Privacy Policy

1.Who is responsible for your data

The data controller for personal data processed through Todofy (website, apps, API) is:

Todofy (operated by Abdulla-al Rakib)
Vienna, Austria
Email: [email protected]

We are established in Austria (European Union). Privacy questions go to the email above.

2.Free service — your choice

Todofy is a personal MVP project. You create an account and use it voluntarily, in your own interest. Anyone may use the Service on that basis.

We process personal data only to run the product for you (account, tasks, reminders, optional voice capture, and limited sharing).

3.Where your data is stored — European Union

Your account data, tasks, and core service data are stored and processed in the European Union. We design Todofy GDPR-first from Austria.

When you use voice-to-task, audio may be processed by OpenAI to create your task draft and is then discarded. That processing may involve a transfer outside the EU under appropriate safeguards (such as EU Standard Contractual Clauses). We do not keep raw voice audio as a permanent archive.

4.What we process

• Account data — email, name, auth credentials / Google sign-in identifiers, language and timezone preferences.
• Task content — titles, notes, due dates, reminders, shares you create.
• Voice — only when you use voice-to-task (see above).
• Technical logs — security, abuse prevention, and reliability (IP, device/session signals as needed).

5.Why we process it

• Provide and secure your account and the free Service (Art. 6(1)(b) GDPR).
• Send task reminders you configure (Art. 6(1)(b)).
• Prevent abuse and keep fair-use limits workable (Art. 6(1)(f)).
• Meet legal obligations when they apply (Art. 6(1)(c)).

6.Processors

We use EU-hosted infrastructure and carefully chosen processors under contracts (including EU Standard Contractual Clauses where a transfer is required). Voice uses OpenAI only when you record. Ask [email protected] for the current subprocessor list.

7.Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to certain processing. Export and delete your account from Account → Data & Privacy, or email [email protected]. You may lodge a complaint with your local supervisory authority.

8.Retention

We keep account and task data while your account is active. After deletion we erase associated personal data within 30 days, subject to short security/legal retention where required.

9.Children

Todofy is designed for users of different age groups. There is no general minimum age of 16 for using Todofy.

Where applicable data protection laws require parental or legal guardian consent for the processing of a child's personal data, Todofy will comply with the applicable legal requirements. Age thresholds and consent rules may vary by country or region.

Parents or legal guardians are responsible for ensuring that their child's use of Todofy complies with applicable laws. If you believe an account was created without required consent, please contact us at [email protected] and we will delete the account and any personal data we hold where appropriate.

10.Contact

Privacy questions: [email protected]