Privacy policy

Last updated:

This policy explains what TomTodo stores about you, why, and how to have it removed. The short version: we keep your email address and your tasks, use them only to run the service, and do not track you.

What we store

  • Your email address, which identifies your account.
  • Your tasks and the data that belongs to them: titles, subtasks, flags, estimates, repeat schedules, repetition history, ordering and the worklog of active periods.
  • Connected apps, only if you connect an AI assistant: which assistant you approved, when, and the access tokens it uses, so that you can see and remove it.

We do not ask for your name, phone number, address or payment details, and we do not store them.

How we use your email address

We use your email address only to send you 6-digit login codes when you sign in. We do not send newsletters or marketing email, and we do not sell, rent or share your email address or tasks with anyone for their own use. The only exception is an AI assistant that you connect yourself, described below.

Where your data is stored

Your data is stored on Google Cloud, in a Firestore database located in the EU (Frankfurt, Germany). Google acts as our infrastructure provider and processes the data on our behalf. Data is encrypted in transit, and Google encrypts it at rest.

Who can see your data

Your tasks are private to your account; other users cannot see them. TomTodo has no admin interface for viewing users’ tasks, and task contents are never written to logs.

TomTodo is operated by Laszlo Barta. As the owner of the cloud account, he has technical access to the database. He accesses production data only:

  • when you ask, for example for support, an export or deletion;
  • when required by law;
  • to investigate a security incident.

Any such access is limited to what is needed for that purpose.

This is not end-to-end encryption. Your data is encrypted in transit and at rest, but the service can read it in order to work. If you need end-to-end encryption, don’t store highly sensitive information in TomTodo, such as passwords, health or financial details.

Cookies and local storage

  • The public website (this page and the other pages outside /app/) sets no tracking or analytics cookies and loads no third-party scripts.
  • The app at /app/ stores your login token in your browser's localStorage so you stay signed in. It is removed when you sign out, or you can clear it in your browser settings.

AI assistants and connected apps

You can connect TomTodo to an AI assistant, such as Claude or ChatGPT, through our connector at https://tomtodo.com/mcp. See Use TomTodo with your AI assistant.

  • Access only with your approval. The connection uses OAuth: you sign in to TomTodo with your email code and click Allow. Only then does the assistant receive an access token. It never sees your login codes.
  • What the connector can access. Your tasks and their data (listed above): it can read, add, update, complete and delete tasks and start or stop timers on your behalf. It cannot see or change your email address, and it cannot access other people’s accounts.
  • What the assistant’s provider sees. Task text the assistant reads or writes in a conversation is sent to and processed by the assistant’s provider (for example Anthropic or OpenAI), under their own privacy policy. We are not responsible for how they handle it.
  • Revoking access. In the app, open the Account menu → Connected apps and remove the assistant; its tokens stop working immediately. Deleting your account also revokes every connection. Removing the connector in the assistant’s settings stops it from using TomTodo as well.

How long we keep data

We keep your account and tasks for as long as your account exists. Tasks you delete in the app are removed. When you delete your account, your email address, all of your tasks and any connected apps are deleted.

  • Deleted accounts are removed immediately, including any copies held in the database.
  • Login codes expire after 10 minutes.
  • Server logs contain no task content and are kept for 30 days.

Your data: export and deletion

Download your data any time: in the app, open the Account menu and choose Export my data to download all of your tasks as a JSON file.

Delete your account instantly: open the Account menu and choose Delete account. Your email address and all of your tasks are deleted right away.

You can also ask for your data, a correction, or deletion of your account by emailing support@tomtodo.com from the address you use to sign in, so we can confirm the request is yours. We aim to handle email requests within 30 days.

Children

TomTodo is not directed at children under 16, and we do not knowingly collect data from them.

Changes to this policy

If we change this policy, we will update the date at the top of this page. For significant changes, we will also show a notice in the app.

Contact

Questions about privacy: email support@tomtodo.com. See also who is behind TomTodo.