Summary
Todo & Timer is operated by Yunsong Feng, an individual, who is responsible for the personal data described here. Contact: stormvite@gmail.com.
We keep what's needed to run your lists and timer, and nothing we don't need. We don't sell personal data and we don't use your tasks for advertising.
Without an account
Tasks, settings and focus history are stored only in your browser. They are not sent to our servers. We don't use device fingerprinting to track guests.
With an account
We store your email address, lists, tasks, notes, focus history, settings, attachments you upload, and the devices you're signed in on. This is used to provide sync and the features you use.
- Passwords are stored only as salted one-way hashes (scrypt); we can't read them. Email verification codes are stored the same way and expire after 10 minutes.
- If you sign in with Google, we receive your email address, your name and a link to your Google profile picture. We use the name and picture only to show your account in the app, and refresh them each time you sign in with Google. We don't receive your Google password or access your contacts, Drive or other Google data.
- Our staff can't browse your tasks or open your files from the admin tools. Support works from account status and usage, not your content.
- Admin actions are recorded in an append-only audit log.
Analytics and logs
Operational logs and product metrics never include task text, file names or contents, share tokens, sign-in codes or payment details.
We use Google Analytics 4 on our public pages only — the home page, the pomodoro and template pages, pricing, help and these legal pages. It is never loaded in your workspace, on shared pages or in the back office, so page addresses that could hint at your content are never sent to Google. We send the page path without its query string, and Google receives your IP address (which it shortens), the page, and a random identifier stored in a cookie.
If you turn on the weekly summary email (a paid-plan feature, off by default), we send one email a week to your account address with counts: focus minutes, completed rounds, completed tasks, and how many tasks are overdue or due today. Task titles are included only if you tick “Include task titles” in Settings. Every summary carries a one-click unsubscribe link, and we don’t use tracking pixels, so we can’t tell whether you opened it. The email log keeps only a masked address, the message type and its delivery status — never the contents.
In the EEA, the UK and Switzerland, analytics cookies are set only after you accept them, and you are asked before anything is stored (Google Consent Mode v2). Elsewhere, analytics are on by default. You can change your choice at any time with “Cookie settings” in the footer. We never enable advertising features, remarketing or ad personalisation, and we don’t link analytics to your account.
Study rooms
When you join a study room from its code, we record when you were in the room (the times your phone checked in) so that the study blocks you sat through can be added to your own focus history, optionally on a task you chose. The host sees how many people are in the room and the room's total time, not who you are.
The ranking shows only members who turn on “Show me on the ranking”, with their display name (or an anonymous tag), never an email address. Room attendance is kept for at most 400 days.
Calendar subscription, report links and co-hosts
A calendar subscription address and a report link that updates itself work like keys: anyone who has one can see what it shows (your focus rounds and due tasks; your recent focus statistics) until you change or turn off the address or revoke the link.
When you add a co-host to a countdown, they see its title and controls in their own workspace, and you see their email address and name. Either of you can end it at any time.
Focus guard browser extension
If you connect the focus guard extension, it reads whether a focus round is running (with its end time and task name) and your list of sites and rules. The addresses you visit are compared with your list inside your browser and are never sent to us.
We store your site list and rules, and for each connected browser a label such as “Chrome · Windows” and when it last checked in. You can disconnect a browser at any time in Settings.
Export and deletion
You can export your data at any time. Deleting your account starts a 7-day waiting period you can cancel; after that, lists, history and files are permanently deleted. Backups expire on their own schedule, and deletions are re-applied if a backup is ever restored.
Payments
Purchases are processed by Waffo Pancake, our reseller and merchant of record. Your card or other payment details go directly to Waffo and never reach our servers. Waffo's own privacy notice covers the information it collects to process payments, prevent fraud and meet tax obligations.
From Waffo we receive what we need to give you access and support your purchase: your email address, the plan and billing period, payment status, amount, and country for tax purposes.