Privacy

Effective date: November 14, 2026

This page describes what this OnLists server stores. It is a product description of the current code. It is not a promise about a future feature.

Who runs this

OnLists lists accounts on X. It is not affiliated with X Corp. The name OnLists is used here as the name of this product. This page does not say that name has been cleared as a trademark.

X sign-in

Continue with X opens X’s own consent screen. OnLists has no password. Ordinary sign-in asks X for the scopes users.read and tweet.read. tweet.read is the read scope X documents for reading the signed-in profile. It is not permission to post. OnLists does not request direct messages or follows for ordinary sign-in.

The access token from that sign-in is used to read the profile and is not written to the database. OnLists does not store an X refresh token.

The first sign-in stores the X user id, handle, display name, bio, profile image URL, verified flag, verified type, and identity-verified flag. A later sign-in updates the X user id, handle, display name, verified flag, verified type, and identity-verified flag. It does not rewrite the stored bio or profile image URL.

That same profile read asks for description, location, and url. OnLists uses the name, bio, location, link, and verification type from it to suggest up to five lists. It stores the list and a short reason, not a separate copy of the location or URL. Nothing is nominated until you submit the form. Dismissing a suggestion hides it.

Copy to X List is a separate consent. It asks for list.read and list.write in addition to the sign-in scopes, and only when you start that flow. If that consent finishes, the access token is stored encrypted with AES-256-GCM, together with the scopes, on your OnLists user id. The token is not shown on the account page. Disconnect X deletes that token and ends the OnLists session. It does not delete the X account, post, or follow.

The OAuth state and PKCE code verifier are stored until the callback is used or for 10 minutes, whichever comes first.

Account deletion

My account has Delete OnLists account. You have to check a box. That deletes the OnLists user row, sessions, ballots and their ranks, saved list follows, in-app alerts, push subscriptions and push preferences, preferred places, hidden and muted items, blocks you created, self-nomination suggestions, and any stored Copy to X List token. Discussion comments you wrote are blanked and marked deleted. The row can remain so the thread still has a place.

Deletion does not delete your X account. It does not remove a directory account that was listed from a public profile. It does not erase nominations, reports, the audit log, or ranking points already written to the ledger. A digest address linked to this sign-in is deleted with the account.

Votes, nominations, and discussions

A ballot is stored on the signed-in user and the list. A private ballot’s ranks are not published. A shared ballot can show the ranked handles without the voter’s name.

A nomination stores the handle, an optional reason up to 280 characters, the signed-in user, and the list. Approving someone else’s nomination can add 1 nomination point on that list. Nominating yourself adds no points. A nomination rate limit stores the request IP as the subject ip: plus that address in rate_events. That is a counter, not a profile. The public footer says OnLists does not store an IP for location. This nomination counter is the exception in the current code.

Discussion is open on team, local-news, and university lists. A comment is plain text, at most 500 characters, and tags are rejected. You can mark a comment helpful, report it as spam, harassment, threats, or personal info, or block another signed-in user. A block hides that person’s comments from you. It does not email them. A moderator can hide or restore a comment. A report does not remove an account by itself.

Ranking points

Ballot points are 20 for rank 1 through 1 for rank 20, on that list only. You cannot rank your own X account. An approved nomination of a different X account adds 1 point on that list. Visit days add 1 point per America/Chicago day when the listed account’s owner opens a page while signed in with the matching X user id, on every list that account is on that day. Share clicks add 1 the first time another person opens your share link, then 0.1 per later click from that person, with at most 0.5 extra, and 0.5 Shares once per share that someone else opens. Your own clicks, a burst inside 60 seconds, bots, and prefetch requests add nothing. A paid highlight does not add points.

Visit points and share points follow ONLISTS_VISIT_POINTS and ONLISTS_SHARE_POINTS. Outside production they are on unless set to 0. In production they stay off unless set to 1.

Saved lists and alerts

Follow list stores that you saved a list on this sign-in. Optional in-app alerts for new nominees or rising accounts stay on OnLists. They are not email. Web push is off unless ONLISTS_WEB_PUSH is 1 and VAPID keys are set, and only after you turn it on. Nothing is sent automatically by opening the page.

Email digest

OnLists collects an email address only after you check the consent box yourself. The box starts unchecked. The wording is version 2026-11-14: “Email me a digest of my saved lists. We'll confirm your address before sending anything.” The purpose is a later digest of the lists you chose. This server stores the address, those list preferences, the consent time, and that consent version. The status is pending_confirmation. No confirmation message is sent until an email provider is approved. Nothing is emailed now.

