Privacy

1Summary

• Simple Todo is a personal task manager run by an independent developer. It is free and has no ads.
• The app only collects what it needs to sign you in and store your tasks and notes, plus anonymous page-view counts and page-speed measurements. We don't sell data, show ads, use tracking cookies, or tie these numbers to your account.

2Data we store

• Account: email and display name. If you sign up with a password, only a hash of it is stored — nobody, including us, can read your original password.
• Signing in with Google: your name, email, profile picture and Google account ID, plus the sign-in tokens Google issues. The app only requests 3 basic permissions (openid, email, profile) — it cannot read your Gmail, Drive or any other Google data.
• Content you create: task titles, descriptions and notes, completion status, due dates, priorities and tags.
• Notebooks: notebook names; each note's title, Markdown content, icon, tags, parent page and linked tasks; up to 30 earlier saved versions of each note (version history). Images in notes are kept in the private file store like attachments, and only you can open them through links that expire after 1 hour.
• Notes can also contain PDF files you insert, plus the font, text size and text colours you pick. PDFs live in the same private file storage as note images and open only through links that expire. When you export a note to PDF, the PDF is built on your own device through the Print dialog — nothing is sent anywhere.
• Settings: the time zone and background theme you choose (the theme is saved to your account so all your devices match).
• Sign-in sessions: the IP address and browser information (user agent) at sign-in — to protect your account.
• Password reset: a single-use code that expires after 1 hour.
• Attachments: the files you upload, their names, types and sizes. Files live in private storage and can only be downloaded through links that expire after 5 minutes.
• Subtasks, repeating tasks, pinned tasks and archived tasks — the same kind of content you create, as above.
• Pomodoro: when your completed focus sessions ended, how long they were, and which task they were for. Timer settings and the running timer (phase, when it ends, the task in focus) are saved to your account so every device shows the same timer.
• Habits you create (name, icon, goal, repeat schedule, reminder time) and their daily log (counts, short notes).
• Daily Quest (when on — on by default, turn it off in Settings): how many tasks you finish each day, XP, streak, shields, rewards received and the days you open the app. The operator only sees totals (how many people opened the app, return rates), never anyone's own record.
• Push notifications (when you turn them on for a device): the notification address your browser issues for that device, plus its language and browser type.
• Telegram (when you connect it): your Telegram chat ID, username, display name and language. Connection codes are stored only as hashes and expire after 10 minutes. Disconnecting deletes this information.
• Feedback (when you send it from the About page): type, message, whether we may contact you, app version and language — stored with your account and read only by the operator. Deleting your account deletes your feedback.
• Blog posts (when you write one): title, content, review status and review reasons. Drafts are visible only to you; once submitted, reviewers (Contributors, Admins) can read the content and your display name — not your email. Published posts are PUBLIC on the Blog with your display name: anyone can read them and search engines may keep a copy. Deleting your account deletes your posts. A post's cover image, images in the post, SEO description and tags (if any) are public along with it; images live in private file storage and open only through links that expire after 1 hour. Translations of a post (title, body and SEO description in other languages — if you write them) are reviewed and published together with the post. When you press "Translate from original", the post's title, body and SEO description are sent to DeepL (Germany) for machine translation; the app only stores how many characters you translated that day, to enforce the daily limit.
• Blog post views: when a post is shown on screen, the app counts one view — at most once per person per post per day. To recognise "the same person", the app stores only a hash (made from the date, IP address, browser type and the post, plus a secret server key). It does not store your IP address or browser details and uses no cookie; the hash changes every day and is deleted after 2 days. Only the total view count is kept and shown publicly.
• Blog post likes (when you like a post): the app stores which account liked which post so you can unlike it. Others only see the total number of likes, not who liked. Deleting your account deletes your likes.
• Blog comments (when you write one): the text, when it was written / edited and the post it belongs to. Comments are shown PUBLICLY with your display name; post authors and reviewers can hide comments. You can edit or delete your own comments; deleting removes the text right away, and the app keeps only when it was written, to apply the anti-spam limit. Deleting your account deletes your comments — a comment that has replies becomes a "This comment has been deleted" line, with neither its text nor your name.
• Author page (once you have a post on the Blog): your display name, handle, the bio and link you choose to add, the month you joined, your Contributor / Admin role, and the post, view, like and comment counts of your published posts — shown publicly at /u/<handle>. Your email and to-dos are never shown there. Until a post of yours is published, the page does not exist for anyone else.

