Privacy Policy

Todo is a task manager. This policy explains what information the app handles, where it is kept, and what happens when you choose to sign in with Google. In short: your tasks stay in your browser, and if you sign in they are also kept in your own Google Drive. We do not run a database of user data, and we do not sell or share it.

Information the app handles

• Your tasks and organisation: projects, sections, tasks, subtasks, labels, due dates, priorities and descriptions that you type into the app.
• Your Google account details (only if you sign in): your name, email address and profile picture, used to show who is signed in.
• Settings: small preferences such as sidebar width, stored in your browser.

Where your data is stored

• In your browser. Your tasks are saved in your browser’s own storage (IndexedDB and local storage) on your device. Clearing your site data removes this copy.
• In your Google Drive, only if you sign in. The app saves one file in a hidden app-data folder of your Drive that only this app can read, and a “Todo” folder in My Drive containing a readable copy (Todo.md and todo-backup.json). This data goes directly between your browser and Google. It does not pass through, and is not stored on, any server we operate.
• Hosting. The website is delivered by Vercel. Like any web host, it may keep standard technical logs (such as IP address and requests) for security and reliability. Your task data is not part of these logs.

Google sign-in and the permissions we ask for

Signing in is optional. If you do, the app asks Google for these permissions:

• Profile and email (openid, email, profile): to show your name, email and picture.
• Google Drive app data (drive.appdata): to read and write the hidden file that keeps your tasks in sync between your devices.
• Google Drive files created by this app (drive.file): to create and update the “Todo” folder with readable copies. This permission only lets the app see files it created itself, never your other Drive files.

Todo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features described above. We do not transfer it to others, use it for advertising, or allow humans to read it.

Sharing

We do not sell your data and do not share it with third parties. The only parties involved are Google (when you sign in) and Vercel (the web host), as described above.

Cookies and tracking

The app does not use advertising or analytics trackers. It uses your browser’s storage to save your tasks and preferences, and, while you are signed in, the current tab keeps a short-lived Google access token in session storage. Google’s sign-in script may set its own cookies when you sign in.

Your choices and control

• Export: Settings → Export backup downloads all your data.
• Log out: stops syncing and keeps the data on this device.
• Remove account: Settings → Remove account deletes the synced file and the Todo folder from your Google Drive and signs you out.
• Delete everything: Settings → Delete all data removes your data from this browser.
• Revoke access: you can remove the app’s access at any time in your Google Account permissions.

Children

The app is not directed to children under 13 and we do not knowingly collect their information.

Changes to this policy

If we change this policy, we will update the date at the top of this page. Significant changes to how Google data is used will be described here before they take effect.

Contact

Questions about this policy? Open an issue at https://github.com/vasylhlodan/todoapp/issues.