Privacy Policy

Introduction

Punch Drunk Productions, LLC, dba Endlist, a Washington limited liability company ("Company," "we," or "us") respects your privacy and is committed to protecting it through our compliance with this policy.

This policy describes the types of information we may collect from you, or that you may provide, when you visit endlist.work (the "Website") and when you use the Endlist application at my.endlist.work (the "Service"), and our practices for collecting, using, maintaining, protecting, and disclosing that information.

It does not apply to information collected by:

• Us offline or through any other means, including any other website operated by the Company or any third party; or
• Any third party, including through any application or content that may link to or be accessible from the Website or the Service.

Please read this policy carefully. If you do not agree with our policies and practices, your choice is not to use the Website or the Service. This policy may change from time to time; your continued use after we make changes is deemed acceptance of those changes.

This Website Collects Nothing

endlist.work is a static marketing site. It has no forms, no accounts, no shopping cart, and no login. It sets no cookies, runs no analytics or advertising scripts, and has no server-side code or database of its own. We do not know who visits it.

The Website also makes no requests to anyone else. Its fonts, styles, and the single small script that opens the mobile menu are all served from endlist.work itself. There is no content delivery network, no hosted font service, no embedded video, no social widget, and no tracking pixel. Loading this page tells no third party that you were here.

Everything else described in this policy applies to the Service at my.endlist.work, which does have accounts and does store your data.

Children Under the Age of 18

Our Website and Service are not intended for children under 18 years of age. No one under 18 may provide any personal information to us. We do not knowingly collect personal information from children under 18. If we learn we have collected personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have information from or about a child under 18, please contact us at hello@endlist.work.

Information You Provide to Us

• Waitlist requests and invitations. If you join the waitlist, you provide your email address, and optionally a name. This is handled by Clerk, our authentication provider, and is used to contact you about access to the Service. If you use an invite code, you provide the email address the invitation is sent to, and we record that the code was used on your account.
• Account information. When you have an account, we store the email address, name, time zone, and profile information associated with your sign-in method, including where you sign in with Google.
• Content you create. The cards, notes, checklists, tags, dates, files, and pictures you put into the Service. This includes emails you send or forward into your account, text messages you send to it, web pages you save to it, and anything you send us through in-app feedback, which may include a screenshot. This is your material; we store and process it in order to operate the Service for you.
• Connection details. If you link a mobile number, we store that number so texts from it can reach your account. If you add your own Anthropic API key or connect Google Calendar, we store that key or connection token encrypted by the Service itself.
• Correspondence. Records and copies of your correspondence with us, including email addresses, if you contact us.

Information We Collect Automatically

As you use the Service, we may collect certain information about your equipment, browsing actions, and usage patterns, including details of your visits, traffic and log data, IP address, operating system, and browser type. The Service uses cookies and similar technologies as required for authentication and session handling. You may refuse browser cookies through your browser settings, but parts of the Service will not function if you do.

How We Use Your Information

• To present the Website and Service to you and operate their features.
• To create, authenticate, and secure your account.
• To store, organize, sort, and surface the content you create.
• To provide the automated organization features described on our Website, such as sorting your list by date and composing your digest, and, if you have them on, the optional AI features described below.
• To notify you about your account, or about changes to the Service.
• To respond to your inquiries and provide support.
• To carry out our obligations and enforce our rights.
• For any other purpose with your consent.

Automated Processing and the AI Layer

Endlist's AI features, called AI Helpers, are optional. The Service works fully without them. They run only on an account that has AI, either because you added your own Anthropic API key or because your account includes Endlist's AI, and you can turn them off, all together or one at a time, in Settings → AI Helpers. When they are off, none of your content is sent to an AI provider.

When they are on, the content needed for each feature is sent to an AI provider for processing: the text of what you capture, so it can be read into a card; card titles, notes, tags, and dates, to write your morning digest, to add a tag you already use or a rough week to cards you have not filed, and to suggest a stack for a card in your Inbox; a link card's page text, when you ask for a summary; a stack's cards, when you ask for a stack summary; and the contents of a Notion export, if you import one.

If you use your own Anthropic API key, your content goes only to Anthropic, under that key. On Endlist's AI, most features use Anthropic, and some use the other AI providers named under Service Providers.

Separately, if you ask a question in the Service's built-in Help, your question and the relevant pages of Endlist's guide are sent to an AI provider to write the answer, whether or not AI Helpers is on. Nothing else from your account is sent with it.

