Security and Data Protection Policy

Effective Date: October 16 2026

Last Updated: October 16 2026

This Security and Data Protection Policy explains how ToDoal protects user information and maintains the security of its productivity application and supporting infrastructure

ToDoal operates from India and is co-founded by MD Faruk Abdulla and Nalband Abdul Qadir

Website: https://todoal.com

Application: https://app.todoal.com

Security and Privacy Contact: contact@todoal.com

1 — Our Security Commitment

ToDoal is designed to help users manage tasks goals reminders and productivity information while maintaining appropriate protections for their accounts and data

We implement technical and organizational safeguards intended to prevent unauthorized access data exposure malicious activity and disruption

Our security measures include authentication controls database access restrictions rate limiting bot protection and infrastructure security services

No online service can guarantee absolute security and we continually aim to improve our safeguards as the application evolves

2 — Authentication and Account Security

ToDoal supports Google and GitHub OAuth authentication through its configured authentication infrastructure

When users authenticate we receive relevant account information such as email address display name and provider user ID

ToDoal does not directly collect or store a separate user-created ToDoal password

Authentication tokens and session mechanisms are used according to the configured authentication flow

Users are responsible for protecting their Google or GitHub accounts and should immediately report suspected unauthorized access

3 — Database Security and Access Control

ToDoal uses Supabase for database and backend functionality

Our database uses PostgreSQL and Row Level Security policies designed to restrict access to records according to the applicable authorization rules

These policies are intended to prevent one user from accessing another user's private tasks reminders goals and account information

Access controls and backend authorization checks are used to protect sensitive operations

Users must not attempt to bypass these controls or access records that do not belong to them

4 — Infrastructure and Security Providers

ToDoal uses infrastructure and service providers that may include

Cloudflare

Content delivery network services security protection traffic handling and bot defense

Vercel and Hostinger

Website hosting deployment and related infrastructure depending on the relevant service component

Firebase

Authentication and related account access functionality

Supabase

Database storage backend functionality and access control

Brevo

Transactional email delivery and configured productivity reminders

Paddle

Subscription payment processing and billing as Merchant of Record

These providers process information as necessary to deliver their services and may have their own security practices contractual obligations and privacy policies

5 — Rate Limiting and Abuse Prevention

ToDoal uses rate limiting to reduce automated abuse excessive requests and potential service disruption

Current server-side limits include

• Standard pages: 150 requests per minute
• API routes: 30 requests per minute
• Login and signup: 20 requests per five minutes

The application also uses client-side burst protection intended to limit excessive actions

These controls help reduce spam and protect backend resources

Rate limits may be adjusted as necessary for security and operational reasons

6 — IP Address Processing

Our server-side sliding-window rate limiter processes IP addresses temporarily in memory to enforce request limits

The rate limiter does not permanently store these IP addresses in its own database

Cloudflare and other infrastructure providers may independently process IP addresses and related technical information when delivering security hosting or networking services

Such processing is subject to the applicable service configuration and provider policies

7 — Bot Protection and Malicious Activity

ToDoal uses Cloudflare Turnstile and other implemented security controls to help identify automated traffic and prevent abuse

We may restrict requests or investigate activity that appears to involve

• Automated spam or excessive requests
• Attempts to bypass rate limits
• SQL injection attempts
• Cross-site scripting attempts
• Malicious payloads
• Unauthorized access attempts
• Attempts to exploit vulnerabilities
• Fraudulent or deceptive activity

These controls are intended to protect user information and maintain service availability

8 — Account Enforcement and Security Logs

ToDoal may temporarily restrict suspend or permanently delete accounts that engage in serious abuse or repeated violations of security controls

Under our configured enforcement system an account may be permanently deleted upon the 41st qualifying violation after exceeding the threshold of 40 violations

Serious malicious activity may result in immediate enforcement without prior warning where appropriate

The Super Admin may take individual or bulk enforcement action to protect the service

For security and investigation purposes we may retain limited enforcement records containing a user UID email address enforcement reason and timestamp

These records are handled according to our Privacy Policy and applicable legal requirements

9 — Payment Security

Paddle acts as our Merchant of Record and handles subscription billing and payment processing

ToDoal does not directly collect or store full credit or debit card numbers CVV bank account details or UPI IDs

Our database stores limited subscription information such as Paddle customer IDs subscription IDs and subscription status

Payment information processed by Paddle is subject to its own security controls contractual terms and privacy policy

Users should contact the relevant payment provider if they suspect unauthorized payment activity

10 — Data Collection and Minimization

ToDoal collects and processes information necessary to provide its functionality maintain accounts and protect the service

This may include account identifiers productivity data notification preferences subscription identifiers and limited technical or security information

We do not sell or rent private task content to advertisers or data brokers

Analytics and tracking technologies may include Meta Pixel Microsoft Clarity Google Analytics and Google Tag Manager

Their processing depends on the configured implementation and applicable consent requirements

Our Privacy Policy and Cookie Policy provide further details about collected information and tracking preferences

11 — Data Retention and Deletion

Users may permanently delete their accounts through the available account settings functionality

The implemented deletion process is designed to remove associated account information productivity data and authentication records and submit a cancellation request for the associated Paddle subscription

ToDoal also enforces a 90-day inactivity deletion policy

Warning emails may be sent at approximately 30 60 80 and 85 days without qualifying activity

If the account remains inactive throughout the 90-day period it will be automatically deleted

Limited security records and information independently retained by third-party providers may remain where required by law or reasonably necessary for security fraud prevention disputes or legal compliance

12 — Security Incident Handling

If we identify or receive a credible report of a potential security incident we may investigate the issue take steps to contain its impact and implement corrective measures

Depending on the nature of the incident we may restrict affected functionality review relevant security records and work with infrastructure providers where necessary

Where applicable law requires notification of affected individuals or authorities we will follow the relevant legal requirements

Users who suspect unauthorized access or a vulnerability should contact contact@todoal.com

Please do not include passwords authentication tokens payment credentials or unnecessary personal information in a security report

13 — User Responsibilities

You are responsible for taking reasonable steps to protect your account and information

You should

• Protect your Google or GitHub account
• Avoid sharing authentication sessions or access tokens
• Use only official ToDoal domains
• Keep your browser and device reasonably secure
• Report suspected unauthorized access promptly
• Avoid storing unnecessary sensitive information in task descriptions
• Sign out when using a shared or public device

You must not attempt to access another user's information or interfere with our security controls

14 — Third-Party Security Limitations

ToDoal depends on external infrastructure authentication email payment and analytics providers

Although we select services intended to support reliable operation and security we do not control every aspect of their independent systems

Third-party processing is governed by the relevant provider's terms privacy policies and contractual arrangements

We remain responsible for obligations that apply to us under applicable law

15 — International Data Protection

ToDoal operates from India and may use providers that process information in other countries

Depending on service configuration personal information may be transferred to or processed in jurisdictions including the United States

Where applicable we seek to use appropriate safeguards for international transfers and comply with relevant data protection requirements

16 — Policy Updates

We may update this Security and Data Protection Policy as our infrastructure security measures or legal obligations change

The latest version will be published at https://todoal.com

Where required by applicable law we will provide appropriate notice of material changes

17 — Contact Information

For security reports data protection questions or suspected vulnerabilities contact

ToDoal aims to maintain appropriate security safeguards protect personal information and respond responsibly to credible security concerns