Eme's List is a product of 1265 Enterprises LLC, 1500 N Grant St, Ste N, Denver, CO 80203. This policy covers the Eme's List mobile app and our website at https://emeslist.com. Your app account and the website's updates list are separate. Signing up for one does not create or link the other.
Questions, or want your information deleted? Email support@emeslist.com.
A separate Consumer Health Data Privacy Policy applies to residents of Washington, Nevada, and Connecticut.
This is the most important section, so we've written it plainly.
What stays on your device. Your saved avoidance profile, your My Meds list, and your recent search history are stored on your device. We do not keep a copy of them, and there is no reusable profile of you on our servers.
What is sent to us. To answer a search or show you comparable products, the app has to ask our servers, because the product reference database is far too large to fit on a phone. When it asks, the request includes what you searched for and the avoidance categories you have selected, so our servers can work out which products match and how to order them. That request is signed in to your account, so we can associate it with you while we answer it.
What we do with it. We use it to answer that one request, and then we're done with it. We do not write your avoidance selections or your medication list into a profile on our servers. We don't use them for advertising, we don't build a picture of your health, and we don't sell them.
What we keep. Our operational logs record which type of request was made and whether it succeeded. They do not record the search terms, the avoidance categories, or the full web address. Those logs are kept for 30 days. We have deliberately turned off the request logging that would otherwise capture the full address of every request.
For usage limits, we also keep a daily record of which product pages your account opened. It holds product identifiers only, never your search terms or avoidance selections, and it is kept for 30 days like our other operational records.
A note on HIPAA. Eme's List is not a doctor, pharmacy, insurer, or health plan, and we are not a HIPAA-covered entity. What you enter is not "protected health information" under HIPAA.
Backing up your own data. Because your saved profile lives on your device, we cannot restore it if you lose your device, delete the app, or move to a new phone without transferring it. The app does not offer an export today. If we add one, we will say so here.
The app uses Firebase Authentication and Firebase App Check (Google services) to sign you in and to confirm requests come from a genuine copy of the app. The app does not contain advertising networks, third-party analytics, or trackers. Our website runs on Cloudflare and uses Google Analytics only if you consent. Its fonts are served from our own site, so nothing loads from Google until you accept.
You give us:
Collected automatically:
We do not collect precise location, advertising identifiers, biometric data, or government ID numbers. We do not use geofencing.
To create and secure your account; to answer your searches and comparison requests; to confirm requests come from a genuine copy of the app; to send you account and security messages; to diagnose crashes and keep the service reliable; to prevent fraud and abuse; to send you the website updates you asked for; and to meet our legal obligations.
We do not build advertising profiles, deliver targeted advertising, sell your information, or use your searches or avoidance selections to build a health profile of you.
On the website, your birth month and year is used to confirm you are 18 or older before we store your sign-up, and to understand the age range of the people who sign up, in ten-year bands. The app does not ask your age.
We send news only to people who select the news box, and every email includes an unsubscribe link and a link to manage your preferences. The launch notice and the guide are separate choices and are sent once.
We use the following providers. Each processes information on our behalf, under contract, to run the service:
| Provider | What it does |
|---|---|
| Cloudflare | Sits in front of our servers to route and protect requests. Cloudflare handles each request as it passes through, which includes the search and avoidance information in it. |
| Google Cloud | Runs our servers, databases, backups and logs. |
| Firebase (Google) | Authentication and App Check device-integrity verification, and sends account emails such as password resets. |
| Apple App Attest | Device-integrity verification on iOS. It is not designed to receive medication or avoidance information. |
| Provider | What it does |
|---|---|
| Cloudflare | Hosts emeslist.com, runs its forms, and stores the updates list in a Cloudflare database. Cloudflare Turnstile checks form submissions for bots and sees your IP address and browser signals when a form opens. |
| Resend | Sends the contact-form message to our support inbox and sends you your preferences link when you ask for it. Resend keeps a copy of those emails for 30 days. |
| Google Analytics | Website usage measurement, only if you consent, never when your browser sends Global Privacy Control, and separate from the app. |
| Google Workspace | Our email provider. Holds contact-form messages, privacy requests and replies sent to support@emeslist.com. |
Account emails for the app come from Firebase. Emails from our website are sent through Resend. We do not use a third-party error-tracking service.
