A-LIST
Shop

Privacy Policy

Version 8 · Effective: October 1, 2026

Company (Controller): Immortal Company Inc., 11273 COLINWARD AVE, LAS VEGAS, NV 89135, USA ("Immortal," "we," "us," or "our")

Contact: privacy@a-list.com

This Privacy Policy explains how we collect, use, disclose, and protect information in connection with A-LIST (the "Service"), a wellness and social application available at a-list.com and via our mobile apps.

Important: A-LIST is not a medical device and does not provide medical advice. A-LIST is intended for adults aged 18 or older. The Android local edition is available internationally, including in the United States, where offered through Google Play. Other features, including telehealth and prescription products, remain subject to their applicable eligibility and geographic restrictions.

Not a contract. This Policy is for transparency and compliance; it does not create contractual rights beyond those required by law. Your use of the Service is governed by our Terms of Use.

Google Calendar

Connecting Google Calendar is optional. After you grant permission, A-LIST reads calendars available to your connected Google account and their events. We use your Google account email, calendar names and identifiers, event identifiers, titles, start and end times, all-day status, and locations. Google's responses may include additional event details; the features described here use the fields listed above.

How we use calendar information

We use this information to display your schedule in A-LIST and help Guardian provide personalized responses and check-ins that take your upcoming schedule into account. Access can continue while you are away from the app until you disconnect or revoke it. The current integration is read-only: A-LIST does not create, edit, or delete events in Google Calendar. A-LIST reminders are separate from your Google Calendar events.

Sharing and AI processing

Relevant calendar information may be processed by our hosting and AI service providers, including the AI providers identified in our detailed privacy policy, solely to deliver these user-facing features on our behalf. Calendar data and information derived from it are not sold, used for advertising, retargeting, or audience profiling, or shared with advertising and attribution partners such as Meta and AppsFlyer.

We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI or machine-learning models, and we do not permit our service providers to do so. These Google-specific restrictions take precedence over broader descriptions of marketing, analytics, sharing, and AI processing elsewhere in this policy.

Protection, retention, and your choices

We encrypt stored Google refresh tokens, use encrypted connections to Google, and require authenticated, account-scoped access to calendar connections. We retain connection credentials while the connection is enabled and cache calendar display data for up to five minutes. Calendar information used by Guardian may also be retained in conversation history, agent memory, and operational records for feature continuity, troubleshooting, and security. Those records follow the retention and deletion practices in the detailed privacy policy.

Disconnecting a Google account in A-LIST removes its stored connection and stops future calendar retrieval; it does not automatically erase information already included in conversations, agent memory, or operational records. You can also revoke A-LIST's permission in your Google Account settings. To request deletion of retained information, contact privacy@a-list.com.

A-LIST's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

1. Scope & Eligibility

This Policy applies to all Services operated by Immortal that link to it.

  • Age 18+. We do not knowingly collect data from individuals under 18.

Android local edition

The following describes the Android local edition. General descriptions elsewhere in this policy of accounts, social features, cloud AI, purchases, and advertising apply only to services that offer them.

Your records and processing

Your journal, health and medication records, profile, and saved photos stay in the app's private storage on your device. This edition has no account, cloud journal sync, social posting, or product checkout. Supported AI, photo, translation, and dictation features process your input on your device. Model and language downloads from providers such as Hugging Face and Google expose connection information, including your IP address and the requested file, but do not upload your journal or the content being processed.

Permissions

With permission, Health Connect supplies steps, active calories, distance, exercise, weight, and mindfulness information for local wellness features; optional background access supports step notifications. The app does not upload these health records or write back to Health Connect. Optional location access supports on-device daylight calculations. App Break reads available app names and identifiers for its app picker and uses accessibility access to identify the foreground app during a break. If you enable website blocking, it checks the supported browser's address. These checks stay on your device; they do not upload app lists or addresses or retain browsing history. You can revoke permissions in Android settings. Revocation does not delete existing Health Connect records or A-LIST routine completions.

