Privacy Policy

Effective Date: October 16 2026

Last Updated: October 16 2026

This Privacy Policy explains how ToDoal collects uses stores protects and deletes personal information when you access our website or use our productivity application

ToDoal is operated from India and co-founded by MD Faruk Abdulla and Nalband Abdul Qadir

Official Website: https://todoal.com

Application: https://app.todoal.com

Contact Email: contact@todoal.com

Founder Contact: founder@todoal.com

We are committed to protecting your privacy and handling your information responsibly

1 — Information We Collect

1.1 Account Information

ToDoal supports authentication through Google and GitHub OAuth

When you register or sign in through these providers we receive and process the following information as applicable

• Email address
• Display name
• Provider user ID

We use Firebase Authentication and our configured backend services to manage authentication and account access

ToDoal does not directly ask users to create or submit a separate password for their ToDoal account and does not store user-created ToDoal passwords

Google and GitHub may independently collect information according to their own privacy policies

1.2 Age Confirmation

ToDoal is intended for individuals aged 16 and older

During registration users must confirm that they meet the minimum age requirement through a self-declaration checkbox

We do not request a date of birth or identity document as part of this age confirmation process

We may restrict or terminate accounts that are found to violate our minimum age requirement

1.3 Productivity Information

When you use ToDoal we process information that you voluntarily create or configure within the application including

• Tasks and subtasks
• Task titles and due dates
• Task completion status
• Reminders and recurring schedules
• Daily weekly and monthly productivity settings
• Yearly goals
• Streaks and task completion history
• Timezone preferences
• Email notification preferences

We use this information to provide task management features calculate progress deliver configured reminders and maintain your productivity history

Your task content is private to your account and protected by access controls designed to prevent unauthorized access by other users

1.4 Technical and Security Information

To protect our services against abuse and automated attacks we process limited technical information

This may include request metadata temporary IP address processing security events and regional request information

Our server-side rate limiter processes IP addresses temporarily in memory to enforce request limits

• Standard pages have a limit of 150 requests per minute
• API routes have a limit of 30 requests per minute
• Login and signup routes have a limit of 20 requests per five minutes

IP addresses processed by this rate limiter are not permanently stored in a database by the rate limiter itself

We also use client-side burst protection and Cloudflare Turnstile to help prevent automated abuse

Cloudflare region headers help determine whether requests originate from jurisdictions such as the European Union the United Kingdom or the United States

Security enforcement events may be retained separately when necessary to investigate abuse and protect the service

2 — How We Use Your Information

ToDoal uses collected information for the following purposes

• Create and maintain your account
• Authenticate users through supported identity providers
• Save and synchronize tasks goals and reminders
• Calculate productivity streaks and completion progress
• Deliver scheduled notifications according to your preferences
• Send essential account and security communications
• Process subscriptions and enable paid features
• Prevent spam automated attacks and unauthorized access
• Diagnose technical problems and improve application reliability
• Understand product usage through configured analytics tools
• Respond to support requests and reported bugs
• Enforce our Terms of Service and applicable legal obligations

We do not sell your private task content to advertisers or data brokers

3 — Analytics Advertising and Tracking

ToDoal uses third-party analytics and tracking technologies that may include

• Meta Pixel
• Microsoft Clarity
• Google Analytics
• Google Tag Manager

These technologies may process information such as page visits interactions device and browser information and online identifiers depending on their configuration

Google Tag Manager may load or manage other tags but does not itself necessarily collect the same information as every tag it manages

We do not currently use Meta Conversions API

We do not intentionally send your private task titles or task content to advertising platforms as part of our analytics setup

Tracking technologies may be subject to applicable consent requirements

In jurisdictions where consent is required we aim to obtain the appropriate permission before activating non-essential tracking technologies

Our cookie preference controls allow users to manage available tracking preferences according to the features implemented in the application

You may also use browser settings and available provider controls to restrict certain tracking technologies

Disabling some technologies may affect analytics or certain website functionality

4 — Cookies and Browser Storage

ToDoal uses browser storage and authentication technologies to provide its services

4.1 Local Storage

Our application may use localStorage for purposes including

• Temporarily caching application data for approximately five minutes to improve responsiveness
• Storing the age confirmation status
• Supporting application functionality and user preferences

The application may use storage keys such as todoal_cache_${uid} and todoal_age_confirmed

Cached information is intended to improve performance and is not a replacement for server-side access controls

You can clear browser storage through your browser settings although doing so may remove saved local preferences or cached data

4.2 Authentication Cookies and Tokens

Authentication may use Firebase session tokens cookies or other browser storage mechanisms depending on the configured authentication flow

These technologies help maintain your signed-in session and protect access to your account

4.3 Cookie Consent

ToDoal displays its cookie consent interface in jurisdictions where its configured rules require it

In other jurisdictions certain technologies may start under the default settings while users retain access to available preference controls

The actual treatment of cookies and tracking technologies depends on the applicable law and your selected preferences

