Privacy Policy

Effective date: October 27, 2026.

Read about local lists, Pro AI Create, ChatGPT handoffs, advertising, or your choices. See also the Terms of Service.

1. Who this policy covers

Lew Labs Apps LLC, an Arizona limited liability company operating as Lew Labs Apps (“we,” “us,” or “our”), provides Simple Checklist for Android. This policy covers its Free features, optional Pro AI features, connected ChatGPT checklist handoff service, and informational website at lewlabsapps.com. It does not replace the policies of ChatGPT, Google Play, or other services you use. Simple Family Games has its own privacy policy.

2. Checklists stored on your device

List names, items, checked states, order, settings, and widget assignments are normally stored locally on your device. You can make and use core checklists without a Lew Labs account. Ordinary checklist use does not send your lists to the Simple Checklist backend. Android backup and restore settings on your device may affect copies of local app data.

3. Voice add, sharing, and widgets

Free voice add uses your device's speech-recognition service. Depending on the Android device and speech provider, that service may process speech remotely under its own privacy practices. This is separate from the Pro Describe a List feature below.

When you share a list, your device sends it to the app or destination you choose. Importing a list creates a local copy after you confirm. Widgets show selected local list information on your home screen; reassigning a widget changes its local selection.

In-app training and tutorial content is local to the app and does not make AI or network requests.

4. Optional Pro AI Create

AI Create is optional. It uses the Simple Checklist backend and OpenAI to process content you deliberately submit. These features require an internet connection. AI-generated items are shown for review, editing, and selection before you save them to a new list or add them to an existing list.

Scan a List

You take a photo or choose one from your device. The selected image is sent securely through the Simple Checklist backend to OpenAI to recognize handwritten or printed list content. You can review and edit the resulting items before saving.

Describe a List

You may hold to record and release when finished, or type instead. A recording you choose to make is kept temporarily in app-private cache and sent securely through the Simple Checklist backend to OpenAI for transcription. The temporary AAC/M4A recording is cleaned up when the active flow ends, including after success, cancellation, or an error. You can review and edit the transcript. Only when you select Make My List is that text used for AI checklist generation. You then review the generated items before saving them.

Avoid including sensitive information in a photo, recording, or typed description unless you want it processed for your list.

These requests are processed through our backend hosted on Google Cloud. The backend is not a cloud copy of your checklists. Scan and Describe use OpenAI; they are different from the handoff encoder below. We do not claim that provider processing or security records have zero retention. OpenAI and Google Cloud apply their own relevant processing and retention practices. Scan and list-generation requests disable stored Responses application state, but that does not disable all provider safety records. OpenAI documents default abuse-monitoring retention of up to 30 days, with legal and safety exceptions, and endpoint-specific rules for audio transcription. See OpenAI API data controls; this is separate from ChatGPT conversation retention. We do not claim an approved Zero Data Retention arrangement.

5. Works with ChatGPT handoffs

When you ask a connected Simple Checklist plugin to prepare a handoff, ChatGPT sends the selected checklist items and any suggested title or destination name to the separate Lew Labs MCP service. That service temporarily validates the input and encodes a link. It does not call an AI inference provider, maintain a checklist database or history, create a Simple Checklist account, read existing lists from your device, or synchronize devices.

Checklist content is processed in memory for the request, not saved as a checklist on our server or included in normal application logs. Firebase Hosting routes the MCP hostname to Cloud Run. Firebase Hosting request-log export to our Cloud Logging project is disabled, and the service-specific Cloud Run request-log exclusion is enabled. These settings do not disable provider-side processing or all operational and security records. Google states that Firebase Hosting retains IP data for a few months for abuse detection and usage analysis; see Firebase privacy information. This is not a promise that cloud providers retain no technical metadata. ChatGPT and hosting providers process information under their own terms and retention practices. ChatGPT may retain relevant conversation context. This handoff is distinct from Scan and Describe processing above.

The resulting link contains Base64URL-encoded JSON. Encoding is not encryption: anyone with the complete link may decode its checklist content. Copies may remain in chats, messages, the clipboard or device/browser history. The fragment after # is not sent in a normal HTTP request to the fallback website, but the content was already sent to the MCP encoder. Handoff links do not expire. There is no server-side import token to expire or revoke; deleting a local list does not remove copies of its handoff link. Reopening a link requires fresh approval and approving it again may add duplicate items.

The app checks any suggested destination against local lists, without sending those local names back to ChatGPT or the handoff service. You review and explicitly approve an import. You can edit the suggestions, select another destination or cancel without changing lists. An “add to my list” request prepares proposed new items; the service cannot inspect, edit, delete or check off your existing items remotely. The link does not prove who authored its contents.

The approved product policy is a Free ChatGPT handoff, separate from Pro AI subscriptions. The encoder consumes no Scan, Describe or transcription quota and requires no Simple Checklist account. ChatGPT's own access and usage rules still apply.

The Simple Checklist ChatGPT plugin is currently in private testing and has not yet been publicly listed. Its public availability is subject to OpenAI review and publication.

Do not include credentials or unnecessary sensitive information in a handoff. Share complete links only with intended recipients. You can avoid the plugin, decline to share content, cancel an import, and manage local lists in the app. Contact us below with privacy questions; avoid sending complete private links to support.

6. Voluntary AI result reports

If you report an AI result, the report may include a bounded portion of the AI-generated result text, the reason you select, an optional comment, app version, report or request metadata, and timestamps. The original Scan photo and voice recording are not attached to these reports. We use reports to review safety and quality. Reports are configured with server-created 30-day time-to-live (TTL) eligibility. Firestore deletes expired reports asynchronously, so deletion may occur after that date.

