Privacy Policy

• Account information: the email address you use to create or log into your account, plus your display name and avatar URL if you sign up or log in with Google.
• Content you create: projects, tasks, and their associated metadata, including names, descriptions, due dates, priorities, and phases.
• Billing information: if you purchase a paid plan, we collect your name and billing address. Payment card details are collected and processed directly by Stripe; they are never transmitted to or stored on our servers. Stripe provides us with a truncated card number (last four digits), card brand, expiration date, and billing postal code for your records.
• Connected integrations: if you connect Slack, we store an encrypted access token for your Slack workspace, your Slack workspace and user IDs, and the email address on your Slack profile so we can match it to your ToDidIt account. Disconnecting Slack removes all stored Slack data.
• Push notification subscriptions: if you enable push notifications, we store the endpoint your browser provides and the encryption keys needed to send messages to that device. Disabling push notifications deletes this data.
• Calendar feed links: if you create a calendar subscribe link, we store the secret token that makes it work. Anyone holding that link can read the tasks it exposes. The link is unlisted and revocable at any time from your account settings.
• Passkey credentials: if you register a passkey, we store the public key credential and a credential identifier generated during registration. See Section 7.3 for details.

• Usage data: pages viewed, actions taken within the product, and standard server log data, including your IP address, browser user agent, and request timestamps.
• Device information: browser type, operating system, screen resolution, and language preference.
• Cookies and similar technologies: see Section 4.

Authenticate your account, store and display your tasks and projects, process payments for paid plans, deliver push notifications you have enabled, and process your connected integrations.

Legal basis (GDPR): performance of our contract with you (Article 6(1)(b)).

Analyze usage patterns, identify and fix bugs, and evaluate potential new features.

Legal basis (GDPR): legitimate interest in improving our service (Article 6(1)(f)). You may object at any time; see Section 13.

Send login codes, account-related notices, security alerts, and service updates necessary to operate your account.

Legal basis (GDPR): performance of our contract with you (Article 6(1)(b)); legitimate interest in keeping you informed about your account (Article 6(1)(f)).

Send product announcements, feature updates, newsletters, and tips for using ToDidIt.

Legal basis (GDPR): consent (Article 6(1)(a)) for users in the EEA, UK, and Switzerland; legitimate interest with opt-out (Article 6(1)(f)) elsewhere. See Section 8 for how to opt out.

Monitor for unauthorized access, investigate suspicious activity, and enforce our Terms of Service.

Legal basis (GDPR): legitimate interest in protecting our service and users (Article 6(1)(f)).

Respond to lawful requests from public authorities and maintain records required by applicable law.

Legal basis (GDPR): legal obligation (Article 6(1)(c)).

• Auth session cookie: keeps you signed in. Duration: 400 days, renewed each time your session refreshes. Strictly necessary.
• Theme preference cookie: remembers your light or dark mode choice. Duration: 1 year. Functional.
• Analytics choice cookie: records whether you have accepted or declined analytics so we do not ask again. Duration: 1 year. Functional.

Because these cookies are strictly necessary or functional, they do not require consent under applicable law.

Analytics cookies are set by the tools described in Section 5and load only in accordance with the consent rules described there. Duration varies by provider; see each provider’s cookie policy for details. Ahrefs Web Analytics sets no cookies.

Inside the European Economic Area, the United Kingdom, and Switzerland, no analytics tools load until you actively agree. Elsewhere, analytics load by default, and you may turn them off at any time using the control on any ToDidIt page or from your account settings. Your choice takes effect immediately; turning analytics off stops collection and removes analytics cookies.

We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, analytics remain off without any action on your part. We do not rely on the older “Do Not Track” header, which browsers no longer send consistently.

When you connect Slack, we read only the messages you explicitly act on, such as turning a message into a task or drafting a project from a thread. We post into channels you have subscribed to notifications. We do not passively read or store channel history.

Before posting to a channel, we verify that every human member of the channel is authorized to see the underlying task. If any member is not authorized, the post is skipped.

Disconnecting Slack removes all stored tokens and Slack-related data from your account.

The calendar subscribe feed is read-only and one-way. Calendar providers such as Google Calendar and Apple Calendar fetch the feed on their own schedule. Nothing they do writes data back to ToDidIt.

When you create an account or log in with Google, we receive your email address, display name, and profile picture URL from Google’s OAuth response. We do not request or access any other Google data (such as your contacts, calendar, or Drive files).

