Skip to content
Quitlist
Start free

Effective October 2, 2026

Privacy Policy

Quitlist is operated by Pack6 LLC ("we", "us"). This policy explains what we collect when you use Quitlist, why, who we share it with, and the choices you have.

1. What we collect

Account detailsYour Google account email address and Google account ID
Signing you in and contacting you about your account
Mailbox accessThe address of each mailbox you connect and an access token from your email provider
Reading your mailbox when you ask for a scan. The token is encrypted at rest.
Email headersSender, recipient, subject, date and your provider's sender check on account-related messages
Finding the services you have accounts with. We never request message bodies or attachments.
Your account listThe services found, references to the messages that point to them, your decisions and cleanup progress
Showing your list and helping you close the accounts you choose
Other sources you addSites and usernames from a password-manager export, and the results of a breach lookup
Adding accounts your inbox doesn't show. Passwords and notes in an export are never read and never leave your device.
Purchase recordsProduct, price, status, dates and a link to your receipt
Unlocking the passes you buy. Our payment provider handles card details; we never see them.
Technical dataIP address, browser type and request logs kept by our hosting provider
Running, securing and troubleshooting the service

We collect only what the service needs. We do not buy data about you from third parties.

2. Google user data

When you connect a Gmail mailbox, you grant Quitlist read-only access through Google. Quitlist asks Google only for the headers listed above, skips Spam and Trash, and cannot send, change or delete your email.

Quitlist's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Gmail data only to show you the accounts found in your mailbox and to help you close them.
  • We do not sell it, use it for advertising, or use it to train general artificial intelligence or machine learning models.
  • We do not transfer it to others except as needed to provide the service, to comply with law, or as part of a merger or acquisition with notice to you.
  • No person at Pack6 LLC reads it unless you ask us to, it is needed for security or to investigate abuse, or the law requires it.

3. How we use your data

We use your data to provide Quitlist: signing you in, scanning the mailboxes you connect, building your account list, showing deletion guides and drafts, recording your progress, and processing purchases. We also use it to keep the service secure and working.

We do not use your data for advertising and we do not sell it. Your account list is visible only to you. Each person's data is kept separate in the database itself, not only in application code.

If you choose to share how a cleanup turned out, we record only the service and the outcome, without your identity, and show combined results to other users.

4. Who we share it with

We share data only with the providers needed to run Quitlist, and each may use it only to provide their service to us:

  • Hosting and database providers store and serve the app.
  • Google provides sign-in and Gmail access.
  • Lemon Squeezy is the merchant of record for purchases. It processes your payment and keeps its own records under its own privacy policy.
  • Have I Been Pwned receives your email address only if you run a breach lookup.
  • Icon services (Google and DuckDuckGo) receive a service's web domain when we fetch its logo. Our server makes the request, so they don't learn who you are.

Otherwise we disclose data only when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition. In that case this policy continues to apply and we will tell you about the change.

5. How we protect it

All traffic to Quitlist is encrypted in transit. Mailbox access tokens are encrypted at rest with a key kept separately from the database. Database rules keep each person's data apart, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.

6. How long we keep it

  • Disconnecting a mailbox deletes its stored access token straight away. You can also remove Quitlist's access in your Google account permissions.
  • Deleting your account list in Settings removes your scan history, findings and cleanup cases.
  • Deleting your Quitlist account removes your account, mailboxes, findings and purchase records from our database. Lemon Squeezy keeps its own receipts as the law requires.

Otherwise we keep your data while your account exists. Deleted data leaves our backups as they expire, within 30 days.

7. Your rights

You can export your list, evidence and cleanup history, disconnect any mailbox, and delete your data or your whole account from Settings. Depending on where you live, including under the GDPR and the CCPA, you may also have the right to access, correct, delete or port your data, to object to or restrict how we process it, and to complain to a data protection authority. We do not sell or share personal information for cross-context behavioral advertising.

To exercise a right we haven't built into the app, email us at the address below. We will respond within the time your local law requires.

8. Cookies

Quitlist uses only the cookies it needs to work: they keep you signed in, protect the Google sign-in and mailbox connection steps, and remember where a scan stopped so it can resume. We do not use analytics, advertising or cross-site tracking cookies.

9. International transfers

Our providers may process your data in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

10. Children

Quitlist is not meant for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. Changes and contact

If we make material changes to this policy, we will tell you by email or in the app before they take effect. The date at the top always shows the current version. Read this policy together with our Terms of Service.

Pack6 LLC · Privacy questions and data requests: support@quitlist.app