Privacy Policy

Last updated: October 1, 2026 · Applies to: TODO it later (Android, iOS, Desktop, Web)

This policy explains what data TODO it later ("the app", "we") collects, why, and how it's handled. We built this app to work fully offline by default, and we only collect additional data when you explicitly choose to enable a feature that requires it.

1. Data stored locally on your device

By default, all tasks, notes, and content you create in TODO it later are stored only on your device, in the app's local storage. We do not see this data, collect it, or transmit it anywhere.

• Android device backup: on Android, the app takes part in Android's own backup system. If you have device backup turned on, Android may include the app's data (your tasks and app settings) in the backup it keeps in your Google account, and restore it when you set up a new phone or reinstall the app. This is handled by Android and Google, not by us, and you control it in your device's backup settings.
• File backup: you can back up your tasks to a file and restore them later, either manually or (on Android) automatically once a day to a file you choose. The file is saved only where you choose, and the app never sends it anywhere by itself.

Apart from these, uninstalling the app or clearing its data removes your data permanently.

2. Optional: Google Drive backup

If you choose to enable Google Drive backup, the app requests permission to create and manage only the files it creates itself in your Google Drive, using Google's restricted "app data" access scope. This means:

• The app cannot see, read, or modify any other files already in your Google Drive.
• The only data stored in Drive is your app content (tasks, notes, etc.) in a backup file created by the app.
• This feature is entirely optional. If you never enable it, no Drive permission is ever requested and no data leaves your device.
• Backups happen when you tap "Back up", or once a day if you turn on automatic daily backup. Each backup replaces the previous one.
• You can revoke this access at any time with "Disconnect Google Drive" in the app's settings, or from your Google Account permissions page. Either one removes the app's ability to access that backup file.

This feature is provided using Google Drive's API. Your use of Google Drive is also subject to Google's Privacy Policy.

3. Optional: Cloud account and sync

[This feature is planned for a future release. This section describes how it will work once available.]

TODO it later will offer an optional cloud account so you can sync your data across devices. We've designed this to require as little personal information as possible:

• No email or personal details are required to create an account. Accounts are secured using passkeys and/or biometric authentication (fingerprint or face recognition) handled entirely by your device's operating system.
• Biometric data (fingerprint or face scans) is never accessed, transmitted, or stored by us. It's processed entirely within your device's secure hardware, and only a success/failure signal is used to unlock your passkey — the biometric data itself never leaves your device or reaches our servers.
• Your account is identified internally by a randomly generated account ID, not by any personal information.
• Passkey sync as the default recovery path: passkeys are synced across your own devices by your device platform (e.g. Google Password Manager or iCloud Keychain), not by us. This means signing in on a new device is typically automatic, as long as it's signed into the same Google or Apple account — no separate recovery step from us is needed in that case.
• Optional recovery email: if you choose to, you can add a recovery email address to your account as a safety net in case you lose access to your synced devices. This is entirely opt-in — the app works fully without it. If provided, it is stored encrypted and used only to help you recover account access; it is never used for marketing or shared with third parties.

4. Crash reporting and analytics

TODO it later uses two third-party services to help us fix bugs and understand how the app is used, so we can improve reliability and features.

• Sentry — used for crash and error reporting. When the app crashes or hits an unexpected error, Sentry receives technical details about what went wrong (stack traces, the type of error) and general device/app information (device model, OS version, app version). It does not receive your tasks, notes, or other personal content. See Sentry's Privacy Policy for details on how this data is handled.
• PostHog — used for product analytics, such as which features and settings are used and how often the app is opened. This helps us understand what to improve, not who you are. We've configured PostHog to never collect your IP address or any location data (country, city, or coordinates) — this is disabled for every event we send, not just discarded afterwards. See PostHog's Privacy Policy for details on how this data is handled.

Neither service sells this data, uses it for advertising, or receives your name, email, or account identity.

5. Advertising

TODO it later may display ads served through Google AdMob to support free use of the app. We show non-personalized ads only — ads are not targeted based on your interests, browsing history, or app usage profile.

Even with non-personalized ads, Google AdMob may still process some technical data as necessary to serve ads, prevent fraud and abuse, and measure basic ad performance. This can include an advertising identifier, general device information, and coarse location (such as country/region) derived from your IP address. This data is processed by Google, not by us directly, and is not linked to your account, your tasks, or any other content within the app. See Google's Ads Privacy & Terms for details on how this is handled.

We also use RevenueCat to track ad performance (such as impressions, clicks, and ad revenue) alongside our other monetization data. RevenueCat does not serve ads itself — Google AdMob remains the ad network — but it receives ad event and revenue data via its SDK to give us a combined view of app monetization. This data is not linked to your account or personal identity. See RevenueCat's Privacy Policy for details.

If you never open a screen that shows ads, no ad-related data is requested.

6. Data we do not collect

• We do not sell your data to anyone, under any circumstances.
• We do not show personalized/targeted ads based on your behavior or interests.
• We never access biometric data — this is handled entirely by your device's operating system and never reaches us.
• We do not access any Google Drive content beyond files the app itself creates.
• We do not collect your IP address or location data (country, city, or coordinates) through our crash reporting or analytics providers.

7. Your choices and rights

• You can use TODO it later entirely offline, with zero data collection, by simply not enabling Drive backup or cloud sync.
• You can disable Google Drive backup and revoke access at any time via your Google Account settings.
• You can delete your cloud account and all associated data at any time from within the app or by contacting us (see below).
• If you're located in a region with specific data rights (such as the EU/EEA under GDPR, or California under the CCPA), you may have additional rights to access, correct, or delete your data — contact us to exercise these.

8. Children's privacy

TODO it later is not directed at children under 13 (or the relevant minimum age in your region), and we do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

9. Changes to this policy

We may update this policy as the app's features change — most notably when cloud sync becomes available. We'll update the "Last updated" date above when changes are made. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this policy or your data can be sent to: artemonsupport@gmail.com

This policy is provided as a plain-language summary of our data practices and has not been reviewed by a lawyer. If you have specific legal or regulatory requirements for your region, consider having it reviewed before relying on it for compliance purposes.