Privacy policy

Effective October 23, 2026 · applies to this website, the ShortList waitlist and the trial app

What we collect

If you join the waitlist, we collect the name and email address you enter. If you use the ShortList trial app, we also hold what you put into it: your account (name and email), the allergen profile you build (patch-test results and cross-reactors), any patch-test sheets and product label photos you upload, your product lists and routine, and feedback messages you send us. Browsing this site requires no account.

If you ask for your allergen list on our home page, we also receive the allergens you pick. We use them only to build your list and email it to the address you entered, once, and we don’t keep them. We keep only the counts (how many allergens, other names and cross-reactors your list had) next to your waitlist entry, for one follow-up email about our service. The allergens you pick while browsing the tool stay in your browser until you ask for the list.

Cookies and advertising measurement

Our home page uses the Reddit Pixel to measure whether our Reddit ads bring visitors here. The pixel sets a cookie in your browser and tells Reddit about your visit — such as the page you viewed, your browser, and your IP address — and that you clicked Sign up or asked for your allergen list by email, if you did. If you use the allergen list tool, the pixel and our Google Ads tag are also told that you picked an allergen and saw a result. They are never told which allergens. Reddit processes that information under its own privacy policy. You can block this cookie in your browser settings or turn off ad personalisation in your Reddit account settings.

This site also keeps its own visitor ID: a random code stored in your browser's storage, which only we use. With it we record which of our links brought you here, the website you came from, Reddit's ad click ID if you came from a Reddit ad, and whether you used the allergen list tool or clicked Sign up. If you ask for your allergen list by email or create an account, we link that visit to your waitlist entry or account, so we can see which links bring people who sign up. When you finish creating an account after a Reddit ad, we tell Reddit an account was made using only its ad click ID — never your name, email address, allergens or IP address. Deleting your account or your waitlist entry deletes this history.

How we use your name and email

Your name and email are used for one purpose: to email you about ShortList — your invite when the app is ready, and occasional updates on its progress. Every email includes a way to opt out.

What we never do

We never sell, rent, trade, or disclose your personal information to third parties for marketing, advertising, or any use of their own. We build no advertising profiles from your data. (Reddit receives only what's described above; it never receives your waitlist entry, name or email address.)

Service providers

Like most websites, we rely on a small number of providers to operate. We store your name and email to send your invite, and delete them on request. These providers handle data as described here:

• Amazon Web Services hosts the ShortList app and its data, runs sign-in (Amazon Cognito), and sends our emails (Amazon SES).
• Anthropic reads the patch-test sheets and product label photos you upload, so ShortList can pull out the allergen and ingredient lists. It also receives the names of your known allergens to suggest possible related allergens (cross-reactors). This data is sent only for those purposes. Uploaded sheets are sent as they are, so anything printed on them (such as your name) is included.
• Product databases receive the product names and barcodes you search for, so ShortList can look up ingredients. Your allergen profile is never sent to them.
• PostHog records how people use the ShortList app during the trial, as described under "Session recordings (PostHog)".
• Reddit measures visits and sign-ups from our ads, and is told when an account is made after a Reddit ad, as described under "Cookies and advertising measurement".
• Google Fonts serves this site's typefaces, so your browser sends Google a standard font request (which includes your IP address) when the page loads.

Session recordings (PostHog)

During the trial, ShortList records how people use the app — clicks, scrolling, and which screens they visit — using PostHog, so we can find where people get stuck. Your name, your allergens and cross-reactors, anything you type, and all images and uploaded files are hidden in these recordings. We can see the app's own screens, buttons and the products you add, so we can tell where people get stuck. Recordings are linked only to an account number, not to your name or email, and are never made on admin pages. PostHog also receives your device and browser type, your IP address, and which app pages you visit (page addresses carry no health details). Recordings are kept for a limited time set by our PostHog plan, and we delete your recordings when you ask us to delete your account.

Keeping and deleting your data

We keep waitlist entries only as long as the waitlist exists. To be removed, reply to any email we send you and ask — we'll delete your entry, along with the visit history linked to it, and confirm it's gone.

Where the app keeps your data

Everything the trial app holds for you (listed under "What we collect") is stored with Amazon Web Services in the United States (us-west-2) and encrypted. It is used only to run ShortList for you, never sold, and never shared for anyone else's use. We delete it when you ask us to delete your account. A full policy covering the app will be published before launch, and the commitment above carries over unchanged.

Changes to this policy

If this policy changes, we'll update this page and its effective date; if a change affects how your data is handled, we'll email the waitlist first. Questions? Reply to any email we send you.