Data & Account Information

This policy explains what account and application data Todoal collects, stores, uses, and protects when you use the Todoal service.

1. Account Information

When you create or use a Todoal account, we may process information associated with your account including email address, display name, authentication identifier, account creation timestamps, login information, account preferences, subscription status, billing status, timezone, and notification preferences. Authentication may be provided through third-party authentication services such as Firebase Authentication.

2. Todoal Application Data

Todoal stores information that you intentionally create inside the application, including tasks, task completion status, task dates, Permanent Reminders, reminder completion history, Yearly Goals, email schedules, theme preferences, application settings, and subscription information. This information is used solely to provide the Todoal features you request.

3. Timezone Information

Todoal stores your selected timezone because scheduled features depend on your local time. For example, a user in New York may use America/New_York while a user in India may use Asia/Kolkata.

Todoal uses the stored IANA timezone identifier to calculate your local date and time when processing scheduled email notifications. Your timezone is not converted into a permanently fixed UTC schedule because doing so could cause notifications to become incorrect when local timezone or Daylight Saving rules change.

4. Subscription and Billing Information

If you purchase Todoal Pro, we may store information required to manage your subscription, including subscription status, billing interval, Paddle customer identifier, Paddle subscription identifier, period dates, and cancellation status. Payment card information is handled by Paddle and is not stored directly by Todoal.

5. Email Information

If you enable Todoal Pro email notifications, we process your email address, notification preferences, scheduled email times, timezone, email delivery status, and delivery history. Email delivery history is used to prevent duplicate notifications and enforce daily delivery limits.

6. Feedback Information

Todoal does not permanently store submitted feedback in the application database. When you submit feedback, the authenticated backend validates the submission and securely forwards it to Todoal through its designated support communication system (Telegram Bot integration).

7. Account Security

Todoal uses technical controls designed to protect account information, including token authentication, database access controls, Row Level Security (RLS), server-side validation, rate limiting, backend authorization, secure payment processing, and restricted administrative access.

8. Data Access

Your account data is accessible only to you and authorized Todoal systems, except where access is necessary to provide the service, comply with legal obligations, prevent abuse, protect security, or operate Todoal.

9. Data Retention

Todoal retains account and application data for as long as reasonably necessary to provide the service, maintain security, comply with legal obligations, and maintain business records. When an account is permanently deleted, associated data is deleted or anonymized where technically and legally appropriate.

10. Account Deletion

You may request deletion of your Todoal account through available account settings or by contacting contact@todoal.com. Account deletion permanently removes application information associated with your account.

11. Your Data Protection Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correction, deletion, restriction, data portability, objection, and lodging complaints with data protection authorities.

12. Legal Basis for Processing

Where GDPR or similar laws apply, processing is based on performance of a contract, compliance with legal obligations, legitimate interests, or consent where legally required.

13. Third Party Service Providers

Todoal uses reputable third-party services for authentication, database infrastructure, payment processing, email delivery, hosting, security, and analytics. Details are available in our Subprocessors Policy.

14. International Data Processing

Where data is processed outside your home country, Todoal uses appropriate legal safeguards required by applicable data protection laws.

15. Changes to This Policy

Todoal may update this policy when services, technology, or legal requirements change. The updated version will be published with a revised Last Updated date.

16. Contact

For questions regarding your account data, personal information, or data rights, contact: