Privacy Policy

This Policy explains, in plain words, what personal data Todonex uses, why, who it's shared with, how long it's kept and how you can exercise your rights. It applies to the todonex.com website and the app.todonex.com app, and it follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), wherever you live.

1. Who looks after your data

Todonex is a service of WordHost (Sergio Canabarro Vidal Junior), Brazilian company registration (CNPJ) 43.639.043/0001-24. WordHost is the controller of your personal data, meaning it decides how and why the data is used.

Our data protection officer is Sergio Canabarro Vidal Junior. For anything about privacy, including exercising your rights, write to support@todonex.com.

2. What data we use

We only use what Todonex needs to work well:

• Account: name, email address and password. The password is stored in an irreversible form (hashed), so no one can read it, not even us.
• Profile and preferences: your profile photo, if you upload one, your language, your time zone (so reminders arrive on time), your font, your theme and other display preferences.
• What you create: lists, tasks, notes, reminders and repeats, priorities, favorites, Timer records, Trash items and the lists you share or receive.
• Premium subscription: your plan, the subscription status, the currency, billing dates and the codes that identify you and your subscription at Stripe, the company that processes payments (your Stripe record is created when you open the payment, even if you don't finish subscribing). Card details are typed straight into Stripe's form and never pass through our servers.
• Notifications: if you turn them on, your browser's notification delivery address, a random code that identifies the device and your browser's identification string (the user agent).
• Support: the subject, the message and any image you attach. The message also carries your name, your account's email address and your language, so we know who's asking for help.
• Acceptance of these documents: the version of the Terms of Use and this Policy you accepted when you created your account, with the date and time.
• Technical access data: IP address, browser identification and the date and time of connections. The login system keeps this data while your session is active, and our infrastructure providers log it for a short time to keep the service running and secure.
• Connection country: when you open Premium, we detect the country of your connection to show the price in the right currency. It isn't stored in your account. If you subscribe, it goes to Stripe as your billing country.
• Website visits: on todonex.com, we count visits in aggregate, without cookies and without identifying you.
• News emails: if you asked to receive Todonex news, we use your email address and, if provided, your name, for that purpose only.

The content of your lists is yours. We don't access it unless it's needed to solve a problem you reported to support, to investigate misuse or to comply with the law. Please don't store passwords, banking details or health information in Todonex.

3. Why we use it, and the legal basis

• Providing the service: creating and maintaining your account, storing your lists and syncing them in real time across your devices, unlocking your plan's features, sending reminder notifications and the emails the service needs, such as sign-up confirmation, a reminder if you haven't confirmed yet and password reset. Legal basis: performance of a contract (LGPD, art. 7, V).
• Premium payments: charging the subscription and meeting tax obligations. Legal bases: performance of a contract and compliance with a legal obligation (art. 7, II and V).
• Support: answering your messages. Legal bases: performance of a contract and legitimate interest (art. 7, V and IX).
• Security: protecting the service from abuse, fraud and unauthorized access, for example with the bot check at login and sign-up and with usage limits. Legal basis: legitimate interest (art. 7, IX).
• Website statistics: measuring visits to todonex.com without identifying you. Legal basis: legitimate interest.
• News and offers by email: only with your consent (art. 7, I), which you can withdraw at any time through the unsubscribe link in the email itself.
• Defending rights and requests from authorities: exercise of rights and compliance with a legal obligation (art. 7, II and VI).

We don't sell your data, we don't show ads and we don't use the content of your lists for advertising or to train artificial intelligence.

4. Who we share it with

We rely on companies that help us run Todonex. Each one receives only the data it needs to do its job:

• Supabase: database, login, photo storage and server functions. Data is stored in the São Paulo region, in Brazil.
• Cloudflare: hosting for the website and the app, network protection, the bot check (Turnstile) and the website's visit statistics.
• Stripe: Premium payments. Stripe receives your email address, language and account code when you open the payment and, if you subscribe, your billing country and card details. It also uses payment data to prevent fraud and meet its own legal obligations. If you use Stripe's Link, your payment details may stay saved at Stripe for future purchases, under Stripe's rules.
• Brevo: sending our emails, such as sign-up confirmation and password reset, and news emails to people who agreed to receive them. To measure delivery, Brevo records opens and clicks on the links in the emails.
• Browser notification services (such as Google's, Apple's, Mozilla's and Microsoft's): they deliver reminder notifications and shared list notices to your device. The notification content, such as the task text or the list name, travels encrypted from our server to your device.
• Email provider: receives the messages sent to support@todonex.com and through the app's Support form.

