Privacy

Bidadari List is built to know as little as possible. Here is exactly what happens to your data.

What people give

• The list title, items, notes and links that you or your participants type in. Anyone with the share link can see them, according to the permission the owner chose.
• An optional display name, only when someone claims an item, marks attendance or wants their name shown in the activity. Once chosen it is kept on our server, tied to that browser for that list, and cannot be changed (the owner can reset it).
• No email, phone number or identity document is asked from participants. Participants never need an account.

Accounts (optional)

• Accounts have no password. You log in with a one-time 6-digit code (TAC) sent to your Gmail address. We store your email and a name taken from it, only so your lists appear in My Lists. Login codes are stored hashed and deleted after use or after 10 minutes.
• Deleting your account removes this data. Your lists stay online as ordinary lists until they expire or you delete them with their owner link.

Cookies on your device

• A session cookie that protects requests from forgery, remembers that you unlocked a password-protected list and, if you log in, who you are.
• It also holds a random anonymous participant id, used only to stop the same browser voting twice in a poll and to let you release an item you claimed. It is not a fingerprint and is not shared.
• Your browser also remembers your theme and your display name on your own device. No advertising or tracking cookies are used.

Security data

• To limit abuse, short-lived counters are kept per network address (for example failed password attempts). They are deleted automatically.
• Like any web server, the hosting provider may keep standard access and error logs.

How long data is kept

• Lists are temporary by default. The owner chooses: 1 or 7 days after completion, 30 days from creation, or until deleted.
• Expired lists are removed automatically. Owners can delete a list and all its data at any time.

What we do not do

• No analytics, advertising, session replay or third-party tracking. Pages make no requests to other services; fonts, icons and the QR code are generated on this site.
• No location is collected, and no data is sold or shared.

Please remember

Anyone who has the public link can open the list. Do not put sensitive personal data in a list. See Security for the full picture, including limitations.