THUGLIST · Zelicra Technologies
THUGLIST — Privacy Policy
1. The short version
THUGLIST runs on your phone. Your targets, deadlines, notes and history are written to your device’s own storage and stay there. Nothing about it leaves your phone unless you turn on sync, which is described in section 4.
This version of THUGLIST has an optional account. You do not need one and the whole app works without one. If you choose to create an account, one thing leaves your phone: the email address you sign in with. Your list is not part of that. If you start the free trial, we also keep a fingerprint that stops it being started twice (section 4). If you also turn on sync, a sealed copy of your list is stored under your account — section 4 explains what that means. The app contains no analytics, no advertising, no crash reporting and no tracking of any kind.
The one thing that does leave your phone is a purchase: if you buy Pro, that transaction goes through Google Play, because Google requires it to. We never see your card, and we never see your purchase either: it stays between you and Google.
2. Who this policy is from
THUGLIST is published by Zelicra Technologies Private Limited, a company registered in India. This policy covers the THUGLIST Android application and nothing else. It does not cover Google Play itself, or any website you reach by tapping a link inside the app.
3. What THUGLIST keeps, and where it keeps it
Everything below is written to app-private storage on your device. On Android, app-private storage is readable only by THUGLIST; other apps cannot open it.
| What | Examples |
|---|---|
| Your list | Targets, deadlines, projects, areas, headings, tags, checklists, notes |
| Your record | What you finished and when, proof notes you wrote, credits, reputation, enforcer level |
| Your setup | Chosen skin, text size, focus-support settings, quiet hours, which apps you picked to block |
| Your plan | When the app was installed (this is how the 14-day trial is measured), and, if you bought Pro, whether it is annual or lifetime and the dates it runs between |
| Keys | Encryption keys, held by Android’s Keystore through the system’s secure storage |
Two deliberate choices about this data:
- THUGLIST is excluded from Android cloud backup (
allowBackupis off). The operating system does not copy your list to Google Drive. - A purchase is stored as three values and nothing more: whether it is annual or lifetime, the date it was bought, and the date it ends. Purchase tokens, order identifiers and anything else Google returns are read to confirm the purchase and then discarded rather than written to disk.
Uninstalling THUGLIST deletes all of it. There is no copy of anything above anywhere else — none of it is uploaded, with or without an account.
The one exception is the account itself, if you make one. Section 4 says exactly what that consists of, and you can delete it from inside the app.
4. What leaves your phone
This is the complete list.
- Buying or restoring Pro. THUGLIST uses Google Play Billing. When you buy Pro, or when the app asks Google whether you already own it, the app talks to Google Play. Google handles the payment and the receipt; your payment details are given to Google, never to us, and never pass through THUGLIST. Google’s handling of that transaction is governed by the Google Privacy Policy.
- Links you tap. The “Privacy policy” button opens this page in your browser. Once your browser has it, your browser’s own terms apply.
- Creating or using an account, if you choose to. An account is optional and the app is complete without one. If you create one, your email address is sent to and stored by Supabase, the authentication provider we use, so that it can recognise you next time. If you sign in with Google rather than an email and password, Google tells Supabase the basic sign-in profile it returns, which includes your email address; we ask Google for nothing beyond that. Apart from the trial fingerprint below, this is the only reason we hold anything about you at all.
- Starting the free trial, if you do. The 14-day Pro trial starts when you sign in with Google. So that it runs once per Google account, we store a one-way fingerprint (a SHA-256 hash) of your Google account’s id, with the date you started the trial. It holds no name, email address or task. We keep it after you delete your account; otherwise deleting the account and signing in again would start the trial over.
- Sync, if you turn it on. Sync is off until you sign in, choose a passphrase and tap Sync now. From then on the app sends a copy of your list, notes, record and settings to Supabase, the same provider that holds your account, and refreshes that copy each time you come back to the app. Before it leaves your phone the copy is sealed with a key derived from your passphrase; the passphrase itself is never sent, so neither Supabase nor we can read the copy, and losing the passphrase makes it unreadable to everyone, including you. The copy exists so that another phone or the web app, signed into the same account with the same passphrase, can open your list. Deleting your account deletes the copy with it.
Nothing else. Your list, your notes, your record and your settings are not sent anywhere unless you turned on sync, and then only as the sealed copy described in point 3.
What an account consists of. An email address, which sign-in method you used, and the timestamps the authentication system keeps for it. That is the whole of it. Deleting the account removes it — see section 7.
THUGLIST holds Android’s INTERNET permission, which is what makes point 1 possible and is required by the framework the app is built on. Holding it is not the same as using it: in the released app, points 1 and 3 are the only things that do. It also holds ACCESS_NETWORK_STATE, added by that same framework so it can tell whether a connection exists; it reports nothing about you and reaches no network itself.
5. Every permission the app can ask for, and why
Each of these is used only on your device, only for the feature named, and each one is optional — the app explains what it needs before sending you to Android’s settings, and you can refuse or later revoke any of them.
Reminders and deadlines
- Notifications — to tell you a deadline is coming or has passed.
- Exact alarms — so a reminder arrives at the minute you set rather than whenever Android next feels like it.
- Full-screen notifications, wake screen, keep awake — only if you switch on deadline takeover, which lets a deadline ring through like an incoming call so it cannot be dismissed without being seen. Off by default.
- Restart notice — so reminders you already set survive a reboot.
- Vibration and app badge — the ordinary ways a reminder announces itself.
Focus sessions
- Usage access — during a focus session you started, THUGLIST checks which app is currently in front, so it can show the block screen when it is one you chose to block. It is read in the moment and acted on immediately. No history of what you used is written down, and none of it is sent anywhere.
