What we store, what we don't, and how to leave

You are handing us your subscriber list and a way into your email platform. You should know exactly what we keep, where, and how to take it back. Here are the plain answers.

What we store

• Your subscribers: email, name if the provider had one, subscription status, subscribe date, the provider's id for them, and a trimmed copy of the provider's record.
• Resolved profiles: name, title, company, seniority, industry, profile link, for the addresses that resolve.
• Validation verdicts: whether an address is live, invalid, disposable, or unknown.
• Your credential for each connected provider: an OAuth token or an API key, encrypted.
• Sync history: when each run started, how many records it saw, whether it finished.

What we do not store

• Your provider password. With OAuth you type it at your provider, never here. With an API key there is no password involved.
• The bodies of your emails, your templates, your campaign stats. We never request them.
• Card numbers. Stripe holds those. We hold a customer id.
• Anything from your subscribers' inboxes. We read your list, not their mail.

Encryption

Tokens and API keys are encrypted with AES-GCM before they reach the database, using a key derived from a secret that lives only in our server environment. Someone who copied the whole database would get ciphertext. The database itself sits on Cloudflare's infrastructure and is encrypted at rest there too. All traffic between your browser, our servers and your provider runs over TLS.

Workspace isolation

Every subscriber, list, connection and resolved profile is tied to one workspace id. Every query we run includes that id. There is no view that crosses workspaces. Team members see only the workspaces they have been invited to. The one shared thing is the validation cache described below, and it holds no workspace identity.

The shared cache

When an address is validated or resolved, we keep the result in a cache shared across all customers. If someone else's list contains the same address, they get the cached answer without a new paid call. The cache stores the address, the verdict and the public profile that came back. It does not store which workspace asked, which list it came from, or when the person subscribed. It is a lookup table of public facts about an address, not a record of your audience.

We never send through your account

Our connection to your provider is read-only in practice and, wherever the provider offers scopes, read-only by permission. We do not send email through Mailchimp, Klaviyo or anyone else on your behalf. We do not add tags, edit subscribers, or touch segments at your provider. Invitations you write in ListFunnel are drafts you send yourself, from your own client, one at a time.

Who can see your data

You and the people you invite to your workspace. Our identity provider sees the addresses we send it for resolution, and nothing about who you are. Our validation provider sees addresses too. Neither sees your list name, your workspace, or your account. Stripe sees your billing details. Nobody else.

Disconnect

Disconnect on the Connections page deletes the stored token or key for that provider. That row is gone, not flagged. Your lists and resolved people stay in the workspace, they just stop syncing. If you want to be sure the token is dead on the provider's side as well, remove ListFunnel from the connected-apps page at your provider. With OAuth, that kills the token even if we still held a copy.

Delete

Deleting a list removes its contacts from your workspace. Deleting your workspace removes every list, contact, connection, sync run and resolved profile tied to it. The shared cache keeps the public facts about an address (this address is live, this address maps to this public profile) because those facts were never yours. It does not keep that the address was on your list.

Export before you go

Every list exports to CSV with the resolved fields attached. There is no lock-in and no export fee. Take your data, then delete the workspace.

Questions we get

• Can you see my subscribers' opens and clicks? Not today. Sync pulls subscribers and status only.
• Do you sell or share lists? No. The shared cache is public facts about addresses, never a list.
• Where is the data held? Cloudflare's network. Ask us if you need a specific region and we will tell you honestly what we can and cannot do.
• What if I revoke access mid-sync? The step in progress fails, the run is marked failed, the connection shows Reconnect. Everything already landed stays.