Privacy Policy

The data controller responsible for your personal data is [your full legal name or company name], based in [your country / region of residence, e.g. United Kingdom].

To exercise any of the rights described in this policy, contact us at [email protected]. This mailbox must be monitored regularly — it is the contact point for data subject requests (DSARs), complaints, and breach reports.

We collect only the data necessary to run the service:

• Account data: your email address, display name, and profile avatar URL, obtained from the sign-in provider you choose (email magic link or a supported SSO provider such as Google, GitHub, Apple, or Microsoft).
• List content: the titles, descriptions, todo items, free-text context notes, and tags you create within your lists.
• Membership data: the roles (admin, editor, reader) assigned to you on each list, and the email addresses of people you invite to your lists.
• Invitation data: the email addresses of people you invite to your lists, retained until they sign in or the invite is revoked.
• Operational data: authentication cookies, access logs, and error logs generated by our hosting and database providers in the course of running the service.

We do notcollect: precise geolocation, biometric data, national insurance numbers, payment card details (we do not process payments), or sensitive special-category data under UK GDPR Art. 10–11. If you include such data in your todo notes, you do so at your own risk — see sections 3 and 9.

We commit to accessing note content only when there is a legitimate purpose (a support ticket you raised, an abuse report, a legal obligation) and never to browse user data without cause.

We process your personal data for the following purposes:

• Providing the service (account creation, authentication, storing and syncing your lists). Legal basis: contract(UK GDPR Art. 6(1)(b)) — the service you signed up for.
• Sharing lists with invited members (matching invite emails to accounts on sign-in). Legal basis: contract— the sharing feature you initiated.
• Maintaining security and preventing abuse (monitoring for violations, investigating reports). Legal basis: legitimate interests(UK GDPR Art. 6(1)(f)) — protecting the service and other users.
• Legal compliance (responding to lawful requests, retaining records where required). Legal basis: legal obligation (UK GDPR Art. 6(1)(c)).

We do not sell your data. We share it only with the following processors and recipients:

• Supabase (database hosting, authentication, realtime updates). Supabase acts as a data processor under our instructions. Hosted in the EU (European region).
• Vercel (web application hosting). Server functions run in the EU region.
• SSO providers(Google, GitHub, Apple, Microsoft) — only when you choose to sign in with them. They share your email, name, and avatar with us under their own privacy policies.
• Email delivery— for sending magic-link sign-in emails via Supabase Auth’s email provider.

[If you add analytics (e.g. Vercel Analytics, PostHog) or email services beyond Supabase’s built-in, list them here with their EU/UK hosting status.]

Your data is hosted in the European Union (Supabase EU region, Vercel EU functions). SSO providers (Google, GitHub, Apple, Microsoft) may process data in their own global infrastructure under the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses. We do not knowingly transfer your data to countries without adequate data protection.

[Confirm your Supabase project region in the dashboard under Settings → General. Confirm Vercel region under Settings → Functions.]

• Account data: retained until you delete your account. You can delete your account from Settings once you have transferred or deleted any lists you created. Deletion is permanent and irreversible.
• List content: retained until the list is deleted by its creator or until your account is deleted (which cascades to your membership rows).
• Invitations: retained until the invitee signs in (converted to membership) or the invite is revoked / the list is deleted.
• Operational logs: retained for [e.g. 30–90 days] for security and debugging.

You have the following rights regarding your personal data:

• Right of access— request a copy of the data we hold about you.
• Right to rectification— correct inaccurate or incomplete data.
• Right to erasure— request deletion of your data (“right to be forgotten”). Account deletion is available in Settings.
• Right to restrict processing— ask us to limit how we use your data in certain circumstances.
• Right to data portability— receive your data in a structured, machine-readable format.
• Right to object— object to processing based on legitimate interests.
• Right to object to direct marketing— we do not send marketing emails, but this right is noted for completeness.
• Rights related to automated decision-making— we do not use automated decision-making or profiling.

To exercise any right, email [email protected]. We respond within one month (as required by UK GDPR). If we cannot comply (e.g. because deleting your account would orphan lists you created), we will explain why and what alternatives are available.

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection authority. You can contact the ICO at:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk — [phone: 0303 123 1113].

EU residents may also complain to their local data protection authority. We would encourage you to contact us first so we can try to resolve your concern.

• Row Level Security (RLS): all database tables enforce per-user access policies. Users can only read and modify lists they are members of, with permissions enforced by role.
• Transport encryption: all connections use HTTPS / TLS.
• Encryption at rest: list titles, descriptions, todo titles, and context notes are encrypted with AES-256-GCM before storage. The encryption key is held in a server-side secret store and is never exposed to the browser.
• Key management:the encryption key is stored as a server environment variable in our hosting provider’s secrets manager. It is not committed to source control.
• Authentication:all access requires sign-in. There are no public links to lists — sharing is strictly by email invite.

No method of transmission or storage is 100% secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify you directly if the risk is high, as required by UK GDPR Art. 33–34.

The service is not directed at children under 13 (or the minimum age required for SSO providers, which may be 13–16 depending on the provider). We do not knowingly process data from children. If you believe a child has provided us with data, contact [email protected] and we will delete it.

We use only essential cookies — those necessary for authentication and keeping you signed in. We do not use analytics, advertising, or tracking cookies. Because we use only essential cookies, a cookie consent banner is not required under the Privacy and Electronic Communications Regulations (PECR).

[If you add analytics cookies later, you must implement a consent banner and update this section.]

We may update this policy as the service evolves. We will update the “last revised” date above. For material changes, we will notify you by email or an in-app notice. Continued use after changes take effect constitutes acceptance.

For any questions about this policy or your data, contact [email protected].