Data and Account Information Policy

Effective Date: October 16 2026

Last Updated: October 16 2026

This Data and Account Information Policy explains what information ToDoal collects how account information is managed how user data is protected and what happens when an account is deleted

ToDoal is operated from India and co-founded by MD Faruk Abdulla and Nalband Abdul Qadir

Official Website: https://todoal.com

Application: https://app.todoal.com

Contact Email: contact@todoal.com

1 — Account Registration

ToDoal allows users to register and sign in through Google and GitHub OAuth

During authentication we receive information provided by the selected identity provider including where available

• Email address
• Display name
• Provider user ID

We use this information to identify your account provide authentication and associate your productivity data with your account

ToDoal does not directly collect or store a separate user-created ToDoal password

Authentication is managed through our configured authentication infrastructure

Your use of Google or GitHub authentication is also subject to the relevant provider's terms and privacy policy

2 — Minimum Age Requirement

ToDoal is intended for users aged 16 and older

During registration users must confirm that they meet the minimum age requirement through a self-declaration checkbox

We do not request a birthdate or identity document as part of this standard age confirmation process

Providing false age information or violating our eligibility requirements may result in account restriction or deletion

3 — Productivity Data

When you use ToDoal we process the information you create or configure within the application including

• Tasks and subtasks
• Task titles and due dates
• Completion status
• Reminders and recurring schedules
• Daily weekly and monthly productivity settings
• Yearly goals
• Streaks and completion history
• Timezone preferences
• Email notification preferences

This information enables ToDoal to provide task management features calculate progress maintain productivity history and deliver configured reminders

Your private task content is not sold or rented to advertisers or data brokers

4 — Technical and Security Information

ToDoal processes limited technical information to operate the service and protect against abuse

This may include request metadata security events authentication-related information and regional request information

IP Address Processing

Our server-side rate limiter processes IP addresses temporarily in memory to enforce request limits and reduce automated abuse

The rate limiter does not permanently store these IP addresses in its own database

Cloudflare and other infrastructure providers may independently process technical information according to their service configurations and applicable policies

Rate Limits

Current server-side limits include

• Standard pages: 150 requests per minute
• API routes: 30 requests per minute
• Login and signup: 20 requests per five minutes

Client-side burst protection and Cloudflare Turnstile provide additional anti-abuse measures

Regional Information

Cloudflare region headers help determine whether requests originate from jurisdictions such as the European Union the United Kingdom or the United States

This information supports jurisdiction-based handling of applicable privacy and cookie requirements

5 — Payment and Subscription Information

Paddle acts as our Merchant of Record for subscription billing and payment processing

ToDoal does not directly collect or store full credit or debit card numbers CVV bank account details or UPI IDs

Our database stores limited subscription information including where applicable

• Paddle customer ID
• Subscription ID
• Subscription status

These records help us identify subscriptions and provide access to paid features

Paddle may independently process billing information invoices payment details and transaction records under its own policies and legal obligations

6 — Third-Party Service Providers

ToDoal relies on third-party providers to operate the application

Firebase

Authentication and related account access functionality

Supabase

Database storage and backend functionality with Row Level Security policies designed to restrict access according to authorization rules

Paddle

Subscription billing and transaction processing

Brevo

Transactional emails and configured productivity reminders

Cloudflare

Content delivery security protection and bot defense

Vercel and Hostinger

Hosting and infrastructure depending on the relevant service component

Meta Google and Microsoft

Analytics and tracking technologies that may include Meta Pixel Microsoft Clarity Google Analytics and Google Tag Manager

These providers may process information necessary to deliver their services

Information independently processed by third-party providers is subject to their respective privacy policies and contractual arrangements

7 — Browser Storage and Authentication Sessions

ToDoal may use browser storage for temporary application caching age confirmation and related functionality

Examples include

• todoal_cache_${uid}
• todoal_age_confirmed

Application data may be cached for approximately five minutes

Authentication may use session tokens cookies or other browser storage mechanisms depending on the configured authentication flow

You can clear browser storage through your browser settings although doing so may remove local preferences or cached information

8 — Data Security

ToDoal uses technical and organizational safeguards intended to protect account information and productivity data

These measures include database access controls Row Level Security authentication safeguards rate limiting bot protection and infrastructure security services

Access to data is intended to be restricted to authorized operations and users

However no internet-based service can guarantee absolute security

Users should protect their Google or GitHub accounts and report suspected unauthorized access promptly

9 — User Access and Control

You can access and manage information through the features available in your ToDoal account

Depending on the functionality provided you may be able to create update or delete tasks change notification preferences and manage subscription settings

Depending on applicable law you may also request access correction deletion or other privacy-related action by contacting contact@todoal.com

We may need to verify your identity before responding to certain requests

10 — User-Initiated Account Deletion

You may permanently delete your account through the available account settings functionality

When the implemented deletion process completes it is designed to remove your account and associated productivity data including tasks subtasks reminders recurring schedules goals streaks and profile information

The process also deletes the associated Firebase authentication account clears applicable browser cache data and submits a cancellation request for the associated Paddle subscription

Account deletion is permanent and may not be reversible

Before deleting your account you should save any information you wish to retain

Certain limited security records or information retained independently by third-party providers may remain where required by law or reasonably necessary for security fraud prevention disputes or legal compliance

11 — Automatic Account Deletion After Inactivity

ToDoal enforces a confirmed 90-day inactivity deletion policy

We may send warning emails at approximately 30 60 80 and 85 days without qualifying account activity

If your account remains inactive throughout the 90-day period it will be automatically deleted

A final notification may confirm that deletion has occurred

Users who wish to retain their accounts must complete the required activity before the deletion process takes effect

Associated productivity data is removed according to the implemented deletion process

12 — Abuse Enforcement and Security Records

ToDoal may restrict or permanently delete accounts involved in serious abuse or repeated security violations

Examples include unauthorized access attempts malicious payloads exploitation of vulnerabilities fraud and repeated rate-limit violations

The configured enforcement system may permanently delete an account after the 41st qualifying violation when the established threshold of 40 violations is exceeded

For security and enforcement purposes ToDoal may retain limited audit records containing information such as the user UID email address enforcement reason and timestamp

These records are separate from ordinary productivity content and are handled according to our Privacy Policy and applicable law

13 — International Data Processing

ToDoal operates from India and uses infrastructure and service providers that may process or store information in other countries

Depending on the provider and configuration this may include the United States or other jurisdictions

Where applicable we seek to use appropriate safeguards for international data transfers and comply with relevant data protection requirements

14 — Data Retention

We retain personal information for as long as reasonably necessary to provide the service meet applicable legal obligations resolve disputes and protect the service

Productivity data associated with an account is subject to our account deletion and inactivity deletion processes

Billing providers may retain transaction and invoice information under their own legal and operational obligations

Limited security records may be retained when reasonably necessary for abuse prevention legal compliance or dispute resolution

15 — Changes to This Policy

We may update this policy when our data practices services or legal obligations change

The revised policy will be published on https://todoal.com with an updated revision date

Where required by applicable law we will provide appropriate notice or obtain any necessary consent

16 — Contact Information

For questions about account information data access deletion or privacy contact

ToDoal aims to protect account information provide appropriate user controls and handle personal data responsibly in accordance with applicable laws and our published policies