- Display over other apps — to draw that block screen on top of the blocked app.
- Do Not Disturb access — to silence other notifications for the length of a session, if you turn that on.
- Foreground service (special use) — so a running session keeps working when THUGLIST is not the app in front. It runs only for a session you started, it shows a notification the whole time, and you can end it whenever you want.
Choosing which apps to block
THUGLIST shows you a list of apps to pick from. It deliberately does not request QUERY_ALL_PACKAGES, the permission that would let it enumerate everything installed. It asks Android only for apps that have a launcher icon — the ones already visible in your app drawer — and it uses that list for the picker and nothing else.
Locking the app
- Fingerprint or face — if you turn on biometric lock. Android performs the check; THUGLIST is told only whether it succeeded. Your fingerprint and face data never reach the app, and cannot.
Screen protection
- Screen-capture detection — THUGLIST can mark its own screens as protected, so your list and your proof notes are kept out of screenshots and out of the recent-apps preview. The component providing this registers a screen-capture observer when the app starts, which Android requires this permission for; it is granted automatically, with no prompt. THUGLIST does not act on the signal and never reads the contents of a screenshot — it deliberately does not request the photo permission that would let it.
Billing
- Google Play billing — required to sell Pro through Google Play.
One permission that is declared but never granted
The app declares WRITE_SECURE_SETTINGS. Android never grants this to an app from the Play Store; it exists so that a technical user who wants the optional greyscale and Wi-Fi cut-off during focus sessions can grant it deliberately over USB. If you do not do that, it is inert.
6. What we never do
- We do not sell, rent or trade your personal data, and we never have.
- We collect nothing from you unless you create an account, and then only the email address described in section 4. Your list, your notes and your record are never transmitted, with or without an account.
- We do not use analytics, crash reporting, advertising or tracking libraries. There are none in the app.
- We do not build a profile of you, and there is no advertising identifier in the app.
- We do not read your contacts, messages, call log, location, camera, microphone, photos or files. The app requests no permission that would let it.
- We do not keep a history of which apps you open. Usage access is read live during a session and never recorded.
7. What you can do
- Export (Pro) — the app can write a copy of your data to a file you control. It contains your notes and proof notes, so keep it somewhere private.
- Delete everything, without uninstalling — the Control screen has a reset that erases the local data.
- Uninstall — removes the app and everything it stored on the phone. If you made an account, uninstalling does not delete it; use the control below first.
- Delete your account — if you made one, Settings → Plan, data and account → Delete my account removes the account and the email address it holds. Two taps, and it cannot be undone. Nothing on your phone is touched: your list stays exactly where it is. If you can no longer reach the app, request deletion here.
- Revoke any permission — in Android Settings, at any time. Features that need one will say so and stop rather than work around it.
- Purchases — refunds, subscription management and cancellation are handled by Google Play, in the Play Store app or at play.google.com. We cannot cancel or refund a Play subscription on your behalf.
8. Security
Your data sits in app-private storage that Android isolates from other apps. Encryption keys are held by the Android Keystore, which is backed by hardware on most modern phones. You can add a biometric lock so the app requires your fingerprint or face when it returns to the foreground, and the app can mark its own screens as protected so they are excluded from screenshots and the recent-apps preview.
No system is perfect. A device that is rooted, compromised, or unlocked and in someone else’s hands is outside what any app can defend against.
9. Children
THUGLIST is intended for adults and is listed for users aged 18 and over. It is not directed at children, and we do not knowingly collect anything from a child. We ask for no personal information from anyone at all, except the email address of a person who chooses to create an account.
10. Your rights
Your list and your record. These are stored only on your own device and we hold no copy, so the usual rights resolve immediately and without going through us: the data is already in your possession on your device, you can read it there at any time, and you can delete it yourself with the in-app reset or by uninstalling. We cannot produce, correct or delete this data on request, because we do not have it.
Your account, if you have one. This we do hold, and here the ordinary rights apply in the ordinary way. The email address on it is shown to you in the app, you can delete the account yourself at any time from Settings → Plan, data and account, and you can ask us to delete it through the grievance contact in section 11 or the form at /delete-account. Deletion is immediate and permanent; we keep no archive copy. The one thing kept is the free-trial fingerprint described in section 4.
This applies equally under India’s Digital Personal Data Protection Act, 2023, the EU and UK GDPR, and the California Consumer Privacy Act. We are not a data fiduciary or controller of your THUGLIST content, because that content never reaches us in a readable form: with sync off it never leaves your phone, and with sync on we hold only a sealed copy we cannot open; we are one in respect of an account email address, for as long as that account exists. Purchase records are held by Google as part of the transaction, and requests about those go to Google.
Sync is opt-in. It stays off until you sign in, choose a passphrase and tap Sync now, so nothing of your list leaves your device without that choice; turning it on is your consent to the sealed copy described in section 4, and you can delete that copy at any time by deleting the account.
11. Grievance contact
For any question, complaint or concern about privacy, including a grievance under the Digital Personal Data Protection Act, 2023:
Grievance Officer, Zelicra Technologies Private Limited
Email: hello@zelicra.com
We aim to acknowledge within 72 hours and to resolve within 30 days.
12. Changes to this policy
If this policy changes, the new version is published at this address and the effective date at the top changes with it. Material changes — in particular any change to what leaves your device — will be announced in the app before the version that makes the change is released.
13. Contact
Zelicra Technologies Private Limited
Email: hello@zelicra.com
Web: zelicra.com