Privacy Policy
todone is a todo app. We collect what it needs to keep your lists, nothing to sell and nothing for ads. This policy covers the hosted app; if you run todone on your own server, you hold the data and this policy doesn't apply.
Who we are
The hosted todone service is run by Kartikey Kushwah, an individual in India, who is the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023 (DPDP Act). For anything about your data, write to kushwah.kartikey@icloud.com.
What we collect, and why
| Data | Why |
|---|---|
| Your name, email and password (stored only as a salted hash) | To make your account and sign you in. |
| Your GitHub or Google account ID, name, email and picture, if you sign in with them | To sign you in without a password. |
| Your lists, tasks, ideas, teams, invitations and settings | This is the app: to store them and show them to you and the teams you share them with. |
| The IP address and browser of each signed-in session | To keep you signed in and keep accounts secure. |
| Tokens for services you connect (Google Calendar, Notion, a Discord webhook) | To sync with those services, only when you turn it on. |
| A push address for each device where you turn on reminders | To send the reminders you asked for. |
| Feedback you send, with the page you sent it from and your browser | To fix bugs and improve the app. |
We don't use analytics, advertising or tracking. We don't sell or rent your data, and we don't use it to train AI models.
Consent
We process your data on the basis of the consent you give when you make an account, and for the specific purposes above. You can withdraw consent at any time by deleting your account (Account → Delete account), which stops all processing. Withdrawing doesn't affect what was done before.
Who else handles it
We use these providers to run the service. They process data for us and only as needed:
- Vercel, which hosts the app.
- Neon, which hosts the database.
- GitHub and Google, if you sign in with them or connect Google Calendar.
- Notion and Discord, if you connect them.
- Your browser's push service (Apple, Google or Mozilla), for reminders you turn on.
These providers may store data outside India. We only use providers that protect it, and we don't transfer it to any country the Government of India has restricted. Teammates see the lists and members of the teams you share. We disclose data to authorities only when the law requires it.
How long we keep it
Until you delete it or your account. Deleting a task, list or team removes it; deleting your account removes your account, personal lists, settings, sessions, connected-service tokens, push addresses and feedback straight away, along with any team where you're the only member. Copies can stay in our database provider's backups for up to 30 days before they roll off.
Your rights
Under the DPDP Act you can:
- Get a copy of your data: Account → Export everything (JSON or CSV), or write to us for a summary of what we hold and whom we've shared it with.
- Correct or update it: edit your lists and name in the app, or write to us.
- Erase it: delete it in the app, or Account → Delete account.
- Nominate someone to exercise these rights for you if you die or can't act, by writing to us.
- Complain to us, and if you're not satisfied, to the Data Protection Board of India.
Write to kushwah.kartikey@icloud.com from your account's email. We reply within 30 days.
Grievances
Our grievance contact is Kartikey Kushwah, kushwah.kartikey@icloud.com. We acknowledge complaints within 7 days and resolve them within 30 days. You must contact us before going to the Data Protection Board.
Children
todone is for people 18 and over. We don't knowingly collect data from children; if you think a child has made an account, write to us and we'll delete it.
Security
Connections are encrypted, passwords are hashed, and access is limited to what each account and team may see. If a breach affects your data, we'll tell you and the Data Protection Board as the law requires.
Cookies
We use only the cookies and browser storage the app needs to work. See the Cookie Policy.
Changes
If we change this policy, we'll update the date below, and tell you in the app or by email before a significant change takes effect.
Last updated 2 November 2026.