1Todo Privacy Policy

1. Who operates 1Todo

Prifecto UG is responsible for the processing described in this policy. Our address is Berliner Straße 69, 13189 Berlin, Germany. Privacy contact: priyom@prifecto.com.

2. Information you provide

1Todo stores the information needed for your account and the content you choose to save. An account is required for the organiser. Please only add information about other people that you are entitled to use, and avoid including sensitive information that is unnecessary for your plans.

• Account: email address, name, optional nickname, authentication identifiers, and profile and reminder preferences. Password authentication is handled by Supabase Auth; passwords are not stored as plain text.
• Plans: project and list titles and descriptions, tasks, subtasks, priorities, deadlines, completion state, and repeat settings.
• People: names, optional contact details and notes, gender if entered, important dates such as birthdays, and links between people and tasks or moments.
• Moments and journal: notes, participant links, dates, optional sentiment, and any other content you enter. The service also supports optional text describing a place; it does not request your device's GPS location.
• Sharing: recipient email addresses, invitations, and shared project or list content. Recipients can access the content you choose to share and the owner information needed to identify the invitation.
• Sharing safety: accepted Terms versions and dates, blocked account identifiers and email addresses, and reports containing your reason, optional details, relevant shared-content context, and moderation outcomes. Prifecto handles reports through a private review queue.

3. Technical information and local storage

Requests to our services include technical information such as IP addresses, request timestamps, and browser or device information. Our rate limiter stores request counts and identifiers to prevent abuse. Hosting and authentication services may keep access, security, and error logs.

The app keeps authentication sessions, preferences, and cached organiser data on your device so navigation can be responsive. Mobile sessions use locally stored tokens and authenticated API requests; web sessions use cookies. There is no advertising SDK or third-party analytics tracking integrated into the current app.

4. Optional connections and email

If you connect Google Calendar, we store the access and refresh tokens, calendar identifier, and synchronization information needed to keep your tasks and their deadlines in a dedicated calendar. New connections use a calendar created for you by 1Todo. Task titles, descriptions, and deadlines are sent to Google; changes to linked calendar events are read to update tasks. You can disconnect Google Calendar in Settings or revoke access in your Google account. Disconnecting stops synchronization and removes the saved connection from 1Todo; your Google calendar and events remain in Google Calendar.

1Todo handles information obtained through Google Workspace APIs in accordance with Google's user data and developer policy, including its Limited Use requirements. We use this information to provide your requested organiser features, and do not sell it, use it for advertising, or use it to train artificial intelligence models.

When the daily email reminder is enabled, your name, email address, timezone, and relevant task details are processed to prepare and deliver that email through Brevo. Daily reminders are on by default and can be turned off in Settings. Email verification, password recovery, and service messages may also be delivered through our authentication email provider. Google sign-in sends account information to Supabase Auth when you choose that sign-in method.

Google Workspace user data and developer policy

5. Why we process information

We use account and organiser information to provide the service you request, synchronize your content, manage authentication and sharing, and deliver optional reminders and calendar connections. This processing is necessary to perform our contract with you. We process limited technical information for security, abuse prevention, troubleshooting, and service reliability based on our legitimate interests. We process information where necessary to meet legal obligations or respond to your requests. Optional integrations are enabled by your choice; permission can be withdrawn through their settings.

6. Service providers and disclosure

We do not sell your personal information or use your organiser content for advertising. We disclose information to the providers needed to operate the features you use, to recipients you choose through sharing, or where required by law. Information may also be disclosed to protect the service or in connection with a business transfer, subject to applicable law.

• Supabase: account authentication and storage of account and organiser data.
• Vercel: hosting, request handling, and operational logs.
• Brevo: delivery of transactional emails and optional task digests, including the email content needed for delivery.
• Google: sign-in and optional Calendar synchronization when you connect those features.
• The Android beta has no purchase flow. RevenueCat and Paddle purchase processing are disabled in this release. If purchases are introduced, we will update the relevant disclosures before enabling them.

7. International processing

Our service providers may process information outside your country, including outside the European Economic Area. Where European data protection law requires safeguards for such transfers, applicable contractual or other lawful transfer mechanisms are used. Contact us for information about the providers and safeguards relevant to your account.

8. Retention and account deletion

We retain account and organiser information while your account is active. You can remove content in the app; some removals are initially marked as deleted to synchronize changes across devices.

You can request account deletion in Settings or through the account deletion page on our website. Requests enter a 30-day recovery period, during which returning to your account cancels the request. After that period, the scheduled deletion process permanently removes your authentication account and associated organiser data from the active database. If you cannot access your account, email priyom@prifecto.com so we can verify your identity and assist.

Your Terms receipts, blocks you created, and reports you submitted are removed with your account. Reports submitted by other users and their email-based blocks may retain information about your account where needed to investigate abuse or prevent unwanted sharing. Such safety records are reviewed manually and retained only while necessary for these purposes or legal obligations.

Service-provider logs, email delivery records, and backups may persist separately under their retention schedules. We may retain limited records where necessary for legal, security, or fraud-prevention purposes. Contact us for details about retention or a deletion request. Content you contributed to another person’s shared list may remain in that owner’s record. Deletion does not remove events already copied to Google Calendar. Copies previously received by someone you shared with are outside our control; you can revoke their access to your shared content in 1Todo.

9. Security

Connections to our production services use HTTPS. We use authenticated requests, access checks, and rate limiting to protect account data. Access depends on account ownership and sharing permissions. No system can guarantee absolute security; keep your credentials and devices secure and report suspected unauthorized access to priyom@prifecto.com.

10. Your rights

Depending on applicable law, you may request access, correction, erasure, restriction, or portability of your personal information, and object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact priyom@prifecto.com; we may need to verify your identity. You may complain to your local data protection authority. We respond within the time required by applicable law.

11. Children

1Todo is not intended for children under 16. If you believe a child under 16 has provided us with personal information, contact priyom@prifecto.com so we can investigate and take appropriate action.

12. Policy updates

We update this policy when the service or our information practices change. The date above identifies the latest revision. Where appropriate, significant changes will also be communicated through the service.