Analytics and diagnostics

Mixpanel receives app-opening and onboarding-completion events. Sentry receives crash and error reports with exception messages removed. Google ML Kit processes text and images locally and separately reports technical usage and diagnostic information. Depending on the provider, technical data includes installation identifiers, app/device details, event times, performance and errors, input/output sizes, and language settings. Network requests expose your IP address to their recipients. Google's translation configuration service can also derive your country from your IP address. These services support usage measurement and reliability; the app does not attach journal content, medication names, health measurements, photos, or recordings to its analytics or diagnostic reports. App analytics and crash reporting start automatically; the current edition has no in-app telemetry opt-out. ML Kit initializes when a feature uses it.

Storage, exports, and deletion

Local journal and profile records remain until you delete them or clear the app's storage. The app's Clear local data action removes those records; downloaded models have separate controls. Journal storage is excluded from Android cloud and device-transfer backups. Exports can be protected with a passphrase. Clearing local records does not delete Health Connect records, exported or shared copies, or technical reports already received by providers. Technical-record retention follows Section 11; clearing your journal does not stop analytics or crash reporting. Contact privacy@a-list.com for privacy questions or requests about technical records. Locating those records may require an installation or report identifier; do not send your health journal for that purpose.

2. Notice at Collection (U.S. State Privacy Laws)

Data practices depend on the edition and features you use; see the Android local edition section for that edition's practices.

We collect the following categories of personal information:

Identifiers

Phone number, email, account handle, IP, device identifiers

Sources: You, your device, service providers

Purposes: Authentication, security, analytics, marketing and promotional communications (including via third-party marketing partners)

Disclosure: Service providers, marketing and attribution partners, legal

Account & Profile

Name, bio, photos

Disclosure: May be public depending on settings

User Content

Posts, messages, photos, videos, comments, reactions, follower graph

Disclosure: Public or private depending on feature

Wellness & Health Inputs (Sensitive)

Diet, exercise, supplements, routines, goals

Health Integrations (Sensitive)

Apple HealthKit data (only what you authorize)

Biometric-Adjacent Image Processing (Sensitive)

We may offer features that analyze photos or videos you provide (e.g., skin-related analysis or classification).

Scope of processing

  • Images are processed solely to provide the feature you request
  • Processing may include analysis of visible characteristics such as skin tone or appearance
  • These features are not designed to identify you or verify your identity

No biometric identification

We do not:

  • Use facial recognition
  • Identify individuals across images or sessions
  • Create or store facial templates, faceprints, or biometric identifiers
  • Use images for identity verification

User consent

  • By using these features and submitting images, you provide explicit consent to this processing
  • Use of these features is optional

Retention & deletion

  • Images are retained only as long as necessary to provide the requested feature
  • Many operations are transient (processed and not persistently stored)
  • Stored images are deleted when you delete them, when your account is deleted, or within a reasonable retention period consistent with service operation

No sale or advertising use

  • We do not sell image data
  • We do not use image data for advertising or cross-context behavioral tracking
  • We do not train our own models on your images unless explicitly disclosed and consented to

Third-party processing

Images may be processed by service providers (e.g., AI model providers) solely to provide functionality under our instructions and contractual safeguards.

Compliance statement

To the extent any data processed is considered "biometric information" under applicable law, we:

  • inform you of the purpose and duration of processing
  • obtain consent prior to collection
  • do not retain data longer than necessary to fulfill the disclosed purpose

Geolocation (Sensitive)

GPS (if enabled), IP-based location

Contacts Matching

Hashed (SHA-256) contacts for friend discovery

Internet / Technical Data

Usage events, page URLs and referrers, logs, IP address, browser and device information, and advertising or attribution identifiers

Purposes: Security, analytics, advertising measurement, attribution, and campaign improvement

Disclosure: Service providers and advertising and attribution partners, including Meta and AppsFlyer

Communications

Email, SMS, push notifications, including service and marketing messages

Disclosure: Messaging, attribution, and marketing service providers (e.g., AppsFlyer) to deliver and measure communications

Voice Data (Sensitive)

Audio captured during AI interactions

  • May be processed in real time or via streaming sessions
  • Used to generate transcriptions and responses
  • Not retained beyond what is necessary to provide the feature unless otherwise disclosed

AI Interaction Data

Inputs, outputs, prompts, interaction history, and session metadata

Screen Context Data

Visible UI elements and app state when using AI-powered navigation features (e.g., Guardian)

Authentication Data

Passkeys (FIDO2/WebAuthn), OTP credentials

Subscription & Entitlement Data

StoreKit transaction metadata, subscription status, billing intervals, renewal state, and administrative overrides

