Privacy Policy

Last updated October 29, 2026

TooDue is a to-do app. This policy explains what we collect when you use the hosted service at app.toodue.com and the TooDue apps for iPhone and Android, and what we do with it. The short version: we store what you need to manage your tasks, we don't sell it, we don't show ads, and we don't track you.

What we collect

• Account details: your name, email address and a salted, hashed password (we never see or store the plain password).
• Your content: projects, tasks, sub-tasks, comments, file attachments and project templates you create, and the members of projects you share.
• Sign-in sessions: a random session token kept on your device so you stay signed in.
• Integrations you turn on: if you connect Google Calendar, we store the OAuth tokens Google gives us and the IDs of the calendar events we create. If you connect an AI agent or create an API key, we store a hashed key or token and when it was last used.
• Server logs: standard request logs (IP address, time, request path) kept briefly for security and debugging.

What we don't do

• No advertising, ad networks or third-party analytics SDKs, in the apps or on the site.
• No selling or renting your data, and no tracking across other companies' apps or websites.
• No reading your tasks except when you ask for support or we must to keep the service running or comply with the law.

How your data is used

Only to run TooDue: storing and syncing your tasks across your devices and with people you share projects with, keeping your account secure, and sending the calendar events you asked us to create.

Third parties

• Google Calendar, only if you connect it. TooDue's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• AI agents you connect (for example via MCP) can read and change the tasks you grant them access to. You can disconnect them any time in Settings.
• Hosting: TooDue runs on servers we rent; the hosting provider doesn't get access to your content beyond operating the hardware.

Security

All traffic is encrypted with HTTPS. Passwords are hashed with Argon2. API keys and agent tokens are stored hashed.

Retention and deletion

We keep your data while your account exists. You can delete your account at any time in the app: open Settings → Delete account. That immediately and permanently removes your account, your projects, tasks, comments, attachments, API keys and integrations. Tasks you added to someone else's shared project stay in that project. Backups roll off within 30 days. You can also email support@toodue.com and we'll delete it for you.

Self-hosting

If you run your own TooDue server, your data lives on that server and this policy doesn't apply to it.

Children

TooDue isn't directed to children under 13, and we don't knowingly collect their data.

Your rights

You can access, export, correct or delete your data. Most of this you can do in the app; for anything else, email support@toodue.com.

Changes

If we change this policy we'll update the date above, and tell you in the app for material changes.

Contact

Questions? support@toodue.com