Privacy Policy

Effective as of May 10, 2026.

This Privacy Policy describes how Journey With Alexa LLC d/b/a The Hundreds List ("The Hundreds List," "we," "us" or "our") handles personal information that we collect through our websites and mobile apps that link to this Privacy Policy (collectively, the "Service"), as well as through our marketing and other activities described below.

Index

You can click the links below to jump to specific sections, but we recommend that you read this Privacy Policy in its entirety.

Personal information we collect

Information you provide to us. You may provide us with the following categories of personal information:

• Account data. Information you provide to create a Service account, including your name, email address, and the password you set.
• Profile data. Information you choose to add to your Service profile, such as a profile photo, display name, or annual intention.
• List data. Information you enter into the Service about your goals, sub-goals, pillars, and related notes — including the contents of your annual list, any private "shadow" entries, photos you attach to entries, and any reflections, completion status, or year-over-year history you save.
• Shared list data. The Service includes the ability to share lists with other users you designate. If you choose to share a list or invite collaborators, the contents you share, the identities of people you invite, and any messages, comments, or contributions exchanged within shared lists are visible to the recipients you designate.
• Transaction data. Information about your purchases or subscriptions in the Service, including what you purchased, the price, and the date. Your in-app purchase transactions are processed by third party payment processors, which collect your personal information as described below under How we share your personal information.
• Communication data. The contents of your communications with us, whether through the Service, email, or otherwise, including your support requests, feedback you provide about the Service, and your responses to surveys.

If we ask you to provide other categories of personal information not listed above, we will use it consistent with this Privacy Policy or as otherwise explained at the time of collection.

Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, your interaction over time with the Service, and our communications, such as:

• Device data. Your computer or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, Bluetooth, 3G), and general location information (e.g., city/town).
• Usage data. The pages or screens you viewed, your search terms, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them.

Cookies and similar technologies. Some of the automatic collection described above is facilitated by the following technologies:

• Cookies. These are small data files that are placed on your computer or mobile device when you visit a website to help website operators understand site traffic and use, help you navigate between pages efficiently, remember your preferences, and enable functionality. Cookies used on our site include cookies that we serve as well as cookies served by third party vendors that we work with to enable the services they provide, such as website analytics services that track traffic and usage. You can learn more about cookies at www.allaboutcookies.org. If we use Google Analytics, you can learn about it and the data it collects through cookies here: https://support.google.com/analytics/answer/6004245?hl=en.
• Pixels. Pixels (also known as web beacons and clear GIFs) used on our site and in our HTML formatted emails to track the actions of users on our sites and interactions with our emails, such as when an email was opened. Pixels are embedded invisibly in image files within webpages or HTML formatted emails. Most browsers and devices allow you to configure your browser or device to prevent images and any pixels embedded in them from loading.
• SDKs. Software development kit (SDK) refers to third-party computer code incorporated into our Service to enable functions and tracking similar to those enabled by the other technologies described above, including to enable authentication services, analytics services, and functionality provided by third parties.
• Browser web storage. Browser web storage (including via HTML5), also known as locally stored objects, functions like cookies but enables the storage of a larger amount of data. Your web browser may provide functionality to clear your browser web storage.

If you block or reject these technologies, certain areas or features of the Service may not work or be accessible.

Third party sources. We may combine personal information we receive from you or collect automatically when you use the Service with personal information we obtain from other sources, such as:

• Third party authentication services. When you log into the Service by using your credentials on a third party service, such as Apple, Google, Meta (Facebook), Instagram, and X (fka Twitter), the service may share your name, email address, profile photo, and/or other information about you to facilitate the authentication as described in the service's settings or privacy policy.

How we use your personal information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service delivery. To provide, operate, support, and improve the Service and our business. This includes communicating with you via email — to provide support, respond to questions, and send you reminders, updates, and other administrative messages.

Personalization and AI features. Where you opt in, to power optional features such as AI-assisted list generation, year-end reflection summaries, and goal-completion guidance. See AI-powered features below for details on how these features handle your content.

Marketing. To send you marketing emails. You may opt out of our marketing emails as described in the Opt-out of marketing communications section below.

Research and development. For research and development purposes, including to analyze and improve the Service and our business. As part of these activities, we may create aggregated, de-identified, and/or anonymized data from personal information we collect. We make personal information into de-identified or anonymized data by removing information that makes the data personally identifiable to you. We may use this aggregated, de-identified, or otherwise anonymized data and share it with third parties for our lawful business purposes, including to analyze, improve, and promote the Service and our business.

