Your data is yours.

Your account. When you sign in with Apple, Google, or an email address, we store the email address (and, for Apple or Google sign-in, the name those services share) so you can sign in on other devices and be found by shared-list invites. You can also use To Done as a guest without giving us any of this; guest accounts that stay unused for 30 days are deleted automatically.

Your tasks. Tasks you create in To Done — titles, notes, checklists, tags, lists, due dates, repeat rules, priority, effort, places you attach, and optional photo or file attachments — are stored on your device and, when you are signed in, synced to our servers so they follow you across devices.

Shared lists. If you share a list, that list and its tasks, including attachments, are visible to the members you invite, along with the email address you signed in with.

• Apple Reminders. With your permission To Done reads and updates your reminders through Apple’s Reminders framework. Reminders are never uploaded to our servers.
• Google Tasks. To Done talks to Google directly from your device. Your Google Tasks are never uploaded to our servers. The sign-in token that keeps you connected is stored in your device’s Keychain; when you are signed into To Done we sync only the account’s email address and on/off setting so the connection appears on your other devices, where you re-authorize once.
• Location. Location reminders are handled entirely on your device. The place you attach to a task (its name and coordinates) syncs with the task; your own location is never stored or uploaded.
• Calendar. Find a Time reads your calendar on the device to suggest open slots and, only when you choose, adds a calendar event. Calendar data is not uploaded.
• Siri, Shortcuts, widgets, and the share sheet run on the device. The widget completes tasks through our servers using a key that identifies only your installation.

To Done is built on Google Firebase. Task data is stored in Cloud Firestore, attachments in Firebase Storage, and sign-in is handled by Firebase Authentication. We use Firebase Cloud Messaging to send your other devices a silent “something changed” signal so they refresh; that signal carries no task content. Daily backups of the database are kept for 30 days, and deleted attachments may remain in soft-delete storage for up to 30 days before being removed.

We do not use analytics, advertising, or crash-reporting SDKs.

Due-date, snooze, and location reminders are local notifications scheduled on your device. You can change or revoke notification and location permissions at any time in your device settings.

• Export every task, list, place, and Logbook entry as JSON or CSV from the Sources screen.
• Disconnect Apple Reminders or any Google account from the Sources screen, and change notification, location, and calendar permissions in device settings.
• Restore deleted tasks from the Trash for 30 days on the device where they were deleted.
• Delete your account from the Sources screen. This immediately removes your tasks, lists, attachments, connected-account records, and sign-in from our servers. Backups age out within 30 days.

Data travels over encrypted connections. Server-side rules restrict each person’s data to their own account and restrict shared lists and their attachments to list members. Google tokens live in the device Keychain. No method of transmission or storage is completely secure, but we work to protect the data entrusted to To Done.

To Done is not directed at children under 13, and we do not knowingly collect information from them.

If this policy changes, we will update the date at the top of this page. Significant changes will also be noted in the app.

For privacy questions or requests, email support@todonenow.com. The Support page covers account and data controls.