Privacy Policy

• Account data: the Firebase user ID created through anonymous authentication and, if linked, identifiers and profile information provided by Apple or Google, such as an email address or name
• Workspace data: Personal and Shared Workspace identifiers, members, roles, display names, notification settings, and participation timestamps
• User content: lists, tasks, notes, due dates, assignees, subtasks, comments, attachments, and related metadata
• Profile data: a display name and image, emoji, or generated avatar configured for each Workspace
• Device and notification data: installation ID, OS and app version, language, time zone, notification permission state, and push notification tokens such as FCM tokens
• Purchase data: store, product, plan, subscription state, purchase and expiration times, and RevenueCat customer identifier. We do not receive complete payment-card numbers
• Operational logs: IP address, Firebase UID, installation ID, RPC method, result status, latency, byte size, and error details. Structured logs are designed not to contain task or attachment bodies. To analyze usage, we export server-confirmed events for task operations, AI use, subscription state, Workspace creation, joining and leaving, and account deletion to BigQuery (Google Cloud, United States). These events exclude task titles and notes, names, photos and text submitted to AI, and subtask titles, and are deleted within 365 days
• Support data: your email, message, and information needed to verify and resolve a request
• Advertising data: ad impressions and interactions, approximate location inferred from IP address, advertising consent status, and, if you allow tracking, the advertising identifier (IDFA)

• To create and authenticate accounts, synchronize data, and support multiple devices
• To provide collaboration, invitations, and permissions in Personal and Shared Workspaces
• To store and deliver tasks, comments, attachments, avatars, and notifications
• To verify purchases, restores, subscription status, and Free, Plus, and Pro limits
• To show ads in free Workspaces and measure their performance
• To troubleshoot, prevent abuse, protect the Service, improve reliability, and answer support requests
• To comply with law, enforce our Terms, and protect rights and safety

The Service creates an anonymous account on first use. Linking Apple or Google to that account normally preserves the same Firebase UID and data. If the credential already belongs to another Todopi account, you may confirm a switch to that existing account and lose access to the previous anonymous data.

Apple’s or Google’s privacy policy also applies to their sign-in service. If you use Hide My Email, Apple may provide us with a relay address.

Current members of a Shared Workspace can see collaborative content stored there, including tasks, comments, attachment filenames, the display name, and the avatar configured for that Workspace. Keep one-time invitation tokens from being shared with unintended recipients.

Image avatars are delivered from a public location using a hard-to-guess random URL. Anyone who learns the URL may view the image; use an emoji or generated avatar if you prefer. Task attachments are private and delivered through short-lived, Workspace-authorized URLs.

We use the following providers as necessary to operate the Service:

• Google Firebase and Google Cloud for authentication, data storage, server processing, push notifications, product analytics, logs, and infrastructure
• Apple and Google for sign-in and App Store or Google Play billing
• RevenueCat for subscription status, restoration, verification, and entitlements
• Cloudflare for avatar and task-attachment storage and delivery
• Anthropic for extracting task candidates from photos and text you submit to the AI task creation feature
• Google AdMob and User Messaging Platform for ad delivery, measurement, fraud prevention, and collecting and managing advertising consent

These providers may process information outside Japan. We use them in light of applicable law, contractual protections, and their security measures.

When you use AI task creation, Anthropic, the AI provider, processes the photos and text you submit. We do not store the submitted content or extracted candidates on our servers or include their content in logs. Tasks you review and add are stored as ordinary user content.

The public release uses Firebase Analytics (GA4) with BigQuery export to analyze typed product events relating to onboarding, authentication state, Workspace creation and joining, task operations, synchronization, billing, attachments, notifications, and errors. Events may include a Firebase UID, Workspace ID, installation ID, device platform, app, build, and runtime versions, locale, and the type and result of an operation.

Product analytics events do not include Workspace names, display names, email addresses, Apple subjects, invitation tokens, task titles or notes, comment bodies, attachment filenames, receipts, payment methods, or source IP addresses. Product analytics starts off in the EEA, United Kingdom, and Switzerland until the user expressly opts in. In other regions, users can turn analytics off in Settings.

Free Workspaces show ads served by Google AdMob. Workspaces with paid features, such as Plus or Pro, do not show ads. For ad delivery, frequency capping, measurement, and fraud prevention, AdMob sends device identifiers, approximate location inferred from IP address, and ad impression and interaction data to Google. We do not send user content such as tasks or comments for advertising.

On iOS, ads based on your interests may be served using the advertising identifier (IDFA) only if you allow tracking through App Tracking Transparency. If you do not allow it, the IDFA is not used. You can change this at any time in iOS Settings. In the EEA, United Kingdom, and Switzerland, we collect advertising consent through Google’s User Messaging Platform, and you can change it from Ad privacy settings in the app’s Settings. For how Google uses information, see https://policies.google.com/technologies/partner-sites.

We do not disclose personal data to third parties except with your consent, to processors necessary to operate the Service, in a business transfer, when required or permitted by law, or when reasonably necessary to protect rights and safety.

• We retain accounts, Workspaces, and user content while needed to provide the Service.
• On Free, a completed task is reduced to a minimal deletion tombstone 180 days after its last Task Activity. The tombstone supports deletion synchronization to long-offline devices. The 180-day limit does not apply to a covered Workspace while Plus or Pro remains active.
• Uncommitted avatar and attachment uploads ordinarily become eligible for cleanup after 24 hours. Unreferenced files are removed after consistency checks, although CDN or device caches may persist temporarily.
• When you are no longer a Workspace member, local projections and caches for that Workspace are removed from the device. Shared content may remain for other members.
• Server structured logs used for security and reliability are ordinarily deleted within 365 days. Server events exported to BigQuery (Google Cloud, United States) for analysis are also deleted within 365 days. Support records, purchase records, and legally required records are retained until their purpose, contractual or statutory period, or a dispute-related need ends.
• Product analytics data is retained in GA4 and BigQuery while needed for analysis and is periodically reviewed in light of usage, legally valid deletion requests, and operational need. Turning analytics off does not automatically and immediately delete data collected before the change.

The public release lets you initiate deletion from the account settings in the app. If you cannot use the app, sign in at https://todopi.app/en/account-deletion with the same Apple or Google account linked to Todopi. The server verifies the Firebase ID token and identifies the deletion target from its UID. We do not delete an account based only on a self-reported email address or UID. We account for other members’ rights, shared content, legal retention duties, and backup overwrite cycles.

We use measures appropriate to the risk, including authentication, access controls, encrypted transport, short-lived authorized URLs, environment separation, secret isolation, and log monitoring.

If applicable law requires consent from a parent or other legal representative, obtain that consent before using the Service.

For material changes, we will provide clear notice in the Service or on our website, including the effective date. Where law requires consent, we will obtain it through an appropriate process.

MAKASETE, Inc. — Todopi Support

Email: hello@todopi.app