Compliance and protection. To comply with applicable laws, lawful requests, and legal process (such as to respond to subpoenas or requests from government authorities), and to protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims), including by enforcing the terms and conditions that govern the Service, and taking steps to prevent, investigate, and deter fraud, cyberattacks, or other unauthorized, unethical, or illegal activity.

How we share your personal information

We may share your personal information with the following categories of recipients and as otherwise described in this Privacy Policy or at the time of collection:

Other users you choose to share with. If you share a list, invite a collaborator, or otherwise make content visible to other users of the Service, that content (and the associated profile information) will be visible to the recipients you designate. Content you mark as private — including shadow list entries — is not shared with other users.

Third parties you designate. Third parties with whom you direct us to share your personal information.

Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as hosting, information technology and security, support, email delivery, payments, generative artificial intelligence, safety monitoring, performance monitoring, marketing, customer research, and analytics).

Payment processors. When you make purchases through the Service, including subscription purchases, your transactions are processed through third party payment infrastructure. We use RevenueCat to manage subscriptions, and the Apple App Store and Google Play Store to process the underlying transactions. These providers may collect your name, email address, billing address, payment card information, in-app purchase identifiers, subscription status, and other information needed to process your payment and manage your subscription. They may retain this information to enable you to make additional purchases without re-entering your payment details. They do not share your full payment card information with us. Their collection and use of your personal information is governed by their own privacy policies, terms, and rules — we encourage you to read them.

Third party authentication services. When you log into the Service by using your credentials on a third party service, such as Apple, Google, Meta (Facebook), Instagram, and X (fka Twitter), the service will collect personal information from you to facilitate the authentication as described in the service's relevant settings or privacy policy, and may retain a record that you accessed the services.

CAPTCHA services. To enhance the security of our Service, we may use CAPTCHA features that require users to complete a task to authenticate to the Service. Third party providers of these CAPTCHA services collect Device Data and Usage Data, as described above to enable the CAPTCHA features and as described in their privacy policies.

Professional advisors. Professional advisors, such as lawyers, accountants, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Authorities. Law enforcement and government authorities for the compliance and protection purposes described above, but only to the extent such sharing is required by law.

Business transferees. Parties (and their advisors) to business transactions (or negotiations of or due diligence for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale, or other disposition of all or any portion of the business or assets of, or equity interests in, The Hundreds List (including, in connection with a bankruptcy or similar proceedings).

AI-powered features

The Service may offer optional features powered by artificial intelligence, such as AI-assisted list generation, year-end reflection summaries, and goal-completion guidance. These features are off by default and operate only when you choose to use them.

How content is processed. When you use an AI feature, the relevant portion of your list or other content you submit is sent to a third-party AI provider so the provider can generate the requested output (for example, a suggested list, a written reflection, or a recommended next step). The output is returned to you through the Service.

Provider commitments. We choose AI providers based on their privacy and security practices. We do not authorize these providers to use your content to train their general-purpose AI models, and we configure these features so that your content is processed for the purpose of generating your output and related abuse-prevention monitoring carried out by the provider, rather than for the provider's independent purposes. Each provider's handling of your content is also governed by its own privacy policy and terms.

What we do with AI inputs and outputs. We may retain AI inputs and outputs associated with your account so you can review, revisit, or build on them in the Service. We may also use de-identified or aggregated information about how AI features are used to evaluate and improve them, consistent with the Research and development section above.

Sensitivity and accuracy. Lists often contain personal, emotional, or aspirational content. AI features may produce inaccurate, incomplete, or unexpected output. They are not a substitute for professional advice, and you should review any AI-generated content before relying on it. If you would prefer not to involve any AI provider, do not opt in to these features.

Your choices

Access or update your information. You may review and update certain Service account information within your account.

Set notification preferences. You can set preferences regarding push notifications sent by our mobile app in your mobile device's operating system settings.

Opt out of marketing communications. You may opt out of marketing emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us with your opt-out request. Please note that if you opt out of promotional emails, you may continue to receive service-related and other non-marketing emails.

Cookies and similar technologies. The settings of most browsers let you remove or reject cookies. If we use Google Analytics, you can learn how to opt out of being tracked by Google Analytics cookies here: https://tools.google.com/dlpage/gaoptout.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Decline AI features. AI-powered features are off by default. You can choose not to opt in, and you can stop using AI features at any time. If you have used an AI feature, you can request deletion of the associated inputs and outputs by contacting us.

Delete your account. You can request that we delete your account through the settings in our mobile app or by contacting us with your account deletion request. Please note that if we delete your account, we will be unable to provide any online or digital services to you or support for past services you have requested.