We require the same protection from them that we give you. Every provider above is bound by contract to protect your information to a standard at least equal to this policy, to use it only to perform the service we've engaged them for, not to sell or share it, and not to keep it longer than necessary.
We only collect what we need. We limit what we collect to what is relevant to running Eme's List and providing the features you use.
Where processing happens. Our databases and application servers are configured in the United States. Cloudflare, Google, Resend, and Apple operate global networks, so some processing may occur outside the United States under their standard terms.
We may also disclose information where the law requires it, or to protect someone's rights or safety. If the business is sold or merged, information may transfer as part of that. If so, we will give you notice first.
Eme's List contains no advertising today, and we do not share your information with advertisers or ad networks. If we introduce advertising in future, we will update this policy first and describe how it works before it launches.
In transit, everything is encrypted using TLS. At rest, our databases and backups are encrypted by Google Cloud.
We do not use per-user encryption keys, which means authorized staff or systems could inspect a live request if needed to operate or troubleshoot the service. Access to production systems is limited, administrative activity is logged by Google Cloud, and most routine database access is performed by automated service identities rather than people.
On your device, your saved profile is protected by your device's own storage protection and your passcode or biometric lock. Anyone with access to your unlocked device may be able to see what's in the app.
No system is perfectly secure. If you think your account has been compromised, email support@emeslist.com.
If a breach exposes health information we handle, such as the search and avoidance details in a request, we will notify you without unreasonable delay and no later than 60 days after discovering it, along with the Federal Trade Commission and, where the FTC Health Breach Notification Rule requires, the media.
Delete your account in the app at Settings → Account → Delete Account.
What happens immediately: we end your sessions, delete your sign-in account, remove the link between your sign-in and your internal user record, delete your current entitlements and per-item usage records, and clear the saved profile on the device you delete from.
What we keep, in a form not linked to your name or email: total usage counts, a history of entitlement events, installation and revocation records, and an internal identifier used as an anchor for those records. We keep these for security, dispute resolution, and to run the service.
A short-lived safety record containing only an account identifier is kept for no more than 25 hours, to stop a request already in flight from recreating an account you just deleted.
Backups. We do not edit individual records inside existing backups. Deleted data ages out of our backups and recovery window within seven days.
If you're signed in on more than one device, delete your saved profile on each of them, because the profile is stored per device.
Website updates list. Every email we send has a link that lets you stop news emails or remove yourself from the list entirely. You can also request your link at https://emeslist.com/unsubscribe. Removing yourself deletes your name, birth month and year, and preferences at once. We keep only a scrambled form of your email address so that nobody else can add you back; you can rejoin any time by signing up again and confirming from your inbox. Your app account and the updates list are separate: deleting one does not change the other.
Withdrawing your consent. You can withdraw consent to our processing at any time by deleting your account, or by emailing support@emeslist.com. Withdrawing consent to the processing described in Section 1 means search and comparison features will stop working, because sending your selections is how those features operate.
You can also email support@emeslist.com at any time to ask what information we hold, to correct it, or to have it deleted. We will respond within 45 days, and we will never treat you differently for asking.
Eme's List is intended for adults. The app is rated 18+ on the App Store and does not ask your age. When you sign up for updates on emeslist.com we ask your birth month and year, never the day, and if it shows you are under 18 we refuse the sign-up and store nothing. We do not knowingly allow anyone under 18 to use the app or join the list. If we learn an account or a sign-up belongs to a minor, we will close it and delete the information associated with it. Contact support@emeslist.com.
We will post any update here and change the version and date above. If we make a significant change, particularly one affecting health information, we will tell you in the app and by email before it takes effect.
1265 Enterprises LLC · 1500 N Grant St, Ste N, Denver, CO 80203 · support@emeslist.com