Legal

Privacy policy

01Who we are

Tododay ("we") is the app and this website, run by Máté Magyar, an independent developer based in Hungary, who is the data controller for everything described here. For anything related to your data, write to [email protected]. Contacting us by email is the fastest way to exercise any of the rights below.

02What we collect

Your email address: used only to sign you in, to send the account emails described below (codes you request, a welcome when you sign up, and security notices when something important changes on your account), and, if you write to us, to reply. You can change it any time inside the app.
Your password: never sent to us. The app derives a separate sign-in key from it on your device, and we store only a bcrypt hash of that key. Neither the key nor the hash can unlock your encrypted tasks.
Your display name: optional, only if you choose to set one, used only to greet you inside the app. It is end-to-end encrypted, see Encryption below.
Your todos: the text, status (done, missed, staged) and timestamps of your tasks, so they can sync between the app and the server. The text of each todo is end-to-end encrypted, see Encryption below.
Your preferences: like whether unfinished tasks should automatically carry over to the next day, used only to control app behavior for your account.
Basic technical data: like any server, ours briefly processes your IP address to deliver responses and to rate-limit sign-in attempts. Traffic to the app and this website passes through Cloudflare, which handles your IP address and standard request data (such as the page or address requested, browser type, and time) on our behalf to deliver traffic and block attacks. None of it is used to build a profile of you.
Messages you send us: if you write to us through the contact form or by email, we receive your email address and your message.
This website: uses no cookies, no analytics, and no advertising trackers. If you use the account-deletion form, we receive the email address and code you type into it.

This is the complete list of data we collect. We do not collect location data, contact lists, or device fingerprints, and none of the above is ever used for profiling or personalised advertising.

An email address and a password are needed to create an account, since the app can't sync your lists without one. Everything else is optional: you can leave your name blank and still use every feature.

03Why we process it

We use your data only to run the service you signed up for. Data protection law (the GDPR) asks us to name a legal basis for each purpose, so here they are:

Running the app and syncing your lists (your email, sign-in data, todos, name, preferences): necessary to provide the service you agreed to in our terms (Art. 6(1)(b) GDPR).
Account emails (codes for password resets, email changes and account deletion, a welcome when you sign up, and a confirmation when your account is deleted): also part of providing the service (Art. 6(1)(b)). The security notices we send when your password is changed or reset, when a new recovery key replaces the old one, and to your old address after an email change are based on our legitimate interest in keeping accounts safe (Art. 6(1)(f)).
Security and abuse prevention (IP address and request data): our legitimate interest in keeping the service and your account secure, for example by limiting sign-in attempts (Art. 6(1)(f)).
Answering your messages (your email address and message): our legitimate interest in replying to you, or performing our contract with you when the message is about your account (Art. 6(1)(f) and (b)).
Legal obligations: in the rare case the law requires us to keep or hand over data, see When we would share data below (Art. 6(1)(c)).

We don't rely on consent for anything, so there is nothing to withdraw, and we never make automated decisions about you or profile you.

04Where it lives

Your account and todos are stored on a server we set up and run ourselves, rented from Hetzner Online GmbH in the EU. Hetzner provides only the hardware and network and acts as our data processor; it does not run any service on our behalf. The app also keeps a copy of your list on your own device so it works offline, and the optional home-screen widget reads that same on-device copy to show today's list on your home screen. The widget introduces no new collection and sends nothing anywhere, though anyone who can see your home screen can of course see the tasks it displays. The website and app sit behind Cloudflare for security and performance. Cloudflare acts as our data processor under its data processing agreement, and as a US company it may process that network-level data outside the EU; such transfers are covered by Cloudflare's certification under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. Emails we send you go out through our own mail server on that same machine. Beyond Hetzner and Cloudflare, nothing personal is shared with, sold to, or processed by any third party, except in the two situations described under When we would share data.

You install and update the app through Google Play, and the app asks Google Play whether a newer version is available. Google handles that under its own privacy policy; the app sends Google nothing from your account.

A few features work entirely on your device and send us nothing new. The suggestions that appear while you type a task come from your own earlier tasks, matched on your phone. Text you share into Tododay from another app stays on your phone until you choose to add it to a list; it then becomes a task like any other, encrypted before it syncs, and if you close the sheet instead it is discarded. The app accepts only plain text this way, never files or images. Your choice of light or dark mode is saved only on the device.

06What we will never do

Sell your personal data or your todos to anyone.
Use your account, your todos, or how you use the app to target ads at you.
Build a personal profile of you or track you individually across the web.
Email you anything except replies to messages you send us and the emails your account itself needs: password reset codes, email change confirmations and account deletion codes; a welcome when you sign up; security notices when your password is changed or reset, when a new recovery key replaces the old one, and to your old address if your account email is changed; a confirmation when your account is deleted; and advance notice of important changes to this policy or our terms. Never newsletters or marketing.