Exercise California removal rights. Registered users of the Service who are California residents and under 18 years of age may request and obtain removal of content or information that they posted on the Service where it can be accessed by others. Please contact us with these requests. Upon receipt of the request, we will comply with applicable legal requirements to remove it or ensure that it is anonymized. Such removal does not ensure complete or comprehensive removal of the content, as, for example, some of the content or data may have been reposted by another user.

U.S. state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another U.S. state with a comprehensive consumer privacy law, you may have additional rights with respect to your personal information. The rights described below apply to the extent provided by the law of your state.

Your rights. Depending on where you live, you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for which we collected the information, and the categories of third parties with whom we shared it.
• Correct inaccurate personal information we maintain about you.
• Delete personal information we have collected from you, subject to certain exceptions.
• Opt out of the "sale" of your personal information or the "sharing" of your personal information for cross-context behavioral advertising. We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising, as those terms are defined under California law.
• Limit the use of sensitive personal information to the purposes permitted by law. We use sensitive personal information only for the purposes permitted by applicable law, including to provide the Service you have requested.
• Appeal a decision we make about your privacy rights request, where required by your state's law.
• Be free from discrimination for exercising any of these rights.

How to exercise your rights. You may submit a privacy rights request by contacting us. We will verify your request before we act on it, which may involve asking you to confirm certain information you have already provided to us. You may also designate an authorized agent to make a request on your behalf. We will require the agent to provide proof that you authorized them to act on your behalf and may require you to verify your identity directly with us.

Categories of personal information. The categories of personal information we collect, the sources, the purposes for collection, and the categories of recipients are described in Personal information we collect and How we share your personal information above. We have collected each of the categories of personal information described in those sections in the preceding 12 months.

EEA and UK privacy rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, the following additional information applies to you. For purposes of the EU and UK General Data Protection Regulation ("GDPR"), Journey With Alexa LLC is the controller of personal information described in this Privacy Policy.

Legal bases for processing. We process your personal information on the following legal bases:

• Performance of a contract with you — for example, to provide the Service, manage your account, and process subscriptions.
• Your consent — for example, when you opt in to AI-powered features, marketing communications, or optional cookies.
• Our legitimate interests in operating, securing, and improving the Service, communicating with users, preventing fraud, and developing our business, where those interests are not overridden by your rights and freedoms.
• Compliance with legal obligations — for example, to respond to lawful requests and meet legal, regulatory, accounting, or reporting requirements.

Your rights. Subject to applicable law, you have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request erasure of your personal information;
• Request restriction of, or object to, certain processing of your personal information;
• Request that we provide your personal information in a portable format;
• Withdraw your consent at any time, where we rely on consent (without affecting the lawfulness of processing carried out before withdrawal); and
• Lodge a complaint with the data protection authority in your country of residence, place of work, or the place of an alleged infringement.

To exercise any of these rights, please contact us.

International transfers. Personal information we collect from you in the EEA, UK, or Switzerland may be transferred to and processed in the United States, where we are headquartered, and other countries where our service providers operate. Where required by law, we rely on appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses (and the UK addendum or Swiss equivalents, where applicable).

Other sites and services

The Service may link to or integrate with websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or other online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications, and online services you use.

Security and retention

We employ technical, organizational, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. If we become aware of a security incident affecting your personal information, we will notify you and applicable authorities as required by law.

We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including to provide the Service, satisfy legal, regulatory, accounting, or reporting requirements, establish or defend legal claims, enforce our agreements, resolve disputes, and prevent fraud. When we no longer need personal information, we will either delete it or anonymize it.

International data transfers

We are headquartered in the United States and may use service providers that operate in the United States and other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those where you live. See EEA and UK privacy rights for additional information that applies to transfers from those regions.

Children

The Service is not intended for, and we do not knowingly collect personal information from, anyone under 13 years of age. If you are under 13, please do not attempt to register for the Service or send any personal information about yourself to us. If we learn that we have collected personal information from a child under 13, we will delete that information as quickly as possible. If you are a parent or guardian and you believe a child under 13 has provided us with personal information, please contact us.

If you are between 13 and 17 years of age, you may use the Service only with the involvement and consent of a parent or legal guardian, who agrees to be bound by our Terms of Service on your behalf. We recommend that parents and guardians of users under 18 review the Service and this Privacy Policy with the user.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Privacy Policy indicates your acknowledgment that the modified Privacy Policy applies to your interactions with the Service and our business.

How to contact us

If you have questions or concerns about this Privacy Policy or our practices, please contact us at [email protected].

Journey With Alexa LLC d/b/a The Hundreds List