When you create an account or log in with email, we send an 8-digit verification code to the address you provide. That address is stored as your account identifier. The code is single-use, expires after a short period, and is not retained after use or expiration.

You may register a passkey (a FIDO2/WebAuthn credential) as a way to sign in without a password or code. When you register a passkey, your device generates a public-private key pair. We store only the public key and a credential identifier on our servers. The private key never leaves your device and is never accessible to us.

When you sign in with a passkey, your device uses the private key to sign a challenge we send. We verify the signature against the stored public key. No shared secret is transmitted during this process.

You can remove a registered passkey from your account settings at any time, which deletes the stored public key and credential identifier from our servers.

We use the following third-party service providers who process data on our behalf and under our instructions:

• Supabase (hosted on AWS): database hosting and authentication. Processes account data and content you create.
• Vercel: application hosting and deployment. Processes server logs and request data.
• Stripe:payment processing. Processes billing information and payment card details for paid plans. Stripe’s privacy policy: stripe.com/privacy
• MailerSend: transactional email delivery, including login codes, account notifications, and security alerts. Processes email addresses and message content. Privacy policy: mailersend.com/legal/privacy-policy
• MailerLite: marketing email delivery, including newsletters and product announcements. Processes email addresses, subscription preferences, and engagement metrics (opens and clicks). Privacy policy: mailerlite.com/legal/privacy-policy
• Google Analytics 4: usage analytics. Processes anonymized usage data and IP addresses.
• Microsoft Clarity: session replay and heatmaps. Processes anonymized interaction data.
• PostHog: product event analytics. Processes product event data.
• Ahrefs: web analytics. Processes page view and referrer data.

Each provider is bound by a data processing agreement and may process your data only as necessary to provide their service to us.

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or where we believe in good faith that disclosure is reasonably necessary to protect our rights or property, your safety or the safety of others, investigate fraud, or respond to a lawful government request.

If Andpixels LLC is involved in a merger, acquisition, reorganization, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you by email or by a prominent notice on ToDidIt before your information becomes subject to a different privacy policy.

We may share your information in circumstances not described above if you give us your explicit consent to do so.

Regardless of where you are located, you may at any time:

• Export your dataas a JSON file from the user menu (“Export Data”).
• Delete a project from its settings page, which permanently deletes all tasks within that project.
• Delete your account from your profile page. Deletion is immediate and permanent: it removes your workspaces, projects, tasks, comments, and any connected integrations, subject to the retention periods in Section 12.

Under the GDPR and UK GDPR, you have the following additional rights with respect to your personal data:

• Access: request confirmation of whether we process your personal data and, if so, a copy of it.
• Rectification: ask us to correct inaccurate or incomplete personal data.
• Erasure: ask us to delete your personal data where there is no compelling reason for continued processing.
• Portability: receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller.
• Restriction: ask us to restrict processing of your personal data in certain circumstances (for example, while we verify its accuracy).
• Objection: object to processing of your personal data based on legitimate interest, including for direct marketing purposes. Where you object to direct marketing, we will stop immediately.
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at todidit.com/contact. We will respond within 30 days, or within any shorter period required by applicable law. We may ask you to verify your identity before processing your request.

You also have the right to lodge a complaint with your local data protection supervisory authority.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), provides California residents with specific rights regarding their personal information.

• Right to Know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: you may request that we delete the personal information we have collected about you, subject to certain exceptions permitted by law.
• Right to Correct: you may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing:we do not sell your personal information, and we do not “share” it (as that term is defined under the CCPA/CPRA) for cross-context behavioral advertising. There is nothing to opt out of.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your rights under the CCPA/CPRA.

Categories of personal information we collect, as defined by the CCPA:

• Identifiers (email address, display name, IP address, device identifiers, Slack user ID).
• Commercial information (billing name, billing address, transaction history, subscription plan).
• Internet or other electronic network activity information (pages viewed, actions taken, server logs, analytics data).
• Other information you create or provide (task content, project data, descriptions).

We collect these categories for the business purposes described in Section 3. We have not sold or shared personal information in the preceding 12 months. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CCPA/CPRA.

To exercise any of these rights, contact us at todidit.com/contact. We will verify your identity before processing your request and respond within 45 days, or within any shorter period required by law. You may designate an authorized agent to submit a request on your behalf by providing us with the agent’s written authorization signed by you.