Privacy Policy

Last updated: 2026-10-09

What we store

Your tasks live on your device first. If you sign in, we store your account (name, email, avatar from your sign-in provider) and an encrypted-in-transit copy of your tasks to sync them across devices.

How we protect it

TLS everywhere, OAuth tokens encrypted at rest with AES-256-GCM, session identifiers stored only as hashes, encrypted daily backups with 30-day retention, and strict access controls.

Third parties

Sign-in and calendar features use Google, Naver or Microsoft only when you choose them. AI features send only the task text you select to our AI provider (OpenAI or Hugging Face) and it is not used for advertising.

Your rights

Export everything as JSON or delete your account at any time in Settings — deletion is immediate and permanent across our systems; backups age out within 30 days.

Contact

See security.txt for our contact address.