This processing exists to operate the Service for you. We do not sell your content, and we do not use it to train AI models.

The Endlist Chrome Extension

Endlist offers an optional extension for Google Chrome (and browsers that run Chrome's extensions) that saves a web page into your Endlist account. It does only what you ask it to, when you ask:

• What it sends, and when. When you press the Endlist button and choose where to save, or choose "Save link to Endlist" or "Save selection to Endlist" from the right-click menu, the extension sends that one page's address and title, and any words you highlighted on it, to the Service. On a Reddit post it also sends that post's words and the addresses of its pictures, read in your browser, and the Service copies those pictures into your account. It sends nothing at any other time.
• What it never does. It does not read pages you don't save, does not record your browsing history, and has no access to any website until you press its button, and then only to the tab in front of you. It runs no advertising or analytics and contains no code fetched from anywhere else.
• Signing in. You connect the extension to your account through Endlist's own sign-in and Allow page. The extension keeps the resulting sign-in tokens in your browser's extension storage, and sends them only to my.endlist.work. You can disconnect it at any time in Settings → Connections, which stops it at once; removing the extension from Chrome deletes its stored tokens.
• What happens to a saved page. It becomes a card in your account, like anything else you capture, and is treated as content you create under this policy. To fill the card in, the Service reads the page's public text through the page-reading service named under Service Providers, exactly as it does for a link you share from your phone.
• Not sold, not used for anything else. Information the extension sends is used only to save the page into your account. We do not sell it, transfer it to anyone for any other purpose, use it for advertising, or use it to determine creditworthiness.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Text Messages

You can add notes to Endlist by text message. It works only from a mobile number you link to your own account:

• Linking your number. In Settings → Capture, the Service shows you a one-time code. You link your number by texting that code to Endlist's number from your phone. Nothing is linked any other way.
• What happens to a text. Each text you send from your linked number becomes a card in your own account. Photos you send come along as attachments on that card. Texts from numbers that are not linked to an account are discarded and never answered.
• What we send. Endlist only ever replies to a text you just sent, at most one reply per text: a confirmation when your number is linked, a short note that a text was saved or could not be saved (you can turn these off in Settings), and the HELP and STOP responses. Endlist never starts a conversation and never sends marketing or promotional texts. Message frequency varies with your use; message and data rates may apply. Every message is listed on our text messages page.
• Stopping. Remove your number in Settings → Capture, and texts from it no longer reach your account. Cards already made from your texts stay in your account until you delete them.
• Who carries the texts. Texts reach Endlist through Twilio, our messaging provider, which receives your number, your message, and any photos in order to deliver them to the Service.

Mobile numbers and SMS opt-in data and consent are not shared with or sold to third parties or affiliates for marketing or promotional purposes.

Connecting Claude

You can connect Claude, Anthropic's AI assistant, to your Endlist account through Endlist's connector. You start the connection yourself, from Claude, and approve it on Endlist's own Allow page. While it is connected, Claude can read and change your own cards: search and read them, create cards, add notes, and rename, move, date, tag, mark urgent, complete, or archive them. It can reach only your account, and only while it is connected. Changes Claude makes are marked "through Claude" in each card's Activity. The same applies to any other AI app you connect to Endlist this way.

You can end the connection at any time with Disconnect in Settings → Connections. Claude's access ends immediately: its next request is refused.

When you connect Claude, Anthropic is a provider you chose, under your own agreement with Anthropic. It is not acting as Endlist's service provider, and what Claude does with what it reads is governed by Anthropic's terms and privacy policy, not this one.

Service Providers

We use third-party service providers to operate the Service. Each processes information only as needed to provide its service to us, and every one of them is reached by the Service, not by this Website.

