Your things.
Clearly accounted for.

Who is responsible

Effective 1 October 2026. Hold This is operated by PSL Digital, the controller of personal information used to provide the app and website. Contact contact@psldigital.dev for privacy questions or to exercise your rights.

Information we process

• Saved content: screenshots, original links, recognised text, titles, list purposes, notes, questions, corrections and associated source information you choose to save.
• Account and collaboration: your Apple sign-in identifier, email or Apple relay address where supplied, username, session credentials, list memberships, invitations and discussions.
• Personal settings: ratings, reminders, image framing, preferences and your recorded enrichment choice. These personal controls are not shared with other list members.
• Service records: request identifiers, processing status, security and error information, usage and allowance records, and subscription entitlement information where applicable. Apple processes payment details; we do not receive your full payment-card details.
• Support: information you choose to include in a message to us.

Local saving and automatic sync

You can save locally without signing in. Images, recognised text and draft information can remain on your device. When you sign in and complete setup, local saves are automatically queued for your account when the app is online. Account separation is used to prevent those guest saves being silently reassigned to another account on the device.

Cloud saving and enrichment processing are different activities. Sync can occur without enabling enrichment. Do not save another person’s confidential information unless you have a suitable reason and permission to do so.

Optional enrichment processing

If you choose enrichment processing, selected originals, recognised text, relevant list context, notes and research questions may be sent to OpenAI through our server to identify content and produce useful details. Relevant public webpages may be fetched or searched; queries can contain information from the item and your instructions. This processing is not solely on your device.

We use the OpenAI API. Its documented API policy is not to train models on API data by default, unless the customer opts in; our app does not opt your content into model training. Provider security and abuse-monitoring retention can still apply. See OpenAI’s API data controls.

You can decline enrichment during setup and continue manual saving. Contact us to withdraw optional enrichment consent or request help stopping future processing. Withdrawal does not undo completed processing. Enriched information may be inaccurate and should be checked against their sources.

Why we use information

We process the information needed to provide the features you request — saving, syncing, account access, collaboration and support — to perform our contract with you. We rely on your consent for optional cloud enrichment processing. We use limited security and operational records for our legitimate interests in maintaining a reliable service and preventing misuse, and retain information where a legal obligation requires it.

We do not sell your personal information or use your saved content for targeted advertising. The app and this website do not include an advertising or cross-site analytics SDK.

Who receives information

Other people receive shared-list content only through the permissions for that list. Notes, questions and discussion messages are shared content where applicable. Ratings, reminders and framing stay personal. Removing access cannot erase copies a recipient has already obtained.

Our service providers include Apple for sign-in, distribution and relevant system features; Supabase for authentication, database and file storage; Railway for the API and background services; OpenAI for optional enrichment processing; and Cloudflare for website hosting and delivery. We may disclose information where required by law or necessary to protect people and the service.

Providers may process information outside the UK. Where applicable, we rely on provider contractual safeguards and recognised transfer mechanisms. We do not promise that all processing remains in the UK.

Retention, deletion and security

We keep active saved content while it is needed for your account or until you delete it. Deleted items and lists have a 30-day recovery period before scheduled removal of their content and associated original files. Account deletion is queued for removal of account data and associated cloud files; it is not the same as signing out or uninstalling.

Operational or legal records may be retained separately where needed for security, accounting or legal obligations. Provider backups, abuse-monitoring records and copies held by recipients are governed by their own retention requirements and may not disappear immediately. We do not promise instant deletion from every backup.

We use encrypted connections, authenticated access and access controls for cloud originals. Local data uses the device’s storage protections. No online service or device can guarantee absolute security.

This website

The marketing website does not set advertising cookies, use visitor analytics or collect a mailing list. Its interactive demonstrations run in your browser and do not upload content. Cloudflare may process connection, IP-address and security information to deliver and protect the website. Email and external links are handled by the services you choose to open.

Your rights and choices

Depending on your circumstances, you can ask to access, correct, erase or receive a copy of your personal information, restrict processing or object to processing based on legitimate interests. You can withdraw consent for optional processing without affecting the lawfulness of earlier processing.

Contact contact@psldigital.dev. We may need to verify that the account is yours. You can also complain to the UK Information Commissioner’s Office or your relevant local regulator.

Hold This is not directed at children under 13. If you believe a child has supplied personal information without appropriate permission, contact us. We will update this notice as the service changes and show the effective date here.