Inferences

Content ranking and personalization signals

Sale and sharing for advertising: We do not sell personal information for money. We may disclose identifiers and internet or technical data to advertising and attribution partners to measure, attribute, deliver, and improve our campaigns. Some state privacy laws may define this activity as “selling,” “sharing,” or targeted advertising even when no money is exchanged. A-LIST's website code does not attach wellness or health inputs, medical-intake responses, prescription details, Apple Health data, image data, or patient-account information as custom Meta web-event parameters. Page context collected on public website pages where Meta measurement is enabled is described in Section 10. You may opt out through Your Privacy Choices or a Global Privacy Control signal as described in Section 9.

3. Information We Collect

We collect information directly from you, from your device, and from integrations you authorize.

Includes:

  • Account information
  • User content and media (including DMs)
  • Wellness and health inputs
  • Camera and image data
  • AI interaction data
  • Voice and real-time session data
  • Screen context data
  • Subscription and entitlement data
  • Technical diagnostics

4. Sources of Information

  • You
  • Your device and OS
  • Integrations (e.g., HealthKit)
  • Service providers
  • Public content

5. How We Use Information

We use information to:

  • Operate and authenticate accounts
  • Provide AI-powered features (including real-time voice and Guardian navigation/actions)
  • Process images and media for requested features
  • Provide subscriptions and entitlement access
  • Enable messaging and social features
  • Improve performance, reliability, and product quality
  • Conduct analytics and research
  • Communicate with users, including marketing and promotional messages (via email, SMS, push, and in-app), and deliver, attribute, measure, and improve advertising and those communications with third-party marketing and attribution partners
  • Ensure safety, integrity, and abuse prevention
  • Comply with legal obligations

Automated systems: We do not use automated decision-making with legal or similarly significant effects.

6. Public Content & Messaging

  • Content may be public depending on settings
  • Direct messages (DMs) are intended to be private but may be processed for safety, moderation, and feature functionality
  • We do not guarantee absolute confidentiality of content

7. How We Disclose Information

Service Providers / Sub-processors

We use providers including:

  • Infrastructure: Google Cloud Platform (Cloud Run), AWS
  • Analytics: Mixpanel, BigQuery
  • AI: OpenAI, Anthropic, OpenRouter models
  • Speech processing: Whisper or equivalent
  • Diagnostics: Sentry, Shake
  • Messaging: Twilio, Firebase
  • Marketing & attribution: AppsFlyer (mobile attribution, deep linking, audience targeting, and campaign measurement) and Meta (website advertising measurement and conversion attribution)
  • Authentication: Supabase, Google Sign-In
  • Payments: Apple (StoreKit), Stripe
  • Experimentation: Statsig

Marketing partners. Depending on the service, we disclose identifiers, contact details, and internet or technical data to marketing, advertising, and attribution providers (including AppsFlyer and Meta) so they can deliver, attribute, measure, and improve marketing communications and ad campaigns. For the Meta website measurement described in Section 10, A-LIST's website code does not supply names, email addresses, or phone numbers as browser advanced-matching fields and does not attach medical-intake responses, prescription details, or patient-profile information as custom event fields. Partners process information under their applicable terms and privacy policies and may use permitted event data for advertising measurement, delivery, and improvement.

AI Processing

Data may be processed by AI providers to fulfill requests. We instruct providers to use data only to provide functionality and restrict training where supported. For Google Calendar data and information derived from it, the stricter Google Calendar restrictions above apply, including the prohibition on generalized or non-personalized model training.

Legal / Compliance

To comply with law or protect rights and safety

Business Transfers

In mergers, acquisitions, or financing events

Public Content

Visible to others as shared

8. Health Integrations (Apple HealthKit and Android Health Connect)

Android Health Connect use is described in the Android local edition section.

  • Access only with permission
  • Used only for requested features
  • Not used for advertising or sold

9. Your Choices & Controls

  • Location, contacts, and health data permissions (manage in your device settings)
  • Content deletion
  • Account deletion

Web advertising data sharing

You may opt out through Your Privacy Choices. When the opt-out is active, we stop Meta browser Pixel measurement and do not send Meta the server-side InitiateCheckout or Purchase events for activity from that browser. We also honor Global Privacy Control signals automatically. Opting out does not affect the Service or prevent you from seeing advertisements unrelated to your A-LIST website activity.

