Privacy Policy - Visual Bucket List

Who we are

Visual Bucket List (“the App”, “we”, “us”, “our”) is a free web application at visualbucketlist.com that helps you plan and visualise life goals. The App is operated by Visual Bucket List, based in Ohio, United States. This policy explains what personal information we collect, why we collect it, how we use, store and disclose it, and the choices and rights you have. We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for users in the European Economic Area or the United Kingdom, the GDPR and UK GDPR.

What we collect

Account information: your email address and a user ID, if you create an account.
Guest information: an anonymous user ID, if you continue as a guest.
Your list content: your plan settings (life stages, column names, layout), list items (text, completion status, image links) and any images you upload. List items can reveal personal details about your plans, relationships, health or beliefs, so please only add what you are comfortable storing.
Technical information: information your browser and device send automatically, such as IP address, browser type and security signals used by Google reCAPTCHA and Firebase to detect abuse.

We collect this information directly from you when you use the App, and automatically through the services described below. We do not ask for your name, and we do not knowingly collect government identifiers or payment details. You can use the App as a guest without giving us your email address.

Account and authentication

Email / password accounts: If you sign up, we use Firebase Authentication (provided by Google) to store your email address and a hashed password. We do not store your password in plain text or in our own database.
Anonymous guest access: You may continue as a guest. Firebase creates an anonymous user ID so your list can be saved in that browser. Guest data is tied to that browser and may be permanently lost if you sign out, clear site data, use private browsing or switch devices. The App does not currently let you move a guest list to an account, so create an account if you want to keep your list.

Why we use your information

To create and secure your account and sign you in.
To save, display and sync your bucket lists and images.
To find suggested images for your list items.
To protect the App from spam, abuse and unauthorised access.
To respond to your questions, requests and complaints.
To meet our legal obligations.

We do not sell your personal information, and we do not use it for advertising or to build marketing profiles. We will only use or disclose it for another purpose if you consent or the law allows or requires it.

For users in the EEA or UK, our lawful bases are: performing our agreement with you (to provide the App), our legitimate interests (to keep the App secure and working, and to prevent abuse), and compliance with legal obligations.

Bucket list data (Firestore)

Your plan configuration and list items are stored in Cloud Firestore under your user ID (for example users/{uid}). Security rules are set so that only you, when signed in to that account or guest session, can read or write that data. As the operator, we can technically access stored data when needed to run, support or secure the App, and we only do so for those purposes.

Couple / shared lists

“Couple” templates in the App are layout templates (for example columns for Yourself / Joint / Partner) stored on a single account. The App does not currently offer multi-user shared ownership or invite-based couple accounts. Anyone who can sign in to that account can see the whole list. If you add information about another person, such as a partner, please make sure they are comfortable with it.

Images and third parties

We use trusted service providers to run the App. They receive only the information they need to provide their service:

Google (Firebase): Firebase Authentication, Cloud Firestore, Firebase Storage and Firebase Hosting store and serve your account details, list content and uploaded images. Google acts as our service provider. See the Firebase privacy information.
Google reCAPTCHA: Our sign-up page is protected by reCAPTCHA. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service. reCAPTCHA collects hardware and software information, such as device and browser data, and sends it to Google for analysis.
Pexels: When you generate images, the App sends your list item text to the Pexels API as a search query and displays the images it returns. Do not include personal details in item text if you do not want them sent to Pexels. Pexels handles those requests under its own privacy policy. Photos are provided by Pexels and remain subject to the Pexels licence.
Fallback images: If Pexels is unavailable, a placeholder image service (such as Picsum) may be used. Your browser will request images directly from that service, which will see your IP address.
Firebase Storage: If you upload custom images (where enabled), the files are stored under your user ID path.

We may also disclose personal information if required or authorised by law, for example to respond to a valid request from a court or law enforcement agency, or to protect the safety of any person.

Overseas storage and transfers

Google and Pexels may store and process information on servers outside Australia, including in the United States and other countries where they operate. We use established providers that publish their own privacy and security commitments, but overseas laws may not protect your information in the same way as Australian law. For users in the EEA or UK, Google relies on approved transfer mechanisms such as standard contractual clauses. By using the App, you acknowledge that your information may be handled overseas in this way.

Cookies, local storage, and similar

The App and Firebase use browser storage (local storage, session storage and IndexedDB) and cookies or similar technologies to keep you signed in, to run reCAPTCHA and App Check security checks, and to cache image links so the same prompt does not query Pexels again in the same session. These are needed for the App to work. We do not use advertising cookies or cross-site tracking. You can clear or block browser storage in your browser settings, but parts of the App may then stop working and guest lists may be lost.

Security measures

We take reasonable steps to protect your information from misuse, interference, loss and unauthorised access, change or disclosure. These include Firebase Authentication, Firestore and Storage security rules, encrypted HTTPS connections, Google reCAPTCHA on sign-up and Firebase App Check. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of your information. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator where the law requires it.

How long we keep information

We keep account information and list content for as long as your account is active. If you ask us to delete your account, we will delete or de-identify your personal information within 30 days, except where we need to keep it to meet legal obligations or resolve disputes. Copies in provider backups may take longer to be removed. Inactive guest data may be deleted after 12 months of inactivity.

Your choices

Stop using the App: You may stop using the App at any time.
Delete your account: Contact us from the email address linked to your account and we will delete your account and list data.
Guest users: Guest lists are not linked to an email address, so we may not be able to identify or recover them. Clearing site data removes the local session, and your guest list will then no longer be accessible.

Access, correction and your rights

You can ask to access the personal information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. You can edit most list content directly in the App. We will respond within 30 days and will not charge you for making a request. If we refuse a request, we will tell you why and how to complain, unless the law means we cannot.

Depending on where you live, you may also have the right to ask us to delete your information, restrict or object to how we use it, or receive a copy in a portable format. Users in the EEA or UK can complain to their local data protection authority. California residents have the right to know what we collect, to request deletion, and not to be treated differently for using their rights. We do not sell or share personal information for targeted advertising.

Children

The App is not intended for children under 13. If you are under 18, you should only use the App with the permission of a parent or guardian. In the EEA or UK, users under 16 (or the age set by local law) need parental consent. If we learn that we have collected information from a child without the required consent, we will delete it. Contact us if you think this has happened.

Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date. If we make significant changes, we will take reasonable steps to let users know, for example by a notice in the App.

Contact and complaints

For privacy questions, requests or complaints, contact us. Please give us enough detail to understand your concern. We will acknowledge your complaint and aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.