Privacy Policy

• Account data: the Firebase user ID created through anonymous authentication and, if linked, identifiers and profile information provided by Apple or Google, such as an email address or name
• Workspace data: Personal and Shared Workspace identifiers, members, roles, display names, notification settings, and participation timestamps
• User content: lists, tasks, notes, due dates, assignees, checklist items, comments, attachments, and related metadata
• Profile data: a display name and image, emoji, or generated avatar configured for each Workspace
• Device and notification data: installation ID, OS and app version, language, time zone, notification permission state, and push notification tokens such as FCM tokens
• Purchase data: store, product, plan, subscription state, purchase and expiration times, and RevenueCat customer identifier. We do not receive complete payment-card numbers
• Operational logs: IP address, Firebase UID, installation ID, RPC method, result status, latency, byte size, and error details. Structured logs are designed not to contain task or attachment bodies
• Support data: your email, message, and information needed to verify and resolve a request

• To create and authenticate accounts, synchronize data, and support multiple devices
• To provide collaboration, invitations, and permissions in Personal and Shared Workspaces
• To store and deliver tasks, comments, attachments, avatars, and notifications
• To verify purchases, restores, subscription status, and Free, Plus, and Pro limits
• To troubleshoot, prevent abuse, protect the Service, improve reliability, and answer support requests
• To comply with law, enforce our Terms, and protect rights and safety

The Service creates an anonymous account on first use. Linking Apple or Google to that account normally preserves the same Firebase UID and data. If the credential already belongs to another Todopi account, you may confirm a switch to that existing account and lose access to the previous anonymous data.

Apple’s or Google’s privacy policy also applies to their sign-in service. If you use Hide My Email, Apple may provide us with a relay address.

Current members of a Shared Workspace can see collaborative content stored there, including tasks, comments, attachment filenames, the display name, and the avatar configured for that Workspace. Keep one-time invitation tokens from being shared with unintended recipients.

Image avatars are delivered from a public location using a hard-to-guess random URL. Anyone who learns the URL may view the image; use an emoji or generated avatar if you prefer. Task attachments are private and delivered through short-lived, Workspace-authorized URLs.

We use the following providers as necessary to operate the Service:

• Google Firebase and Google Cloud for authentication, data storage, server processing, push notifications, product analytics, logs, and infrastructure
• Apple and Google for sign-in and App Store or Google Play billing
• RevenueCat for subscription status, restoration, verification, and entitlements
• Cloudflare for avatar and task-attachment storage and delivery

These providers may process information outside Japan. We use them in light of applicable law, contractual protections, and their security measures.

The public release uses Firebase Analytics (GA4) with BigQuery export to analyze typed product events relating to onboarding, authentication state, Workspace creation and joining, task operations, synchronization, billing, attachments, notifications, and errors. Events may include a Firebase UID, Workspace ID, installation ID, device platform, app, build, and runtime versions, locale, and the type and result of an operation.

Product analytics events do not include Workspace names, display names, email addresses, Apple subjects, invitation tokens, task titles or notes, comment bodies, attachment filenames, receipts, payment methods, or source IP addresses. We do not use advertising IDs for behavioral advertising. Analytics starts off in the EEA, United Kingdom, and Switzerland until the user expressly opts in. In other regions, users can turn analytics off in Settings.

We do not disclose personal data to third parties except with your consent, to processors necessary to operate the Service, in a business transfer, when required or permitted by law, or when reasonably necessary to protect rights and safety.

• We retain accounts, Workspaces, and user content while needed to provide the Service.
• On Free, a completed task is reduced to a minimal deletion tombstone 180 days after its last Task Activity. The tombstone supports deletion synchronization to long-offline devices. The 180-day limit does not apply to a covered Workspace while Plus or Pro remains active.
• Uncommitted avatar and attachment uploads ordinarily become eligible for cleanup after 24 hours. Unreferenced files are removed after consistency checks, although CDN or device caches may persist temporarily.
• When you are no longer a Workspace member, local projections and caches for that Workspace are removed from the device. Shared content may remain for other members.
• Server structured logs used for security and reliability are ordinarily deleted within 365 days. Support records, purchase records, and legally required records are retained until their purpose, contractual or statutory period, or a dispute-related need ends.
• Product analytics data is retained in GA4 and BigQuery while needed for analysis and is periodically reviewed in light of usage, legally valid deletion requests, and operational need. Turning analytics off does not automatically and immediately delete data collected before the change.

The public release lets you initiate deletion from the account settings in the app. If you cannot use the app, sign in at https://todopi.app/en/account-deletion with the same Apple or Google account linked to Todopi. The server verifies the Firebase ID token and identifies the deletion target from its UID. We do not delete an account based only on a self-reported email address or UID. We account for other members’ rights, shared content, legal retention duties, and backup overwrite cycles.

We use measures appropriate to the risk, including authentication, access controls, encrypted transport, short-lived authorized URLs, environment separation, secret isolation, and log monitoring.

If applicable law requires consent from a parent or other legal representative, obtain that consent before using the Service.

For material changes, we will provide clear notice in the Service or on our website, including the effective date. Where law requires consent, we will obtain it through an appropriate process.

MAKASETE, Inc. — Todopi Support

Email: hello@todopi.app