How to opt out of marketing

You can opt out of marketing and promotional communications, and of sharing your contact details with marketing partners (including AppsFlyer), at any time:

  • Email: click the "unsubscribe" link in any marketing email.
  • SMS: reply STOP to any marketing text.
  • Push notifications: disable in your device's notification settings or in the A-LIST app settings.
  • In-app: turn off marketing communications in Settings → Notifications / Communications.
  • Mobile ad tracking: on iOS, deny App Tracking Transparency for A-LIST (Settings → Privacy & Security → Tracking) and/or reset your device advertising identifier.
  • By email: send a request to privacy@a-list.com and we will remove you from marketing audiences shared with third-party marketing partners.

Opting out of marketing will not stop service or transactional messages (e.g., security alerts, billing, account notices) that are needed to operate the Service.

10. Cookies, SDKs & Tracking

Data practices depend on the edition and features you use; see the Android local edition section for that edition's practices.

We use cookies, SDKs, and similar technology for:

  • Analytics (Mixpanel, BigQuery)
  • Diagnostics (Sentry, Shake)
  • Communications (Twilio, Firebase)
  • Advertising measurement and attribution (Meta and AppsFlyer)

Meta website measurement

On public website pages where Meta measurement is enabled, we use the Meta Pixel to send a PageView event. Meta's Conversions API reports InitiateCheckout when an initial online visit begins and Purchase after successful payment authorization. PageView may include the page URL and title, referrer, IP address, browser or device information, and Meta ad-click or browser identifiers. InitiateCheckout is limited to the event time, an anonymous session-derived event identifier, IP address, user agent, and available Meta ad-click or browser identifiers. Purchase is limited to the event time, an order-derived event identifier, value and currency, IP address, user agent, and available Meta ad-click or browser identifiers. We use these events to measure and improve advertising. A-LIST's website code does not supply contact information for browser advanced matching or include the purchased treatment, medical-intake responses, prescription details, or patient-account information in these events.

11. Data Retention

  • Account data: retained while active
  • Logs: retained for limited operational periods
  • Audio: not retained beyond processing unless disclosed
  • AI data: retained as needed for functionality, safety, and debugging
  • Legal retention as required

Order, prescription & compliance records

If you have placed an order (including prescription/telehealth orders), we retain records associated with that order after you delete your account — including order and billing history, prescription and consent records, identity-verification records, and a limited snapshot of the identifying information needed to keep those records attributable to you (such as name, date of birth, email, and phone number). We retain these records as required by law and for tax, accounting, and regulatory recordkeeping purposes, and for the establishment or defense of legal claims. We retain them only for as long as those obligations require, after which they are deleted or de-identified. If you have not placed an order, deleting your account removes your personal information as described above without a compliance snapshot.

12. Security

We use:

  • Encryption in transit and at rest
  • Access controls and least-privilege access
  • Monitoring and logging

No system is completely secure.

13. U.S. Privacy Rights

You may request:

  • Access
  • Deletion
  • Correction
  • Portability
  • Opt out of sale, sharing, or targeted advertising where applicable through Your Privacy Choices or Global Privacy Control

Deletion. Your right to deletion is subject to exceptions permitted by law. We may retain certain information where necessary to comply with a legal obligation, meet tax and recordkeeping requirements, complete a transaction you requested, maintain prescription/medical and consent records, prevent fraud, or establish or defend legal claims. See "Data Retention" for what we retain after account deletion and why.

We will not discriminate against you for exercising an applicable privacy right.

Contact: privacy@a-list.com

14. International Transfers

Android journal content is stored and processed on your device as described above. Technical information sent to external services may be processed outside your country, including in the United States.

15. Children

We do not knowingly collect data from users under 18.

16. Third-Party Links

We are not responsible for third-party services.

17. Changes

We may update this Policy and provide notice where required.

18. Contact

Immortal Company Inc.

11273 COLINWARD AVE

Las Vegas, NV 89135

privacy@a-list.com

Short Disclaimers

No medical advice. Not a healthcare provider.

AI Systems. Outputs may be inaccurate or incomplete.

Not a contract. See Terms of Use.