Summary
Todo & Timer is operated by Yunsong Feng, an individual, who is responsible for the personal data described here. Contact: stormvite@gmail.com.
We keep what's needed to run your lists and timer, and nothing we don't need. We don't sell personal data and we don't use your tasks for advertising.
Without an account
Tasks, settings and focus history are stored only in your browser. They are not sent to our servers. We don't use device fingerprinting to track guests.
With an account
We store your email address, lists, tasks, notes, focus history, settings, attachments you upload, and the devices you're signed in on. This is used to provide sync and the features you use.
- Passwords are stored only as salted one-way hashes (scrypt); we can't read them. Email verification codes are stored the same way and expire after 10 minutes.
- If you sign in with Google, we receive your email address, your name and a link to your Google profile picture. We use the name and picture only to show your account in the app, and refresh them each time you sign in with Google. We don't receive your Google password or access your contacts, Drive or other Google data.
- Our staff can't browse your tasks or open your files from the admin tools. Support works from account status and usage, not your content.
- Admin actions are recorded in an append-only audit log.
Analytics and logs
Operational logs and product metrics never include task text, file names or contents, share tokens, sign-in codes or payment details.
Export and deletion
You can export your data at any time. Deleting your account starts a 7-day waiting period you can cancel; after that, lists, history and files are permanently deleted. Backups expire on their own schedule, and deletions are re-applied if a backup is ever restored.
Payments
Purchases are processed by Paddle.com, our reseller and merchant of record. Your card or other payment details go directly to Paddle and never reach our servers. Paddle's own privacy notice covers the information it collects to process payments, prevent fraud and meet tax obligations.
From Paddle we receive what we need to give you access and support your purchase: your email address, the plan and billing period, payment status, amount, country for tax purposes, and invoice numbers.