Todolu app icon Todolu

Privacy Policy

Effective Date: November 9, 2025  ·  Last Updated: October 16, 2026

1. Introduction

Welcome to Todolu (“the App”), operated by an individual developer under the name Todolu Technologies (“we,” “our,” or “us”). Your privacy is important to us. This Privacy Policy explains how we handle your information when you use the App.

Todolu is provided as a freemium service intended for use “AS IS”.

2. Information Collection and Use

Google sign-in is required to use Todolu. You cannot use the App without signing in.

When you sign in with Google, we collect and store:

  • Account profile information: your user ID, name, email address, and profile photo URL (when provided by Google)
  • Device information: push notification tokens and device platform, used to deliver reminders
  • Task data: tasks with due dates and reminders may be stored in our cloud database so we can send you timely notifications

The App also collects information when you download and use it. This may include:

  • Device and app information, such as operating system, device model, and app version
  • Screens or pages of the App that you visit, the time and date of your visit, and time spent in the App
  • Anonymized usage events (for example, onboarding or feature use) through Google Analytics for Firebase, to help us improve the App
  • Approximate geographic region, which Google may derive from IP address as part of Firebase Analytics. We do not gather precise GPS location of your device.

We do not send the content of your lists, tasks, or notes in analytics events.

We may use the information you provided to contact you from time to time with important information, required notices, and service-related messages.

We do not sell your personal information. We do not use advertising or third-party tracking networks.

3. Google sign-in (required)

Signing in with Google is required to use the App:

  • Basic profile information authorized by you is stored in Firebase (Google Cloud) to manage your account and provide personalized features.
  • Task reminder data is stored in Firebase Firestore to enable push notifications for due tasks.
  • Your lists, tasks, and notes may be stored in a private app-specific folder in your Google Drive account for cross-device sync. This data is not visible in your normal Google Drive file browser and is accessible only to Todolu with your authorization.
  • Signing in requires Google Calendar permission so dated tasks can stay in sync with your primary calendar, as described in section 4.

4. Cloud Sync (Google Drive and Google Calendar)

If you sign in with Google and use the Sync feature, Todolu uploads a backup of your lists, tasks, and notes to a hidden application data folder in your Google Drive. Sync uses Google’s secure APIs. You can stop Drive sync by signing out or revoking Todolu’s Google Drive access in your Google Account settings.

Signing in with Google requires your permission to connect Todolu to Google Calendar. That permission lets Todolu see, edit, share, and permanently delete all the calendars you can access using Google Calendar. With that permission, Todolu reads events on your primary Google Calendar and can create, edit, and delete those events so they stay in sync with dated tasks in Todolu. Calendar information we use includes the event title, description, start and end time, reminder, and whether the event was cancelled. Changes you make in Todolu can update the matching event, and changes you make in Google Calendar can update the matching task. You can stop this by signing out or by revoking Todolu’s Google Calendar access in your Google Account permissions.

5. Permissions

Todolu may request minimal device permissions (for example, notifications and local storage) only to enable core features. All permissions are optional and can be controlled through your device settings.

On Android and iOS, a notification permission may be requested so Todolu can deliver reminders. Push notification tokens are stored in our cloud database for your signed-in account.

If you sign in with Google, Todolu requires permission to connect to Google Drive and to Google Calendar. The Google Calendar permission Google asks you to grant is: “See, edit, share, and permanently delete all the calendars you can access using Google Calendar.” Todolu uses that permission to read your primary calendar and to create, edit, and delete events on it. Google Drive permission is used to store an app-only backup. If you do not grant both permissions, Google sign-in does not complete.

6. Third-Party Services

Only aggregated, anonymized analytics data is periodically transmitted to external services to aid us in improving the App. Please note that the App uses third-party services that have their own privacy policies about handling data.

Todolu uses the following third-party services:

We may disclose user-provided and automatically collected information:

  • as required by law, such as to comply with a subpoena or similar legal process;
  • when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
  • with trusted service providers who work on our behalf, do not have an independent use of the information we disclose to them, and have agreed to adhere to the rules set forth in this privacy statement.

7. Opt-Out Rights

You can stop all collection of information by the App by uninstalling it. You may use the standard uninstall process available on your device or via the mobile application marketplace. Signing out ends your session and returns you to Google sign-in, which is required to use the App.

8. Data Retention and Deletion

  • Account profile data is retained while your account is active.
  • Push notification tokens are updated on each login and removed when invalid.
  • Task data in Firestore is retained while your account is active to support reminders.
  • Google Drive sync data remains in your Google account until you delete it or revoke access.
  • Google Calendar events that Todolu creates or edits remain on your calendar until you change or delete them, or revoke Todolu’s Calendar access.
  • Analytics data is retained according to Google Analytics for Firebase practices.

You may sign out at any time. Signing out returns you to the Google sign-in screen. To request deletion of your account data, contact us at todolu.app@gmail.com and we will delete your Firebase profile and associated cloud data within a reasonable period.

9. Children’s Privacy

Todolu is not directed to children under 13. We do not knowingly collect personal data from children under 13 years of age. If we discover that a child under 13 has provided personal information, we will delete it from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us at todolu.app@gmail.com so that we can take the necessary actions.

10. Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS) for all data transmitted between the App and our servers. Data stored in Firebase and Google Drive is protected by Google’s security infrastructure and access controls. Only you can access your synced data through your authenticated account.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last Updated” date and, where required, notify you of material changes. You are advised to consult this Privacy Policy regularly for any changes, as continued use is deemed approval of all changes.

12. Your Consent

By using the App, you are consenting to the processing of your information as set forth in this Privacy Policy now and as amended by us.

13. Your Rights

You have the right to know, access, update, or request deletion of your personal data. When applicable, you may contact us to exercise these rights under the GDPR and India’s DPDP Act (2023).

14. Contact Us

If you have questions or concerns about privacy, please contact: todolu.app@gmail.com