• Clerk (account authentication, sign-in, invitations, and the waitlist).
• Railway (application hosting and database).
• Cloudflare (storage for your files and pictures, network delivery and protection for the Service, and bot protection at sign-in).
• SendGrid (sending the Service's emails, such as invitations and account notices). Email sent to your capture address is received through Cloudflare or SendGrid.
• Anthropic (the optional AI features described above, and answers to questions asked in Help).
• OpenRouter (reading what you capture into a card, on Endlist's AI only; OpenRouter passes the text to a Google AI model with data retention turned off).
• TypeSafe AI (choosing a tag, rough week, or stack for a card from the ones you already use, on Endlist's AI only).
• Jina AI (reading the text of a web page you save or share). To fill in a saved link, the Service may also ask the site the link points to, or that site's public preview service, for the page's title and picture.
• Twilio (receiving the text messages you send to Endlist).
• Google (Google sign-in, through Clerk; and Google Calendar, only if you connect it, in which case the Service reads your calendar and, if you allow it, adds your cards' titles and dates to it).
• Basecamp (receiving the feedback you send from inside the Service, including any screenshot and basic details about your browser; and, only if you connect a Basecamp account, keeping cards in sync with it).
• OpenStreetMap's Nominatim, the U.S. National Weather Service, and MET Norway (finding your place and its weather, only if you set a location; they receive the place you type or its coordinates).

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or you provide:

• To our employees, contractors, service providers, and affiliates who need it to operate the Service.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company's assets.
• To the people you choose to share it with. If you share a card with someone, or turn on a public link for it, they (or anyone holding the link) can see that card until you stop sharing it.
• To fulfill the purpose for which you provide it.
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process.
• To enforce or apply our Terms of Use and other agreements.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our users, or others.

We do not sell your personal information.

When We Look at Your Data

Your cards, notes, and files are yours to read, not ours. A person at Endlist opens them in four cases, and no others:

• You ask us to, and then only what you asked about.
• Something is broken and can only be fixed by hand. We open as little as we can.
• Someone reports something illegal and nothing short of looking can settle it. Then we look only at that one thing.
• The law makes us, as described under "Requests from Law Enforcement and Courts."

Nobody at Endlist reads through what you keep. There is no feature in Endlist that lets us sign in as you, and our admin tools show counts, never your cards, notes, files, or the names of your boards and stacks.

Requests from Law Enforcement and Courts

Your data goes to a government or a court only when the law makes us hand it over, such as by subpoena, court order, or warrant, or, very rarely, when someone's life or safety is in immediate danger. Even then, we provide the least the request requires and nothing more.

If that happens, you hear it from us first, unless a court or the law prevents us from telling you, or there is no time because someone is in danger. In that case we tell you as soon as we are free to.

Data Security and Encryption

Endlist can read what you store. That is how search, reminders, and the optional AI features work. We promise not to look except as described in "When We Look at Your Data."

Your data is encrypted on its way to and from Endlist, and our hosting providers encrypt the disks that hold our database and your files. That protects against someone stealing the hardware. It does not protect against someone who gets hold of our passwords, and it is not end-to-end encryption: Endlist, and the companies that host it, are technically able to read your data. Your own Anthropic API key and your Google Calendar connection, if you add them, are additionally encrypted by the Service itself.

The safety and security of your information also depends on you: you are responsible for keeping your sign-in credentials confidential and for any activity under your account.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee its security. Any transmission of personal information is at your own risk.

What We Keep, and for How Long

• Trash. A card you delete stays in Trash for 60 days. Then it and its files are erased.
• Deleting your account. You can delete your account yourself in Settings → Account → Delete my account, and the page offers you a copy of your data first. For 30 days after you ask, you can change your mind by signing in and choosing Keep my account; during that time the account takes no new cards. After 30 days, everything you stored is erased from Endlist: your cards, your files and pictures, your settings and connections, and your sign-in. Our hosting providers' backups roll over on their own schedule, and we cannot pull one account out of a backup, so a copy may remain in a backup for a limited period until it is overwritten.
• Suspended accounts. If we suspend an account, we keep it untouched while it is suspended, and its owner can still download a copy of everything in it.
• When the law requires us to keep something. If we report content to the National Center for Missing & Exploited Children, United States law requires us to keep it, and information about the account it came from, for at least a year. We also keep records when a court or law enforcement properly asks us to preserve them.

Your Choices

You can delete your account yourself, as described above. You may also ask us to correct the personal information associated with your account, or to remove your email address from the waitlist, by contacting us at hello@endlist.work.

Reporting Illegal Content or Abuse

If you see something illegal in the Service, email abuse@endlist.work and say what it is and where it was. Describe it; do not send it. Our rules for acceptable use, and what happens when they are broken, are in our Terms of Use.

Changes to Our Privacy Policy

It is our policy to post any changes we make to this privacy policy on this page. The date it was last revised is identified at the top. You are responsible for periodically checking this policy for changes.

Contact Information

To ask questions or comment about this privacy policy and our privacy practices, contact us at: hello@endlist.work