7. Advertising and Pro

Free users may see Google AdMob banner ads. Google and its advertising partners may process information such as device identifiers, IP address, approximate location inferred from IP address, ad interactions, diagnostics, and consent choices to serve and measure ads where allowed. The app uses Google's consent tooling where required. Pro users have an ad-free experience. Ad processing is separate from your locally stored list content.

8. Service providers and technical data

OpenAI processes content submitted to optional AI features under its applicable terms and policies, including its own processing and retention practices. Google AdMob and its consent tooling support Free-user advertising. The Simple Checklist backend and its cloud infrastructure handle optional AI requests and may process basic technical information needed to provide and secure the service, such as request IDs, timestamps, and network data. Android, Google Play, device speech services, and hosting providers may also process technical data under their own policies. We do not use ordinary checklist contents for advertising.

Google Cloud Run hosts the separate handoff encoder and AI backend. Google Firestore supports temporary closed-test authorization and abuse-control records, and the voluntary AI reports described above; it is not a synchronized checklist database. Closed-test access verification uses Google Play Integrity information about the app, its Play licensing and device integrity. Temporary challenges, sessions and counters have expiration controls; scheduled storage cleanup is asynchronous. These records are not permanent user accounts and do not contain your ordinary local lists.

The static website is hosted through GitHub Pages. Support or privacy email includes the address and information you choose to send and is processed through Google Workspace Gmail to deliver and handle your request. The owner of Lew Labs Apps LLC personally monitors support, privacy/deletion, and security/abuse correspondence; no other company staff currently handle it. Send only the information needed for your question. Lew Labs Apps LLC has adopted the manual correspondence retention and privacy-request procedure below.

Correspondence retention

No automated deletion has been configured; the owner follows the manual procedure below.

Our retention practice is to remove routine support correspondence from our active mailbox and owner-controlled working copies no later than 90 days after the case closes. For privacy or security cases, we retain only the information necessary to document the request, response and resolution for 12 months after closure. We keep unresolved cases until they are resolved and remove unnecessary attachments, private links and other sensitive content sooner when no longer needed.

The owner reviews eligible records manually each week. Necessary records subject to an applicable legal hold, legal obligation or ongoing investigation are kept for that purpose, with the reason and review date recorded, then deleted when the exception ends and the normal retention period has passed. Business and tax records have separate retention requirements; these periods are not a reason to keep every support message as a business record.

These periods govern records we control. Deleting mail does not immediately erase every copy held by a provider: Gmail Trash, administrator recovery, backups and any applicable retention or hold rules can retain information for additional periods. We cannot delete copies in another person's mailbox. The same distinction applies to independent provider security records and information you shared with other services.

9. Your choices and deletion

You can use core checklists without AI Create, choose whether to submit a photo or recording, type instead of recording, review AI output before saving, and choose whether to report a result. You can delete individual lists and items from the active checklist collection in the app. The app keeps a previous local recovery snapshot, and older migrated data may remain in local storage; ordinary list deletion is not a secure erase of all local copies. Android backup, exported .sclist files and copies you shared are separate. Device-level removal of app storage is destructive and is not required to make a privacy request; back up anything you want to keep before using device controls. We cannot access or delete your local lists remotely.

For a ChatGPT handoff, you can decline the connected tool, cancel review or delete imported items locally. We cannot revoke a content-bearing link or erase copies held in another service. Manage your conversation history with ChatGPT and consult that provider's controls. Contact our privacy address for questions about information you deliberately sent to us; do not send credentials or unrelated private lists.

Privacy questions and deletion requests

Contact privacy@lewlabsapps.com to ask about or request deletion of information you deliberately sent to Lew Labs Apps LLC. State that your request concerns Simple Checklist and describe the records concerned, such as support correspondence or an AI result report. A report ID and approximate date can help if available. Do not send passwords, API keys, Play Integrity or session tokens, recordings, photos, full private handoff links or unrelated lists.

The owner will assess the request, ask only for information reasonably needed to locate the records and verify your authority, and explain the result and any applicable limits. Where records can be identified and deletion is appropriate, this may include correspondence, owner-controlled copies and identifiable AI result reports. If processing by a service provider is involved, we will use the available provider request process where applicable. We will explain any necessary legal or security retention and respond within applicable requirements. This is not a promise that all provider records can be located by email or erased immediately.

There is no Simple Checklist account to delete and no stored MCP checklist history to search. Temporary authorization records are not an email-indexed user profile. Deleting a local list does not remove exported files, Android backups, shared links or ChatGPT conversations. Use the relevant device or provider controls for those copies. The correspondence schedule above includes a minimal record of a privacy request and its resolution.

10. Children, security, and data sales

Simple Checklist is a general-purpose utility and is not directed specifically to children under 13. We use secure transmission for optional AI requests and take reasonable steps to protect the information we handle, though no system can guarantee complete security. Lew Labs Apps does not sell personal information.

The deployed handoff service uses HTTPS, bounded input validation, request timeouts and rate limits. Normal handoff application logs contain fixed operation labels and status codes, not checklist text or encoded links. AI-backend logging is configured to redact content and credentials. These safeguards do not make a complete handoff link confidential or guarantee uninterrupted service.

11. This website and policy changes

This website is a static information site without account sign-in or a contact form. Its hosting provider may process standard request information to deliver pages. If app features or data practices change, we will update this policy and its date here.

12. Contact

Privacy: privacy@lewlabsapps.com
Support: support@lewlabsapps.com