someone liked or commented on your post, or sent you a friend request, so we can show it to you.
• Messages you send us. If you use the contact form, we keep what you write, your email address (so we can reply), your name if you give one, and, if you were signed in, a link to your account. To stop floods we also keep a one-way, scrambled version of your IP address (a keyed hash, not the address itself), which can't be turned back into the address and is used only to count how many messages one sender sent. We read these messages in a private admin page and, if email notifications are switched on, receive a copy by email.
• Photo scan. If you choose “Scan photo”, the picture you pick is sent off to guess the place (see below). We keep a small record that you used it, so we can apply a daily limit.
• Approximate location, only if you ask. If you tap “Near me” and allow your browser's location prompt, we round your position to roughly 1 km and keep it in a cookie on your own device for 6 hours. It is not saved to our database or put in any web address.
• Technical data. Like any website, our servers and our error-monitoring tool see your IP address, browser and device type, the pages you request and any errors. We use this to keep the service secure, stop abuse and fix bugs.

We don't ask for your date of birth, payment details, phone number or contacts, and we don't collect precise location. Photos you upload are re-encoded in your browser before they leave your device, which removes camera and GPS metadata.

If you're in the UK or EEA, our legal bases are: performing our agreement with you (running your account and the features you use), your consent (Near me, Photo scan, being findable by name), and our legitimate interests in keeping the service safe, preventing abuse and fixing problems.

• Everyone signed in can see posts, captions, comments and likes, along with the display name and profile photo of whoever wrote them. Post photos are also served from a public web address: anyone who has the exact link can open the image, even without an account.
• Your friends can see your ratings, visits and activity, but never your private visit notes. Joining someone through an invite link makes you friends straight away.
• Anyone on the internet, including search engines, can see place pages. If you add a place, its name, description, photo and map pin may be shown there, and may be reviewed first. Please don't add private homes or addresses. An invite link you share shows your name and profile photo to whoever opens it.
• Nobody but you sees your email address or your private visit notes.

When you use “Scan photo”, your picture is sent to Anthropic (in the United States), which runs the AI model that suggests which place it shows. We use only the answer. We don't keep the photo, and we don't use it for anything else. Anthropic handles it under its commercial API terms, which at the time of writing do not allow it to train its models on this data and keep it only for a limited time; see Anthropic's privacy policy for the details. The suggestion can be wrong, so please check it.

Pictures with other people's faces or private information in them are best left out of the scan.

These companies process data on our behalf, only to provide their service to us:

• Supabase hosts our database, sign-in and photo storage (United States).
• Vercel hosts the website and keeps request logs (United States).
• Sentry collects error reports and a sample of performance data from the app, including your IP address, browser, the page you were on and what went wrong. It is not given your email or name.
• Anthropic runs the photo scan, only when you use it (United States).
• Resend delivers the email that tells us a contact-form message has arrived (when we have email notifications switched on), so it sees that message and your email address in transit (United States).

Some services are contacted directly by your browser while you use the app, so they can see your IP address and which page you're on:

• Wikimedia serves most place photos. Wikimedia's own privacy policy applies to what it sees.
• OpenStreetMap serves the map tiles; the areas you look at are visible to it. See the OpenStreetMap Foundation privacy policy. When you drop a pin on a new place, our servers also ask OpenStreetMap's Nominatim service which country and city it is in, which sends it the pin's coordinates.
• Cloudflare Turnstile, a bot check, may run on the sign-up, log-in and contact forms. When it does, your browser contacts Cloudflare and Cloudflare sees your IP address and browser details; see Cloudflare's privacy policy.

Place information comes from Wikidata, Wikipedia and Wikimedia Commons, fetched by us rather than about you. See Credits. We share personal data with authorities only when the law requires it.

Our database and servers are in the United States. If you use BucketList from the UK, the EEA or elsewhere, your data is transferred there. Our providers rely on safeguards such as the EU–US Data Privacy Framework and Standard Contractual Clauses for these transfers.

We only use storage that the app needs to work or to remember a setting. We don't use advertising or analytics cookies, so there is no cookie banner. What is stored on your device:

• Sign-in cookies (named like sb-…-auth-token), set by Supabase while you are signed in, so you stay signed in. Essential.
• bl_near cookie. Your rounded “Near me” position, kept 6 hours. Only set if you tap Near me.
• Browser storage (localStorage) for small conveniences: theme (light or dark), bucketlist:lastCountry (the last country you picked), bucketlist:hideFriendsBanner (you dismissed the add-friends tip), bl-ties-sorted:* and bl-ties-hidden:* (which tied rankings you've sorted or dismissed), and bucketlist:deckSkipped (an older copy of your swipe-deck skips, cleared once moved to your account).

You can clear all of these in your browser settings at any time. Our error-monitoring tool does not set cookies, but it does receive the technical data listed above.

• Account data, travels, posts and photos: until you delete them or your account.
• Housekeeping records, like unconfirmed sign-ups, photo-scan usage counts and old read notifications: we clear these out from time to time rather than keeping them forever.
• Contact-form messages: until we have answered them (marked done), plus 12 months, then they are deleted along with the hashed IP. Deleting your account unlinks your messages from it but doesn't delete them early; ask us through the contact form if you want one removed sooner.
• Server logs and error reports: a limited time, typically up to 90 days, set by those providers.
• After you delete your account, copies can remain in encrypted backups for a limited period (we aim for no more than 30 days) before they expire.
• A place you added to the shared catalogue may stay, with your name removed, so other people's ratings and visits aren't lost.

Download or delete, yourself. Go to Profile → Account to download everything we hold about you as a file, or to delete your account. Deleting removes your profile, ratings, visits, rankings, friends, posts, comments and photos, and can't be undone. You can also edit your profile and the places you added any time, and turn off “find me by name” whenever you like.

Your rights. Depending on where you live (for example under the GDPR, UK GDPR or California law) you may have the right to access, correct, delete and port your data, to object to or restrict how we use it, to withdraw consent, and to complain to your local data protection authority. We don't sell or “share” personal data for advertising, and we don't treat people differently for using their rights. We'll answer requests within 30 days. To make a request, use the contact form. We may ask you to write from your account's email address so we know it's you.

BucketList is for people aged 16 or older. We don't knowingly collect information from anyone younger, and we delete an account if we learn it belongs to someone under 16. If you're a parent and think your child has an account, please contact us.

Everything is sent over HTTPS, passwords are stored hashed by our sign-in provider, our database enforces who can read which rows, and we limit how much any one account can do in a day to blunt abuse. No service is perfectly secure. If something goes wrong that affects you, we'll tell you and the authorities as the law requires.

If we change this policy, we'll update the date at the top and, for anything significant, tell you in the app or by email. Our Terms sit alongside this policy.

Send privacy questions and requests to the contact form. More ways to reach us, and how to report content, are on the contact page.