Acceptable Use Policy

Effective Date: October 16 2026

Last Updated: October 16 2026

This Acceptable Use Policy explains the rules users must follow when accessing or using ToDoal

ToDoal is a productivity application operated from India and co-founded by MD Faruk Abdulla and Nalband Abdul Qadir

Website: https://todoal.com

Application: https://app.todoal.com

Contact: contact@todoal.com

By accessing or using ToDoal you agree to comply with this policy and our Terms of Service

1 — Purpose

ToDoal provides productivity tools that help users manage tasks subtasks reminders goals and progress

This policy exists to protect users maintain service availability prevent abuse and safeguard our infrastructure and data

Every user must use ToDoal lawfully and must not interfere with the security privacy or experience of others

2 — Eligibility and Account Responsibility

ToDoal is intended for individuals aged 16 and older

You must confirm during registration that you meet this minimum age requirement

You must provide accurate account information and use an authorized Google or GitHub account to authenticate

You are responsible for activity conducted through your account and for protecting access to your authentication provider

You must not impersonate another person use another person's account without authorization or misrepresent your identity

3 — Prohibited Activities

You must not use ToDoal to conduct unlawful activities or interfere with the operation of the service

Prohibited activities include the following

3.1 Unauthorized Access

You must not

• Access accounts or information without authorization
• Attempt to bypass authentication or authorization controls
• Access restricted database records or administrative functionality
• Exploit vulnerabilities to gain unauthorized privileges
• Attempt to access another user's tasks reminders goals or personal information

3.2 Attacks and Malicious Requests

You must not submit requests designed to compromise damage or disrupt ToDoal

Prohibited conduct includes

• SQL injection attempts
• Cross-site scripting attempts
• Malicious scripts or payloads
• Attempts to exploit API vulnerabilities
• Attempts to bypass security validation
• Requests designed to corrupt or manipulate database records
• Malware distribution or execution attempts

Legitimate security research must not involve unauthorized access data extraction disruption or damage

3.3 Spam and Automated Abuse

You must not use bots scripts or automated tools to overload or abuse ToDoal

Examples include excessive API requests repeated automated account creation unauthorized bulk operations and attempts to bypass rate limits

ToDoal uses technical protections to detect and limit abusive activity

Current server-side rate limits include

• Standard pages: 150 requests per minute
• API routes: 30 requests per minute
• Login and signup: 20 requests per five minutes

The application may also apply client-side burst protection and Cloudflare Turnstile verification

These limits may change as necessary for security and operational reasons

3.4 Fraud and Deceptive Conduct

You must not use ToDoal for fraud impersonation phishing identity theft payment abuse or other deceptive conduct

You must not attempt to manipulate subscriptions or obtain paid features through unauthorized methods

3.5 Interference With Other Users

You must not interfere with another user's account privacy data or normal use of ToDoal

You must not access modify delete or disclose another user's content without authorization

You must not use the service to harass threaten or unlawfully target other individuals

3.6 Misuse of Infrastructure

You must not interfere with the availability reliability or security of our application databases hosting services authentication systems or third-party integrations

You must not attempt to bypass infrastructure security controls or deliberately exhaust shared resources

4 — User Content

You are responsible for the information and content you create or submit through ToDoal

You must not use the application to store or distribute content that is unlawful or infringes another person's rights

You must ensure that you have the necessary rights to any content you submit

ToDoal does not claim ownership of your personal tasks goals reminders or productivity records

We process user content as necessary to provide and protect the service under our Privacy Policy

5 — Security Monitoring and Abuse Prevention

ToDoal uses technical and organizational measures to protect the service

These may include rate limiting authentication controls database access policies Cloudflare Turnstile and security monitoring

Our server-side rate limiter processes IP addresses temporarily in memory for request validation and abuse prevention

The rate limiter does not permanently store these IP addresses in its own database

Other infrastructure providers may independently process technical information under their applicable service configurations and policies

We may investigate activity that reasonably appears to violate this policy

6 — Rate-Limit Violations and Enforcement

Repeated violations of rate limits or other security controls may result in restrictions or account termination

Under our implemented abuse enforcement system an account that exceeds the configured threshold of 40 detected violations may be permanently deleted upon the 41st qualifying violation

This action is intended to protect the service from repeated abuse

Enforcement decisions depend on the system's detection and classification of qualifying violations

Users must not deliberately trigger or manipulate abuse detection systems

7 — Immediate Suspension and Termination

ToDoal may suspend restrict or permanently delete accounts involved in serious violations

Examples include deliberate exploitation of vulnerabilities unauthorized access attempts malicious payloads fraud repeated rate-limit abuse and conduct that threatens other users or service security

Serious violations may result in immediate enforcement without prior warning where appropriate

The Super Admin may take individual or bulk enforcement action when necessary to protect the service

Where appropriate and legally permitted ToDoal may retain limited security records documenting the account identifier email address enforcement reason and timestamp

Such records are handled according to our Privacy Policy and applicable legal requirements

8 — Inactive Accounts

ToDoal enforces a 90-day inactivity deletion policy

We may send warning emails at approximately 30 60 80 and 85 days without qualifying account activity

If the account remains inactive throughout the 90-day period it will be automatically deleted

Users who wish to retain their accounts must complete the required activity before the deletion process takes effect

Once deletion is completed associated productivity data is removed according to our implemented deletion process

9 — Reporting Security Issues or Bugs

If you discover a security vulnerability technical issue or suspected misuse of ToDoal report it to contact@todoal.com or use the available bug reporting form

When reporting an issue include a clear description of the problem and steps to reproduce it where appropriate

Do not include passwords authentication tokens payment credentials or unnecessary personal information

Do not access another person's data extract information disrupt the service or exploit a vulnerability beyond what is necessary to document the issue

We will review reports and take appropriate action based on their nature and severity

10 — Third-Party Services

ToDoal relies on third-party providers including Firebase Supabase Paddle Brevo Cloudflare Vercel and Hostinger

Users must not abuse these integrations or attempt to circumvent the applicable security controls

Your use of third-party services may also be subject to the relevant provider's terms and policies

11 — No Guarantee Against Abuse

ToDoal applies security controls intended to reduce unauthorized access spam and malicious activity

However no online service can guarantee that every threat will be detected or prevented

Users must report suspected account compromise and take reasonable steps to protect their authentication accounts

12 — Policy Changes

We may update this Acceptable Use Policy to reflect changes to our application security systems or legal obligations

The latest version will be published at https://todoal.com

Where appropriate we will provide notice of material changes

13 — Contact Information

For questions about this policy or to report abuse contact

By using ToDoal you agree to follow this Acceptable Use Policy and understand that violations may result in restrictions suspension or permanent account deletion subject to applicable law