Privacy policy
Effective 3 September 2026 · applies to checklistor.com
The short version: we don't collect your data, because the product is built so we never receive it.
What we collect
Nothing, by design. Checklistor has no user accounts, no sign-up forms, no cookies set by us, no ad network, no advertising scripts and no third-party analytics or tracking scripts. Every page is a static file; there is no application database that could store your checklists.
Where your checklists live
Your lists, ticks, notes and preferences (like the dark-mode setting) are stored in your browser's localStorage on your device. They never leave it unless you export or share them yourself. Consequences worth knowing:
- Clearing your browser data deletes your checklists. Back up important lists with Export → JSON.
- Lists don't sync between devices or browsers — move them via JSON export/import or a share link.
- Anyone using the same browser profile can see your lists, like any local file.
How share links work
When you share a checklist, the entire list is compressed and encoded into the link's #fragment. Browsers do not send fragments to web servers, so the contents of your checklist are not transmitted to us even when the link is opened. Be aware that the link itself contains your checklist: anyone you send it to (and any app it passes through, like a chat service) can read it. Don't share links to lists containing sensitive information.
Server logs, and the one processor
This site is hosted by Hostinger International Ltd., which acts as our processor and is the only company that handles anything on our behalf. Its servers keep standard, short-lived web-server access logs (IP address, requested page, user agent) for security and operations, as virtually every website's host does. We don't use these logs to identify or profile visitors, and no other processor, analytics service or ad network is involved.
The legal basis for those logs is our legitimate interest in keeping the site up and secure (GDPR Article 6(1)(f)). Retention is the host's own short log-retention period; we keep no copy and maintain no database of our own. Hostinger states in its privacy policy that where data reaches a country outside the EU or EEA, the transfer is covered by the European Commission's approved standard contractual clauses (read 1 September 2026).
The embed widget
The embeddable widget follows the same rules: visitors' items and ticks are stored in their own browsers, scoped to the widget. Nothing is reported back to us or to the site embedding it.
Analytics
There are currently no analytics on this site. If we ever add measurement, it will be a cookieless, privacy-respecting counter (no cross-site tracking, no personal identifiers), and this page and the changelog will say so before it happens.
Partner links
Seven links on this site are partner links, each clearly labelled where it appears. Five sit on checklist items: the moving-company step on the moving house list and the belongings step on the apartment move-in/move-out list point to 1-800-PACK-RAT, the insurance step on the international travel packing list points to Faye, the load-testing step on the e-commerce store launch list points to Cloudways, and the SEO-settings step on the website launch list points to Semrush. 1-800-PACK-RAT and Faye serve the United States only, which is marked on the link. The other two are both in the choosing a website platform guide, one in the site-builder section pointing to Weblium and one in the WordPress-hosting section pointing to WP Engine. Each sits with the question it answers, and there is never a second partner for the same job: WP Engine is managed WordPress hosting on the platform guide, Cloudways is managed cloud hosting on a store-launch step, and the two are never offered as alternatives to each other. Every other item, template and page on this site carries no partner link at all.
Where one appears it sits after free advice that costs nothing to follow, is marked “Partner link” and carries a rel="sponsored nofollow" attribute. If you follow it and buy something, we may earn a small commission at no extra cost to you. It is a plain outbound link: no script, pixel, iframe or cookie from those companies is loaded into this site, and we send them nothing about you or your checklists. Their reporting tells us only anonymous totals, such as how many clicks a page sent, never who clicked. Follow one and you are on their site, under their privacy practices.
Children
Checklistor collects no personal data from anyone, including children.
Who controls this data, and your rights
The data controller is the operator identified in full on the imprint, which is this site's single authoritative record of who runs it. Direct contact for any privacy question: hello@plainforge.com.
Under the GDPR you may request access to personal data about you, its correction, erasure or restriction, object to processing carried out on legitimate-interest grounds, and ask for portability. In practice there is very little here to exercise those rights against: there are no accounts, no database and no copy of the server logs on our side, so a request will usually be answered with exactly that explanation, plus whatever the host still holds at the time.
If you are not satisfied with how a request is handled, you have the right to complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), at vdai.lrv.lt, or to the supervisory authority of the EU country where you live or work.
Changes and contact
If this policy changes, the new version appears here with a new effective date. Questions: hello@plainforge.com.