Start free

Privacy Policy

Last updated: 30 October 2026

This policy covers ToDev: the iOS and Android apps, the web app at todev.app, the website at todevlist.com, the API behind them at api.todev.app, and the AI connector at api.todev.app/mcp. It says what we collect, why, who handles it for us, how long we keep it, and what you can ask us to do with it.

Who is responsible

ToDev is provided by DK Digital Studios (Dimitrios Kyriakakis, “we”), Von-Graffen-Str. 7, 20537 Hamburg, Germany, who is the controller of the personal data described here. Privacy questions and requests:todevlist@gmail.com.

What we collect

Your account

  • Your name and email address.
  • Your password, if you sign up with email. We only store a one-way bcrypt hash of it, never the password itself.
  • If you sign in with Google: the name, email address and profile picture link that Google shares with us.
  • If you sign in with Apple: the name and email address Apple shares with us. If you choose to hide your email, Apple gives us a relay address instead.
  • Anything you add to your profile: username, location, website and bio.
  • Your settings (for example dark mode, currency and first day of the week), your plan, and when you last signed in.

What you put into ToDev

  • Tasks, projects, descriptions, notes and due dates.
  • Company details: company name, tax ID, address and invoice numbering.
  • Client details you enter: name, email, phone number, address, tax ID and notes.
  • Invoices, their amounts and dates, and files you attach to them.

Client details are about people other than you. You decide what you enter about them, and you need a lawful reason to do so. We only process that data to run ToDev for you.

AI connector

On any plan you can connect ToDev to an AI client such as Claude, ChatGPT, Grok or Cursor. Nothing is shared with an AI client unless you add the connector and approve it. When you do, we store:

  • The client's name, website and sign-in return address, as the client reports them when it registers.
  • That you approved it, which access you gave (read, write or both), and when it was last used.
  • Sign-in tokens for the client. We store only one-way hashes of them, never the tokens themselves.
  • If you attach a file to an invoice through the connector: a one-time upload link, stored only as a hash, which works once and expires after a few minutes.

We do not record your conversations or what the connector returns.

Payments

We never see or store your card details.

  • On the web, plans are paid through Stripe. Stripe holds your payment details; we store the Stripe customer ID that links your account to them.
  • In the iOS and Android apps, plans are paid through the App Store or Google Play. Apple or Google take the payment. RevenueCat, our subscription service, receives the purchase from the store under your ToDev account number and tells us which plan is active. We store your plan and which store bills it.

Usage and technical data

  • The iOS and Android apps send anonymous usage and crash reports to PostHog, hosted in the EU (Frankfurt): which screens are opened (by name, such as “today” or “account”, never the task, project or client on them), when the app is opened and closed, and error and crash reports with the app version, device model and operating system. These reports carry a random ID created on your device, not your name, email or ToDev account. The apps do not record what you type or tap, and contain no advertising tools.
  • The web app at todev.app and the website at todevlist.com count page views with PostHog, hosted in the EU (Frankfurt). It sets no cookies, stores nothing on your device, does not record what you type or click, and discards IP addresses. A visit cannot be linked to you or to your earlier visits.
  • Our hosting and network providers keep short-lived request logs, which include IP addresses, to keep the service secure and find faults.

Cookies and local storage

The web app keeps you signed in by storing a sign-in token in your browser. That is the only thing the web app stores on your device. We use no advertising or analytics cookies. The iOS and Android apps also keep the random analytics ID described above on your device.

Why we use it

  • To provide ToDev: create and secure your account, keep your tasks, projects, clients and invoices, and sync them between your devices. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
  • To bill paid plans and keep the records tax law requires. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).
  • To send account emails: email verification and password resets. We do not send marketing email. Legal basis: contract.
  • To count page views and app screens and find crashes, without identifying you. Legal basis: our legitimate interest in knowing which parts of ToDev are used and fixing what breaks (Art. 6(1)(f)). You can object at any time by writing to us.
  • To keep ToDev secure and fix problems. Legal basis: our legitimate interest in a working, safe service (Art. 6(1)(f)).
  • To run the AI connector when you connect a client: answer its requests and make the changes you ask for. Legal basis: contract (Art. 6(1)(b)).

We do not sell personal data, do not use it for advertising, and do not make automated decisions about you.

AI clients you connect

When you connect an AI client and ask it something, the connector sends that client the ToDev data it needs to answer: tasks, projects, clients (including the client contact details you entered), company details, and income and expense records. The company behind the client, for example Anthropic for Claude, OpenAI for ChatGPT, xAI for Grok or Anysphere for Cursor, then handles that data and what you type under its own privacy policy and your account with it. It acts as an independent controller, not on our behalf, and we do not choose where it stores data.

Every connected client is listed in the web app under Settings, then Connected apps. Revoking a client there stops its access to ToDev. Data the client already received stays under its own policy, so delete it there if you want it gone.

Who processes data for us

These providers handle personal data on our behalf, each only for the purpose listed:

  • Railway: hosts the API, the database and invoice files, in the Netherlands (Amsterdam).
  • Cloudflare: network and DNS in front of the API.
  • Netlify: hosts the web app at todev.app.
  • Resend: sends account emails.
  • Stripe: takes payments on the web.
  • Apple: Sign in with Apple and App Store payments.
  • Google: Google sign-in and Google Play payments.
  • PostHog: anonymous page view counts, app usage and crash reports, in the EU (Frankfurt).
  • RevenueCat: keeps track of App Store and Google Play subscriptions.

Apple, Google and Stripe also act as independent controllers for the payments and sign-ins they handle, under their own privacy policies.

Transfers outside the EU

Your account and the content you put into ToDev are stored in the Netherlands. Some of the providers above are based in the United States. Where data leaves the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

  • Your account and everything in it: for as long as you keep the account. Deleting the account deletes it, as described below.
  • Connected AI clients: until you revoke them or delete your account.
  • Payment records: Stripe, Apple and Google keep their own records of your payments for as long as the law requires them to.

Deleting your account

In the app, go to More, then Account, then Delete account. This permanently deletes your account, tasks, projects, company details, clients, invoices and attached files, and disconnects every AI client you connected. A web subscription through Stripe is cancelled at the same time.

Subscriptions bought in the App Store or Google Play are managed by Apple and Google, so cancel those in your store account settings first. Deleting your ToDev account does not stop a store subscription.

You can also ask us to delete your account by writing totodevlist@gmail.com from the email address you registered with.

Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Write to todevlist@gmail.com; we answer within one month. You can also complain to a data protection authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

Children

ToDev is a tool for freelancers and is not meant for children under 16. We do not knowingly collect their data.

Security

All traffic is encrypted with HTTPS. Passwords are stored only as bcrypt hashes. In the iOS and Android apps, sign-in tokens are kept in the device's secure storage.

Changes

When this policy changes, we update the date at the top. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.