3How the data is used

• To sign you in and keep you signed in.
• To store and show your tasks and notes — only you can see them.
• To work out "today" and "overdue" in your own time zone.
• To send a password reset email when you ask for one. The app never sends marketing emails or newsletters.
• The app's operator has an admin page used only to run the service and help users: it shows account details (name, email, sign-up date, last activity, sign-in method) and totals (number of tasks, file storage, Pomodoro sessions). It never shows your task titles, descriptions, notes, notebook content or files. Accounts that break the terms may be locked; you'll see a message when signing in. The admin page also has a Files section for cleaning up unused files: it shows only each file's type, size, upload date, owner and whether it is still in use — never file names, file contents or which task uses it; Blog images show their post title only once the post has been submitted or published.

4Data stored on your device

• Sign-in cookie: required for the app to work, not readable by JavaScript, only sent over HTTPS. No advertising or tracking cookies.
• Appearance choices (light/dark, background, how notes open: Write / View / Reading mode) are stored in your browser.
• A copy of your task list and any changes not yet sent to the server are stored in your browser so the app works offline. All of it is deleted when you sign out.
• Up to 100 notes you opened recently are kept in your browser so they reopen instantly. All of it is deleted when you sign out.
• Daily Quest's “opened the app today” mark is stored in your browser so it is not sent to the server again during the day.

5Third-party services

The app relies on these services. Each one only receives the data it needs for its job:

• Vercel — hosts the app (Singapore region). Keeps short-lived technical logs of each request.
• Vercel Web Analytics — counts anonymous page views so we know which pages get used: the page path (with every URL parameter removed), the referring page, country, device type and browser. No cookies, and nothing is linked to your account or your tasks.
• Vercel Speed Insights — measures how fast pages load and respond on your device (Core Web Vitals) so we can spot slow pages: the page path (with every URL parameter removed), device type, browser and country. No cookies, and nothing is linked to your account or your tasks.
• Neon — the database that stores your account, tasks and notes (Singapore region).
• Sentry — receives a report when the app hits a technical error, so we can fix it: the error message, where in the code it happened, the page path (without URL parameters), your browser and operating system. It never receives your name, email, task content, cookies or anything you type.
• Resend — sends password reset emails; receives your email and name when you request a reset.
• Google — only if you choose "Continue with Google".
• Cloudflare — stores attachments and images in notes (R2, a private bucket) and keeps time for reminders (a Worker that only knows when the next reminder is due, not what it says), and relays “something changed” signals between your devices (a Worker that only sees a hashed channel code and when a change happened, never your account or your tasks).
• Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser) — delivers reminder notifications to devices you turned on: the task title and due time.
• Telegram — only if you connect it: receives the messages the bot sends to your chat, including reminders and the daily summary with task titles and due times (can be turned off in Settings › Notifications & integrations). When you tap a button in a message, Telegram sends that tap back to Simple Todo.

6Data received from Google

Applies only if you choose "Continue with Google":

• What the app accesses: your name, email address, profile picture and Google account ID — through exactly 3 permissions: openid, email, profile. The app does not request or access any other Google data (Gmail, Drive, Contacts, Calendar…).
• How the app uses it: only to create your account, sign you in, and show your email in Settings. It is not used for advertising, behavioural analytics, or training AI models.
• How the app stores it: this information and the sign-in tokens Google issues are stored in the app's database (Neon, Singapore region) and sent over encrypted connections. The tokens are never used to call any other Google API.
• Sharing: we do not sell, rent or transfer your Google data to third parties, other than the infrastructure providers that host and run the app for us (Vercel, Neon). Nobody reads this data unless needed to handle a security incident or required by law.
• Deletion: go to Settings › Account › Delete account to delete your account and all its data yourself, including data received from Google (or email the contact address below). You can also revoke Simple Todo's access at any time at https://myaccount.google.com/permissions.
• Simple Todo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7Retention and deletion

• Data is kept for as long as your account exists. Sign-in sessions expire after 30 days of inactivity.
• Delete your account and all its data yourself in Settings › Account › Delete account: the app sends a confirmation email and only deletes once you open the link in the browser where you're signed in and confirm. Deletion happens right away, includes attachments in storage, and can't be undone. Download a copy of your data yourself at any time in Settings › Account › Download a copy of your data: one JSON file with your profile, every task (including done and archived ones) with notes, tags, subtasks, Pomodoro sessions, the list of attachments, your Telegram link, the feedback you sent, your chosen theme and your Pomodoro timer with its settings; attachment contents are downloaded one by one in the app.

8Security

• All connections use HTTPS. Passwords are hashed and never stored in plain form. Every data access checks that the task belongs to you.
• Resetting your password signs out every device. Sign-in and password reset requests are rate-limited to stop password guessing.

9Changes to this policy

• When the app adds a feature that needs new data, this page is updated before the feature launches, with the update date at the top.