Privacy Policy

Who operates TODO.md

TODO.md is operated by Andriy Viychuk (devviy.com), an individual developer and the controller of support information. devviy.com is the developer's website, not a separate company. Support goes to todo-md@devviy.com. Questions about this policy or requests about your personal data go to hello@devviy.com.

Your vault

TODO.md asks you to choose a folder of markdown files. An Obsidian vault works; so does any other notes folder. It uses the permission iOS grants for that folder to read task files and to make the edits you request, such as creating or checking off a task. The files remain in their existing location, including when they are stored through a provider such as iCloud Drive.

What stays on your device

The app stores its own settings locally in the shared container used by the app and widget, including the permission needed to reopen the vault you chose, widget preferences, task filters, and calendar or reminder options. Those settings are not sent to the feedback service. A feedback draft is held only during the current Settings session, not saved to disk.

Optional Apple integrations

Calendar

If you enable calendar sync, TODO.md creates and updates a dedicated app-owned Apple Calendar using the name you choose. It isolates its events to that calendar and does not edit your other calendars. Edits made directly in Calendar do not update your Markdown files.

Reminders

If you enable reminder capture and choose a destination file, TODO.md can move supported reminders from your default Apple Reminders list into that markdown file. It verifies the file write before removing a reminder.

Dictation

If you tap dictation in a task or feedback field, iOS transcribes your speech using Apple Speech Recognition. Apple may process it on your device or on its servers, depending on what iOS supports at that moment. The feedback service receives text only when you tap Send, not your recording. See Apple's Siri, Dictation & Privacy notice for how Apple handles that service.

Optional feedback

Send Feedback sends the text you enter and, if provided, your reply email to an HTTPS endpoint hosted by Vercel. The endpoint passes that information to Resend as a plain-text email addressed to our fixed support address, todo-md@devviy.com. We use it to understand your report, fix bugs, and reply if you supplied an email. No account is required. The app does not add vault content or paths, device identifiers, attachments, recordings, or automatic diagnostics. Please avoid including information you do not want to share.

The app sends once per explicit attempt and does not automatically resend. A success means Resend accepted the email, not that delivery to the mailbox has been proven. If acceptance cannot be confirmed, the app keeps your draft; choosing Send again may create a duplicate.

Why we process information

Where EU data protection law applies, our support handling and necessary website and service-security processing rely on our legitimate interests in answering requests, fixing problems, and keeping TODO.md available. We also process information when required by law. Feedback is voluntary and is not needed to use the app; without a reply email, we cannot reply to your report.

Support providers and retention

Vercel hosts and secures the service, processing IP addresses, IP-derived city/country location, and technical request/security metadata. Our endpoint does not log message bodies, reply addresses, or credentials. See Vercel's Privacy Notice.

Resend delivers the feedback email and documents 30-day retention for email content, metadata, and API logs, with seven-day backups. These records can include your message and optional reply address.

Cloudflare forwards support mail to Gmail, where we read and reply to it. We delete support copies under our control manually when report and follow-up needs end, except for justified legal or security retention. There is no automatic deletion timer. Google also uses mailbox content and activity for enabled smart features and their improvement.

Provider logs, backups, and mail-client copies have separate retention and deletion processes; deleting the app or a mailbox message does not immediately erase every copy. Cloudflare documents 31-day retention for routing events. See Cloudflare's, Google's, and Resend's privacy policies for their handling.

International processing

Vercel, Resend, Cloudflare, and Google may process support information outside the European Economic Area, including in the United States. Their covered US entities participate in the EU–US Data Privacy Framework. They publish transfer information in Vercel's notice, Resend's terms, Cloudflare's terms, and Google's transfer policy. Contact us for information about safeguards relevant to your data.

Website hosting and resources

Visiting our website generates standard web requests to Vercel to deliver and secure the pages, which transmit IP addresses and technical request metadata. The homepage also loads the Lucide icon library script from unpkg.com (unpkg.com), which processes standard HTTP requests from your browser to deliver that asset. These web visits are separate from the app and do not transmit your vault content.

Your rights and deleting data

You control your vault files directly: edit or remove them in your notes app or Files. You can remove TODO.md's local settings by deleting the app. Calendar events and reminders are managed in the Apple apps where they live.

Subject to applicable data protection laws and the legal basis for processing, you may have rights to request access to, rectification of, erasure of, restriction of processing of, or portability of your personal data, as well as rights to object to processing or withdraw previously given consent. You may also have the right to lodge a complaint with a competent supervisory authority.

Right to object: You can object to processing based on our legitimate interests by contacting hello@devviy.com. We will stop that processing unless applicable law permits us to continue, such as for compelling overriding grounds or legal claims.

To exercise these rights or ask about support information, contact hello@devviy.com with enough information to locate your message. We will evaluate and handle your request under applicable law, remove support copies under our control where applicable, and contact the relevant provider when its assistance is needed. Deleting the app does not delete already-sent feedback. Provider records, backups, and information retained for legal or security purposes follow their own retention and deletion processes; we do not promise immediate erasure of every partner or backup copy.

Changes

If this policy changes, the effective date at the top changes too. A material change to what TODO.md reads, sends, or stores will be called out in the app's release notes.