Privacy Policy

At a glance

• We do not sell personal information.
• We do not show ads or use your information for cross-app tracking.
• We do not currently use a product-analytics or advertising SDK.
• Your tasks and calendar events are private to your signed-in account.
• You can delete your account and its Todobly content from Account settings.

Information we collect

Account and authentication information

When you create or use an account, we process your email address, Todobly and Clerk user identifiers, authentication provider, account-creation time, session identifiers, and authentication tokens. Clerk provides our authentication flows and may also process the profile information and authentication factors you provide to it, such as your name, profile image, password credentials, verification status, or information returned by Google if you choose Google sign-in. Todobly stores your verified email address, Todobly user ID, Clerk identity link, account-creation time, and whether the welcome email was sent in its own database.

Tasks and calendar events

We collect the content you choose to save: task titles and their created, committed, discarded, and completion state; and calendar-event titles, descriptions, start and end times, all-day status, recurrence rules, and creation time. We also store identifiers that link each item to your account. Calendar events in Todobly are stored in Todobly; the current app does not read from or write to your device calendar.

Communications and support

We use your email address to send one welcome email. That message includes your email address, and email delivery creates records such as sender, recipient, subject, message content, delivery status, and timestamps. If you contact support, we collect your email address and whatever information you include in the message.

Technical information

When you use Todobly, our hosting and authentication providers may automatically process technical information needed to deliver and secure the service, including IP address, approximate location derived from IP, browser or device type, operating system, app or SDK version, requested pages and API routes, timestamps, cookie or session information, and request, error, security, and performance logs. Clerk's web SDK uses cookies to maintain web sessions; the iOS app sends a short-lived Clerk session token with authenticated requests. We do not use the iOS advertising identifier and do not request App Tracking Transparency permission.

How we use information

• create, authenticate, secure, and maintain your account;
• save, synchronize, display, and update your tasks and events;
• send the welcome email and respond to support requests;
• operate, troubleshoot, protect, and improve the reliability of Todobly;
• prevent fraud, abuse, and unauthorized access; and
• comply with law and enforce our rights.

We do not use your task or event content for advertising, and we do not permit our service providers to use it for their own advertising.

Service providers and other third parties

We share information only as needed to operate Todobly, when you direct us to, or when law requires it. Our current production providers are:

• Clerk provides account registration, email/password and Google authentication, session management, and account deletion. It processes account, identity, authentication, session, device, and security information.
• Googlereceives and returns authentication information if you choose Google sign-in. Google's handling is also governed by your Google settings and its privacy policy.
• Neon hosts our PostgreSQL database containing Todobly user records, identity links, tasks, and calendar events.
• Vercel hosts the Todobly website and API. It processes requests and may retain network, security, performance, and runtime logs, including IP and device information and data transmitted through the service.
• Resend delivers the welcome email and processes your email address, the message content, and delivery metadata. Todobly does not enable Resend open or link tracking in its send request.
• Appledistributes the iOS app and may process App Store, download, and diagnostics information under Apple's own privacy terms.

These providers may use their own subprocessors and process information in the United States or other countries. We require providers acting for us to protect personal information consistently with their contracts and applicable law. We may also disclose information to comply with legal process, protect people or the service, or as part of a business transfer.

Retention and deletion

Todobly keeps your account record, tasks, and events while your account is open so the service can synchronize them. Completing or discarding a task changes its state; it does not delete the database record. The welcome-email timestamp is also kept while the account is open to prevent duplicate messages.

You can delete your account from the in-app Account screen or the web Account page. The deletion flow removes your tasks, events, identity links, and Todobly user record from the active database, then deletes your Clerk identity. You can also request help at support@todobly.com. Deletion is permanent and cannot be undone.

Our processors may keep limited copies in backups, security logs, or legal records until their normal retention periods expire. Resend states that email data is retained for 30 days across its standard plans. Clerk and other providers may retain limited information longer where needed for security, dispute resolution, legal compliance, or enforcing agreements. Support messages are kept only as long as reasonably needed to respond, maintain a record of the request, protect the service, or comply with law.

Your choices

You may ask to access, correct, or delete your personal information, and may have additional rights depending on where you live. Account deletion is available directly in Todobly. For another privacy request, email support@todobly.com. We may need to verify that the request belongs to you. You can stop future collection by deleting your account and uninstalling or no longer using the service.

Children

Todobly is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided information to us, contact us so we can investigate and delete it.

Security and changes

We use reasonable administrative, technical, and organizational measures to protect information, but no internet service can guarantee absolute security. We may update this policy as Todobly changes. We will post the revised policy here, update the date above, and provide additional notice when required.

Contact

Questions or privacy requests can be sent to support@todobly.com.