The address is kept until you delete it from account settings, or until you delete the OnLists account. Either action removes it. Neither one requires an email. An administrator can export the stored addresses. They are not shown on a public page.

The digest also stores a cadence of daily or weekly, and the topics you check. Those preferences are kept with the address and deleted with it. Interests used to suggest lists come from lists you save, follow, or vote on. That activity is already stored with the account. OnLists does not ask how you heard about the site.

Home region and language

A home region is optional. You pick one country, state, or metro from the regional lists. OnLists uses it to suggest local lists. It is not GPS, not a street address, and not an IP lookup. It stays on the account until you clear it or delete the account.

Language starts from the browser Accept-Language header, then a manual choice. The choice is limited to locales the server has enabled with ONLISTS_LOCALES. The manual choice is stored on the account when you are signed in, and in the onlists_lang cookie. It is a display preference, not a tracking cookie.

Cookies and local storage

onlists_sid is the session cookie. It is HTTP-only, SameSite Lax, and Secure when the site is HTTPS. The cookie lifetime is 14 days. The session row is stored for 400 days and holds a CSRF token. Signing out deletes that session.

onlists_vid tells share links apart. It can last 400 days. The database stores a salted hash of it, not the cookie value and not a browser fingerprint.

onlists_places holds up to eight place ids, or off, for 180 days when you are signed out. Signed in, the same choice is stored on the account.

onlists_hides holds hidden accounts and muted lists for 180 days when you are signed out. Signed in, those hides are stored on the account.

The theme choice is in this browser’s local storage under onlists-theme. House-ad rotation position is in session storage under onlists-house.

Analytics and location

There is no third-party analytics tag and no tracking cookie. OnLists counts page views, sign-ups, ad impressions, and ad clicks as daily totals. The purpose is to see which days the site was used. Raw daily aggregates are kept for 24 months, then deleted.

A visit may include a referring domain, such as x.com or google.com, plus utm_source, utm_medium, and utm_campaign when those three are present. A t.co referrer is stored as x.com. The full referrer URL is not stored. The IP address, the user agent string, and a browser fingerprint are not stored.

The first referring domain of a visit is kept on the short-lived session so a later sign-up can be counted against that domain. After the sign-up is counted, that session value is cleared. It is not stored on the user. Administrators can open a page of referring domains and sign-up counts. That page is not public.

Digest links add utm_source, utm_medium, utm_campaign, and utm_content. The campaign is the digest date or the template variant. The content value is the section: header, list card, account, suggested, ad, call to action, or footer. Clicks are counted per section, per campaign, and per day so the layout can be compared. OnLists does not keep a per-person click history and does not include an open-tracking image. Those daily totals follow the same 24-month retention.

On-site attention is the same kind of daily total: the page type, the section, the layout variant, and whether it was a click, an impression of a section at least half on screen for one second, or a scroll depth of 25, 50, 75, or 100 percent. The variant is chosen in this browser’s session storage and is not a cookie. Do Not Track and Global Privacy Control turn the counts off. The pages still work with JavaScript off. These totals are kept for 24 months. OnLists does not record a session replay.

Offline IP-to-place lookup stays off unless ONLISTS_IP_GEO is 1 and a local DB-IP City Lite file is configured. That lookup does not call a geo service. Preferred places are the places you pick, or a time zone for the home lists. They are not a stored street address.

OnLists does not collect age, gender, phone numbers, contacts, direct messages, or follower lists.

A sponsored highlight is $30 for 30 days on one list, labeled Ad, and it does not change rank. A sitewide rotation is $130 for 30 days, also labeled Ad, and it does not change rank. Payment, if the Stripe flag is on, is described in the terms. Card data and the rest of the billing record stay at Stripe. OnLists stores the order: the plan, the list or placement, the amount, the currency, and the payment status. This server does not store a card number.

Recommended gear

A list page can show a Recommended gear box of up to six Amazon search or product links. The box stays off unless ONLISTS_AFFILIATE is 1 and ONLISTS_AMAZON_TAG is set. It is not shown on politics, news, government, crypto, or kids lists. It does not show prices, star ratings, or product images. It does not say that a listed account uses or endorses a product.

As an Amazon Associate, OnLists earns from qualifying purchases.

A click in that box is counted with the other anonymous section totals, under the section affiliate. The count is a daily total. It does not store which person clicked.