Shared lists. To invite someone, the list owner types that person's email address, and Todonex says whether it belongs to an account (lookups are limited per hour to prevent abuse). Inside a shared list, participants see the owner's name, email address and photo, the name and photo of the other people who have opened the list, and who completed each task and when. The owner sees the email address of each invited person and whether they have opened the list. When someone is editing a task, the other people on the list see it as it happens, and this isn't stored.

Authorities. We may share data when the law requires it or under a court order.

Business changes. If Todonex is sold or transferred, the data may pass to the new owner, who will remain bound to protect it under this Policy and the law.

5. Transfers to other countries

Some of these providers are based outside Brazil or may process data in other countries, such as the United States and countries in the European Union. These transfers are needed to provide the service you use (LGPD, art. 33, IX) and only happen with companies that apply security measures and data protection commitments compatible with the LGPD.

6. How long we keep it

• Account and content: for as long as your account exists.
• Trash (Premium): items stay for 30 days and are then deleted automatically. On the Free plan, whatever you delete is erased right away.
• Unconfirmed sign-up: deleted automatically after 24 hours if you don't confirm your email address.
• Shared list notices and reminder delivery history: 30 days.
• News emails: until you unsubscribe.
• Messages to support: for as long as needed to help you and for any legal obligations.

When you delete your account, we immediately erase the account, your lists, tasks, notes, photo, preferences, the devices registered for notifications and the record of your acceptance of these documents. Your subscription is canceled and your customer record at Stripe is deleted.

After that, only the following may remain:

• tasks you created or completed in other people's lists, which belong to the list owner (without your name);
• the messages you exchanged with support, for as long as needed to help you and for any legal obligations;
• database backups, kept for up to 7 days and then replaced;
• providers' technical logs, for a short time;
• payment records that Stripe and we must keep by law, for the legal period.

7. Cookies and browser storage

On todonex.com, your browser stores only your theme choice (light or dark) and, if you switch languages, a cookie named lang with your choice, for up to 1 year. Visit statistics don't use cookies.

In the app, we use the browser's storage, not tracking cookies, to:

• keep you logged in (your login session);
• keep a copy of your lists, tasks, name, preferences and plan, so the app opens fast and works even offline;
• remember device preferences, such as theme, language and whether notifications are on.

A privacy note (about your device, not about the system's security): the offline copy saves in the browser's storage (localStorage), as plain text, your lists and tasks, your name and the details of lists shared with you, such as the names and email addresses of the people on them. On a shared computer, anyone using the same browser profile could read it. That's why the app erases this copy when you log out. If you uncheck Remember me when logging in, the session and the copy are kept only until the app's tab is closed, but notifications turned on for that device keep arriving until you log out. On shared devices, uncheck Remember me and always log out when you're done.

After you log out, only device preferences, such as theme and language, and technical codes remain in the browser, without the content of your lists.

When you open the Premium payment, Stripe may use its own cookies to prevent fraud. Cloudflare's bot check, on the login, sign-up, password reset and resend confirmation screens, looks at browser data to tell people from bots. We don't use advertising cookies or tools that follow you across other websites.

8. Your rights

Under the LGPD (art. 18), you can ask us at any time for:

• confirmation that we process your data, and access to it;
• correction of incomplete, wrong or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed against the law;
• portability of your data;
• deletion of data processed with your consent, and withdrawal of that consent;
• information about who we share your data with, and about the option of not giving consent and its consequences;
• objection to processing that doesn't comply with the law.

You can do a lot of this yourself in the app, under Manage Account: change your name and photo, and delete your account with everything in it. For anything else, including a copy of your data, write to support@todonex.com from your account's email address. We reply within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

9. How we protect your data

Data travels encrypted (HTTPS) and is stored encrypted on the servers. Access rules in the database itself make sure each account sees only its own data and what was shared with it. Photos are kept in private storage and opened only through temporary links. We also use a bot check and limits on attempts.

No system is completely immune to failures. If a security incident could cause you significant risk or harm, we'll notify you and the ANPD, as the law requires. Use a strong password that you don't use on other websites.

10. Children and teenagers

Todonex isn't meant for children under 13, and we don't knowingly collect children's data. Teenagers aged 13 or older should use Todonex with the permission and guidance of their parents or guardians. If you learn that a child has created an account, write to support@todonex.com and we'll delete the data.

11. Changes to this Policy

We may update this Policy. The date of the last update is at the top of the page. If a change is significant, we'll let you know by email or in the app before it takes effect.

12. Contact

WordHost (Sergio Canabarro Vidal Junior), CNPJ 43.639.043/0001-24
Email: support@todonex.com