Privacy policy
Last updated 18 October 2026
Todoly is a small task manager, and this page says what it does with your data, in plain words. If anything here is unclear, write to hello@todoly.io.
Who is responsible
The controller is [Legal name], [Address], Stockholm, Sweden. Contact: hello@todoly.io.
What we hold
- Your account: name, display name, email address, a photo if you add one, and a password hash if you sign in with a password. With Google sign-in we get your name, email and photo from Google and store nothing else from it.
- Your workspaces: projects, tasks, labels, comments, files you attach, who is a member and what role they have, and notifications inside the app.
- Billing: which plan a workspace is on, its subscription status and the invoices Polar issues. Card details go to Polar and never reach us.
- Technical records: request logs with your IP address and browser, kept 30 days for security and debugging; error reports when something breaks, which carry the error and the page you were on but no session replay.
- Email settings: which of our emails you have turned off.
Why, and on what basis
To run the service you signed up for (contract); to keep it secure, find bugs and stop abuse (legitimate interest); to send the emails the product needs, such as invites, mentions, password resets and payment problems (contract), each of which you can turn off except the ones about your account itself.
Cookies and analytics
The app sets one session cookie so you stay signed in, and keeps your theme choice in your browser. That is all, so there is no cookie banner. The landing page at todoly.io uses Plausible, which counts visits without cookies or personal data. There is no advertising and no tracking across sites.
Who processes data for us
- Railway runs the application and its database.
- Cloudflare serves the landing page, handles DNS and stores attached files.
- Resend sends our email.
- Polar is the merchant of record for payments and handles tax.
- Sentry receives error reports.
- Plausible counts landing-page visits.
- Google, only if you choose to sign in with Google.
Some of these handle data outside the EU/EEA. Where they do, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision. We do not sell data and we do not share it with anyone else, unless the law requires it.
Teammates see what you share
Everyone in a workspace can see every project and task in it, and the names and emails of the other members. Your comments stay after you leave, without the name if you delete your account.
How long we keep it
For as long as your account or the workspace exists. Deleting a task, project, workspace or account removes it from the live service at once; copies can remain in database backups for up to 30 days and are then gone. Request logs last 30 days.
Your controls
- See and take your data: Settings → General → Export gives you a workspace as one JSON file.
- Correct it: name, photo and email change in Settings → Profile.
- Delete it: Settings → Profile → Delete account. Workspaces you are alone in go with it.
- Emails: the link at the bottom of a mention or invite email turns that kind off, as does Settings → Notifications.
For anything else, including objecting to a use of your data or asking what we hold, email hello@todoly.io; we answer within a month. You can also complain to the Swedish Authority for Privacy Protection (IMY) or your local authority.
Age
Todoly is for people aged 16 and over.
Changes
When this page changes in a way that matters, we email account holders before it takes effect. Small clarifications update the date above.