Skip to content

ChaTodo

ChaTodo+
You're offline — changes are saved locally

Privacy Policy

Personal Data & GDPR

  • Your data is stored on your device by default.
  • Optional cloud sync, enabled by signing in with Google.
  • No analytics, advertising, or third-party tracking tools are used.
  • AI features (chat, categorization) use Anthropic services. Only relevant task content is sent, and only when you use these features.
  • Data export and deletion are available in Settings.

End-to-End Encryption

  • ChaTodo offers optional end-to-end encryption (E2E) for your tasks and lists.
  • When enabled, your data is encrypted on-device with AES-256-GCM before being sent to the cloud.
  • The encryption key is derived from your passphrase via PBKDF2 and never leaves your device.
  • Neither our servers nor Firebase can read the content of your encrypted tasks.
  • If you forget your passphrase, your encrypted data cannot be recovered.

Google User Data

Data We Access

  • Profile information: name, email address, and profile picture (via openid, profile, email scopes).
  • Google Tasks: ability to create, update, and delete tasks in your Google Tasks list (via tasks scope) — only when you enable Tasks sync in Settings.

How We Use Your Data

  • Profile info: used solely for authentication and displaying your name/avatar in the app.
  • Email: used to identify your account.
  • Tasks access: used exclusively to sync your ChaTodo tasks with Google Tasks — only when you explicitly enable this feature.

Data Storage & Retention

  • Profile data (name, email, photo URL) stored in Firebase Firestore under your user account.
  • A Google refresh token is stored server-side in Firestore to maintain Tasks sync without re-authentication.
  • Task-to-Google-Tasks mappings (task IDs) are stored alongside your tasks.
  • Data is retained as long as your account exists.

Data Security

  • All data is transmitted over HTTPS (encrypted in transit).
  • Google user data is stored in Firebase Firestore, protected by Google Cloud infrastructure security.
  • Firestore security rules enforce per-user access — only you can read and write your own data.
  • Authentication tokens are stored securely and never exposed to third parties.
  • OAuth sign-in flows use PKCE (Proof Key for Code Exchange) to protect against authorization code interception.

Data Sharing

  • Google user data is never sold, shared with third parties, or used for advertising.
  • Data is only transmitted between the app and Google APIs for the features described above.

Limited Use Compliance

  • ChaTodo's use and transfer of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Google user data is used only to provide and improve the user-facing features described above.
  • Google user data is not used for advertising, retargeting, or any purpose unrelated to app functionality.
  • Google user data is not used to determine credit-worthiness or for lending purposes.
  • No one reads your Google user data unless you give affirmative consent, it is necessary for security purposes or legal compliance, or the data is aggregated and anonymized for internal operations.

Data Deletion

Cookies & Local Storage

  • A session cookie to keep you signed in (expires after 14 days).
  • Temporary sign-in cookies for security (CSRF and PKCE protection, cleared after authentication).
  • Browser local storage: your tasks, settings, and theme.
  • Offline cache for cloud sync.
  • All of these are strictly necessary for the app to work. No advertising or tracking cookies are used.

Contact

For any questions about your personal data or the site, contact us at: contact@chatodo.app