Privacy Policy

LarkIT (Finland) is the data controller for Bullets. Contact: [email protected].

• Account data: your email address, and an optional display name.
• Content you create: checklists, sections, items, runs, and tags.
• Cover images you upload.
• API keys, stored only as a salted hash plus a short display prefix.
• Minimal technical logs needed to run and secure the service.

We process account and content data to provide the service you asked for (performance of a contract, GDPR Art. 6(1)(b)). We process limited data for security and abuse-prevention based on our legitimate interests (Art. 6(1)(f)). Where we ask for consent, the basis is consent (Art. 6(1)(a)).

• Mailgun — sending sign-in and transactional emails.
• Object storage (S3 / R2) — storing the cover images you upload.
• Our hosting provider — running the application and database.

Processing may take place within or outside the EEA under appropriate safeguards (data-processing agreements and, where relevant, Standard Contractual Clauses).

Bullets uses one strictly-necessary session cookie to keep you signed in — no consent banner is required for it. We also use functional localStorage on your device for your theme, section collapse state, and dismissing the install prompt. We do not use advertising or analytics tracking cookies.

We keep your data while your account is active. When you delete your account, your checklists, runs, memberships, and API keys are deleted along with it; backups are rotated on a regular schedule.

Under the GDPR you have the right to access, rectify, erase, restrict, export (data portability), and object to the processing of your personal data. To exercise any of these, email [email protected]. You can also export your data and delete your account directly from your Settings page. You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

Bullets is not directed at children under 16.

We may update this policy; changes are reflected by the "last updated" date above.

Privacy questions: [email protected].