Privacy Policy v2
Data controller: Tophhie Cloud, United Kingdom
Address: Disclosed upon request to help@marvelist.co.uk
General enquiries: help@marvelist.co.uk
Privacy requests: privacy@tophhie.cloud
About Marvelist
Marvelist is an iOS and watchOS app for tasks, lists, and personal organisation. It includes features such as list creation and management, item sharing, Apple Watch integration, Siri and Shortcuts support, and push notifications for reminders and updates.
This policy applies to all users of the Marvelist app, including those using the production release and those participating in the beta programme via TestFlight.
Personal information we collect
We collect only what is necessary to provide and improve the Marvelist service.
Account and identity information
- Name, email address, and profile photo (provided by you on registration)
- Account credentials (stored as a secure password hash; plaintext passwords are never stored)
Device and session information
- Device model, iOS and watchOS version, and app version
- Unique device identifier used for session and authentication management
- Whether the development (TestFlight beta) version is installed
- Session tokens issued on sign-in, stored securely and used for authentication
Push notification information
- Device push token (APNs token), shared with OneSignal to deliver notifications
- Notification preferences and targeting tags (for example, beta vs. production user status)
Usage and content data
- Lists, tasks, and items you create or share within the app
- Sharing relationships between users where list sharing is used
We do not collect: location data, advertising identifiers, financial information, or any special category data as defined under UK GDPR.
How we get your information and why
Most personal information is provided directly by you during registration or use of the app. Some information (such as device identifiers and session tokens) is generated automatically as part of normal app operation.
We use your information to:
- Create and manage your account
- Provide personalisation within the app
- Enable list sharing with other users you choose to share with
- Authenticate your identity securely across devices
- Send push notifications for reminders and app updates (where you have consented)
- Support Apple Watch and Siri/Shortcuts integrations
- Maintain service security and detect abuse
Lawful basis under UK GDPR
We rely on the following lawful bases, depending on the type of processing:
- Your consent — for push notifications and optional personalisation. You can withdraw consent at any time via the app's notification settings or by contacting help@marvelist.co.uk.
- Contract performance — to provide the core app functionality you have signed up for, including account management, list storage, and sharing.
- Legitimate interests — to maintain the security of the service, prevent abuse, and improve reliability, where these interests are not overridden by your rights.
Sharing with third parties
We will only share your personal information with law enforcement agencies where required under UK law. Law enforcement will be required to provide a justifiable reason and formal order before we release any information. See Section 6 for disclosures about third-party processors (such as OneSignal) used to operate the service.
How we store your information
Your data is stored securely on servers hosted within the United Kingdom and/or European Union. Data is encrypted in transit (TLS) and at rest.
Retention
We retain your personal information for as long as your account remains active. Upon receiving a deletion request, we will remove your personal data within 30 days. Some audit records may be retained for a longer period where required to comply with security or legal obligations.
Account deletion
You can delete your account directly from the User Profile section of the app, or by contacting help@marvelist.co.uk. Deletion removes all personal information associated with your account, including your lists, tasks, and profile data.
Third-party processors
We use a small number of third-party service providers (sub-processors) to operate Marvelist. These processors act only on our instructions and are contractually bound to protect your data.OneSignal, Inc.
Push notification delivery. Receives your APNs device token and notification targeting tags. Data processed in the United States under appropriate safeguards. See OneSignal Privacy Policy.
Backend Infrastructure (Azure and Cloudflare)
Cloud hosting and managed database services used to store app data. Servers located in the United Kingdom and/or European Union.
Apple, Inc.
Apple Push Notification service (APNs) is used to deliver notifications to your device. Apple's handling of notification routing is governed by the Apple Privacy Policy.
Push notifications
Marvelist may send push notifications to your device for reminders and app updates. Push notifications require your explicit consent, which iOS will request when you first use the app.
To send notifications, your device's APNs token is shared with OneSignal (see Section 6). We may apply targeting tags to your notification profile — for example, to distinguish between production and beta users — so that we can send relevant communications to the right audience.
You are in control. You can disable push notifications at any time via iOS Settings > Notifications > Marvelist, or by managing your preferences within the app. Disabling notifications does not affect your account or any other app functionality.
Apple platform features
Apple Watch
When using Marvelist on Apple Watch, your list and task data is synchronised between your iPhone and Apple Watch via WatchConnectivity. No additional personal data is collected solely by virtue of using the Apple Watch app. Data transferred to the watch is stored on-device and subject to Apple's own security model.
Siri and Shortcuts
Marvelist supports Siri and Apple Shortcuts to allow you to interact with your lists using voice commands or automations. When you use Siri or Shortcuts with Marvelist, Apple may process your voice input and intent data in accordance with the Apple Privacy Policy. We do not receive your voice input or raw Siri data. We only receive the resolved intent (for example, "add item X to list Y") that iOS passes to the app.
Beta testing (TestFlight)
Marvelist beta versions are distributed via Apple TestFlight. If you are a TestFlight beta tester, please be aware that:
- Apple collects crash logs, usage data, and feedback submitted through TestFlight, in accordance with the Apple Privacy Policy.
- Beta builds may include additional diagnostic logging to help us identify and resolve issues. This logging is limited to technical diagnostic data (such as errors and feature usage counts) and does not include the content of your lists or personal data.
- We may use crash and diagnostic data from TestFlight to identify and fix issues before production release.
Beta testers are subject to the same data rights and protections described in this policy. If you wish to stop participating in the beta, you can remove the TestFlight app and contact us to request removal from the beta programme.
Your data protection rights
Under UK data protection law, you have the following rights. You are not required to pay any charge to exercise them, and we will respond within one month of receiving your request.- Right of access: Ask us for copies of your personal information.
- Right to rectification: Ask us to correct inaccurate or incomplete information.
- Right to erasure: Ask us to erase your personal information in certain circumstances.
- Right to restriction: Ask us to restrict processing of your personal information.
- Right to object: Object to our processing of your personal information.
- Right to portability: Ask us to transfer your data to another organisation or directly to you.
To exercise any of these rights, contact us at privacy@tophhie.cloud or help@marvelist.co.uk.
Children's privacy
Marvelist is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at help@marvelist.co.uk and we will take steps to remove that information promptly.Changes to this policy
We may update this policy from time to time. When we make material changes, for example, introducing a new type of data collection or a new third-party processor, we will notify you via push notification and/or email before those changes take effect.
The "last updated" date at the top of this page will always reflect when the policy was most recently revised. We encourage you to review it periodically.
How to complain
If you have concerns about how we handle your personal information, please contact us first — we'd like the opportunity to put things right.
Email: help@marvelist.co.uk
If you remain unhappy with our response, you have the right to complain to the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Have a question about this policy?
Reach out to Tophhie Cloud if you have any questions, concerns, or requests relating to this policy. We'll get back to you as soon as we can.