Privacy Policy

Last updated: 7 November 2026

This policy explains how vchecklist (the "Service") handles personal data. The Service is operated by Virtual Random LLC, Erosi Manjgaladze St. 75a, Nadzaladevi District, Tbilisi, Georgia ("we", "us"), who is the controller of your personal data. Contact: vchecklist@protonmail.com.

1. What we collect

• Account data: your email address and a salted hash of your password (we never store your password itself).
• Content you create: checklist titles and items, saved lists, organization names, and for team users: membership, assignments, due dates, completion status and schedules.
• Technical data: your IP address is used briefly for abuse prevention (rate limiting), and our hosting provider processes standard request logs.

If you use the Service without an account, your checklist stays in your browser's local storage on your device and is not sent to us.

2. Why we use it

• To provide the Service: create your account, save and sync your lists, deliver assignments to team members (performance of the agreement with you).
• To keep the Service secure and prevent abuse (our legitimate interest).
• To send service emails such as password resets and notices about checklists assigned to you (performance of the agreement).

We do not sell your data and we do not use it for advertising.

3. Cookies and local storage

We use one essential session cookie to keep you logged in, and your browser's local storage to keep your unsaved checklist on your device. We do not use advertising or analytics cookies, so no cookie banner is needed.

4. Teams and employers

If you join an organization, its administrators can see your email address, the checklists assigned to you and your completion progress. The organization decides why and how it uses this information and is responsible for having a lawful basis to do so (for example, as your employer). We act on the organization's instructions for that team data.

5. Who we share data with

• Cloudflare, Inc.: hosting, content delivery and database storage.
• Resend (or another email provider we may choose): sending service emails.

These providers may process data outside Georgia, including in the EU and the United States. We rely on contractual safeguards from these providers where required.

6. How long we keep it

We keep account and checklist data until you delete your account. Login sessions expire after 30 days, password reset links after 1 hour, and rate-limit records after at most one hour. Backups held by our provider may persist for a short additional period.

7. Your rights

You can: access and download your data (use "Download my data" after logging in), correct it, delete your account and data (use "Delete my account"), object to or restrict certain processing, and complain to the Personal Data Protection Service of Georgia. For any request, write to vchecklist@protonmail.com.

8. Security

Passwords are hashed with a salt, sessions use random tokens in secure cookies, and traffic is encrypted in transit. No system is perfectly secure; please use a strong, unique password.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

We may update this policy and will change the date above. For significant changes we will give notice in the Service.