Any promotion of the app is generic and never uses anything drawn from your account.

07Security

Your password never leaves your device; we store only a bcrypt hash of a separate sign-in key derived from it. Session tokens are stored only as SHA-256 hashes, so a copy of the database cannot be used to hijack a session. Emailed codes expire after 15 minutes and allow only a handful of attempts per hour, and sign-in attempts are rate limited per network and per account. Changing your password signs out every other device automatically. No security is perfect, but nothing we store is usable in plain form.

If a security incident ever exposed personal data in a way that puts you at risk, we would tell you without undue delay, explain what happened and what to do, and report it to the data protection authority as the law requires.

08Encryption

Your todo text and display name are encrypted on your device before they are ever sent to our server, using a key derived from your password. We store only the encrypted result and a copy of that key locked with your password, which never reaches us. We cannot open either one, and neither could anyone who copied our database or our network traffic.

A few fields stay unencrypted so the app can function: your email address, needed to sign you in, and basic todo metadata: status (done, missed, today, staged), the day a task belongs to, when it was created and completed, its priority colour, and its position in the list. That lets sync work without exposing what a task actually says.

Tasks often hold personal things, like a doctor's appointment or a medication reminder. We never ask for that kind of information, but whatever you write is encrypted on your phone before it leaves it, so we cannot read it and never use it for anything.

This has one real consequence worth knowing: because we cannot read or recover your encrypted content, resetting a forgotten password normally cannot bring your existing tasks back. When you create your account, the app gives you a one-time recovery key. Save it somewhere safe, it lets you reset your password without losing your tasks. Without it, a password reset starts your account's tasks fresh, there is no back door we can use to recover them, since building one would undermine the protection itself.

09Sessions

When you log in, you remain logged in on that device until you log out, change your password, or clear the app's data. This is a deliberate choice: a personal productivity app should not require you to re-enter your password on a regular basis. As a safeguard, a login that has not been used at all for twelve months is removed on our side; the device simply asks you to log in again.

10How long we keep it

Your account and todos: until you delete them. Deleting a todo in the app deletes it on the server too, and deleting your account deletes everything tied to it at once.
Backups: for disaster recovery we keep daily backups of the database for up to 14 days, so deleted data also disappears from those within two weeks. Like the live database, backups hold your tasks only in encrypted form.
Emailed codes: they expire after 15 minutes and are then deleted from our server, along with the new address of an email change that was never confirmed. Each code works only on the device or page that requested it, and a new request from there replaces the old code.
Logins: a login that hasn't been used for twelve months is removed (see Sessions).
Technical data: rate limits for sign-ins and emailed codes are counted in memory only for the length of the limit (at most a day), our server does not log IP addresses, and technical logs rotate automatically. Cloudflare keeps its own short-lived logs under its terms.
Messages you send us: deleted within 24 months of the last message in the conversation, unless we need them for an open legal claim.

11Your rights

You have the right to access the personal data we hold about you, to correct it, to get a copy in a portable format, to have it erased, to restrict how it is used, and to object to processing based on our legitimate interests. We give these rights to everyone who uses Tododay, wherever you live.

Most of it you can do yourself, right away, in the app: correcting your email is Me, then Manage account, then Change email (we confirm the new address with a code and notify the old one; this opens once your account is a day old, and before that we correct it for you if you write to us), and both export and deletion are one tap away: open Me, tap Manage account, then Export data or Delete account. Export writes every task you have to a file, in full, readable and machine-readable (JSON) form, since it comes straight from your own decrypted copy, not from us (we could not decrypt it if we tried). Deletion is immediate and permanent: your account, your todos, and everything tied to them are gone the moment you confirm your password.

No app on hand, or no access to your device? Delete your account at tododay.co/delete-account with a code sent to your email, or write to [email protected]. For any other request, write to us from the address you signed up with, so we can be sure it's really you. Requests are free, and we answer within one month (if a request is unusually complex, we may need up to two more months, and we'll tell you why).

If you think we've handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a data protection authority: ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, [email protected], or you can contact the authority where you live or work.

Because nothing on this website or in the app tracks you, there is nothing for "Do Not Track" or Global Privacy Control signals to switch off, and we don't sell or share personal information in the sense of US state privacy laws.

12Children

Tododay is not directed at children under 13 (or the higher age your country requires), and we do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.

13Changes

Whenever this policy changes, the date at the top is updated. For changes that matter, such as collecting a new kind of data, a new provider handling your data, or anything that reduces your rights, we'll give at least 30 days' notice on this page, in the app's store listing, and by email to account holders, so you can decide whether to keep using Tododay. Earlier versions are available on request. The principle behind this policy, that your data belongs to you, will not change.

14Contact

Questions about this policy, or requests regarding your data, can be sent to [email protected].