5 — Third-Party Service Providers

ToDoal relies on third-party providers to operate the application

Firebase and Google

Used for supported authentication flows and related account access functionality

Supabase

Used for database storage and backend functionality

Our database uses Row Level Security policies designed to restrict access to records according to the applicable authorization rules

Paddle

Paddle acts as our Merchant of Record for subscription payments and related billing operations

ToDoal does not directly collect or store your full credit or debit card number CVV bank account details or UPI ID

Our database stores limited subscription information such as Paddle customer IDs subscription IDs and subscription status

Paddle independently processes payment and billing information under its own privacy terms

Brevo

Brevo is used to deliver transactional emails account notifications and configured productivity reminders

Depending on the email being sent Brevo may process your email address delivery information and message-related metadata

Cloudflare

Used for content delivery network services security protection traffic handling and bot defense

Vercel and Hostinger

Used for website hosting deployment or related infrastructure depending on the service component

Analytics Providers

Meta Google and Microsoft may process information through the analytics and tracking technologies described in this policy

These providers may process information under their own privacy policies and applicable contractual arrangements

We encourage users to review the privacy policies of relevant third-party providers

6 — Email Communications

ToDoal may send the following categories of email

Productivity Reminders

Configured reminders may include daily briefings evening reviews and other productivity notifications where available and enabled

Account Inactivity Notices

We may send inactivity notifications after approximately 30 60 80 and 85 days without qualifying account activity

A final notification may confirm account deletion after the 90-day inactivity period

Billing Communications

Paddle may send payment confirmations invoices subscription renewal notices payment failure alerts and cancellation confirmations

We may also send checkout recovery communications where applicable

Users can manage supported productivity email preferences through their account settings

Where applicable non-essential emails include an unsubscribe mechanism

Essential security account and billing communications may still be sent when necessary to operate the service or meet legal obligations

7 — Data Retention and Account Deletion

7.1 User-Initiated Deletion

You may request permanent account deletion through the available account settings functionality

When account deletion completes our implemented deletion process is designed to remove your account and associated productivity data including tasks reminders recurring schedules goals streaks and profile information

The process also deletes the associated Firebase authentication account and clears applicable browser cache data

An active Paddle subscription is submitted for cancellation as part of the implemented deletion process

External providers may retain certain records independently under their own legal and operational obligations

7.2 Automatic Deletion After Inactivity

ToDoal enforces a confirmed 90-day inactivity policy

We send warning emails during the inactivity period including notices around days 30 60 80 and 85

If the account remains inactive throughout the 90-day period it is automatically deleted

Users who wish to retain their accounts must return and complete the activity required by the application before the deletion process takes effect

7.3 Security Records

Limited enforcement records may be retained to document serious abuse prevent repeated attacks and protect the service

These records may include a user UID email address enforcement reason and timestamp

Such records are separate from ordinary productivity content and may be retained when reasonably necessary for security legal compliance or dispute resolution

7.4 Third-Party Retention

Deletion from ToDoal does not necessarily erase information already retained independently by payment providers identity providers email providers or other third parties

Their retention practices are governed by their own policies and legal obligations

8 — Security Measures

We use technical and organizational measures designed to protect personal information

These measures include database access controls Row Level Security rate limiting bot protection authentication safeguards and infrastructure security services

Our team develops and maintains backend functionality and security controls alongside selected third-party and AI-assisted development tools

No online service can guarantee absolute security

You should protect access to your authentication provider account and notify us if you suspect unauthorized access

9 — International Data Processing

ToDoal operates from India and uses service providers that may process information in other countries

Depending on the provider and service configuration your information may be processed or stored outside India including in the United States or other jurisdictions

Where applicable we seek to use appropriate contractual and legal safeguards for international transfers

Data protection rights and obligations may vary depending on your location

10 — Your Privacy Rights

Depending on applicable law you may have the right to

• Request access to personal information associated with your account
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent where processing relies on consent
• Change available cookie and tracking preferences
• Object to or restrict certain processing where legally applicable
• Request information about relevant data processing
• Submit a complaint to an appropriate data protection authority

To exercise a privacy right contact contact@todoal.com

We may need to verify your identity before responding to certain requests

We will handle requests according to applicable legal requirements

11 — Children's Privacy

ToDoal is intended for users aged 16 and older

We do not knowingly intend to provide accounts to individuals below the minimum age

If you believe a person below the minimum age has created an account please contact us so we can investigate and take appropriate action

12 — Bug Reports and Support

Users may report bugs technical problems or privacy concerns through the available support or bug reporting form

Please avoid including passwords authentication tokens payment credentials or unnecessary sensitive information in support submissions

We use submitted information to investigate reported issues and improve the reliability and security of ToDoal

13 — Changes to This Privacy Policy

We may update this Privacy Policy when our services data practices or legal obligations change

The revised version will be published on our official website with an updated revision date

Where required by applicable law we will provide notice or request renewed consent before implementing material changes

We encourage users to review this page periodically

14 — Contact Us

For questions requests or concerns relating to this Privacy Policy contact

ToDoal is committed to handling personal information responsibly and providing users with appropriate control over their accounts and privacy