Privacy Policy

1. Information We Collect

Account information. When you create an account, we collect your email address. If you sign in with Apple or Google, we receive a verified email address and, optionally, a display name from those providers. You may also add a display name and profile photo directly in the app.

Task and content data. We store the tasks you create, including titles, descriptions, due dates, time windows, categories, repeat schedules, and any assigned group members or sub-tasks. If you attach a location to a task, we store those coordinates. We also store any Lists you create, including list names and the checklist items within them.

Habit data. We store the habits you create, including titles, notes, categories, frequency and weekdays, the times of day you want to be reminded, your daily target, and your check-in history and streak counts.

Activity and challenge data. We store the activities and challenges you create — names, descriptions, how-it-works text, requirements, restrictions, and start and end dates — along with your participation in them: entries, scores, targets reached, daily check-ins, votes cast, streaks, and leaderboard positions.

Community content. If you post to a group's feed ("The Wall"), we store your posts, comments, and reactions, along with the time they were made and which member made them.

Photos and images. You can attach images to your profile, to groups, activities, and challenges, and to completion or check-in proof. Uploaded images are stored in our cloud storage. Before any photo leaves your device, Todofun re-encodes it, which strips embedded metadata such as EXIF GPS coordinates — so the precise place a photo was taken is not uploaded with it.

Check-in location. Some challenges record where you check in. If you take part in one, we store the coordinates your device reports at that moment, together with a place label derived from them (for example, a gym name and city). The place label is shown to other participants. This is captured only at the moment you check in — Todofun does not follow your location between check-ins, and check-in location is only ever recorded for challenges that ask for it.

Date of birth and age band. The released app does not ask for this, because the public group features it applies to are switched off (see Section 7). Where they do apply, we ask for your date of birth once and store only the resulting age band (under 13, 13–17, or adult) — never the date itself — and use it to gate community features and to select the moderation threshold applied to your content.

Reports and blocks. If you report content or block another user, we store the report (the content reported, the reason, any note you add, and who submitted it) and the block relationship, so we can review the report and keep the block in force.

Shopping cart data. If you use the Shopping Cart feature (Premium Plus), we store the items you add — item names, quantities, notes, and whether they are ticked off — and the shops you add them under. For a shop, that includes its name and address and, when you pick it from a map search rather than typing it yourself, its coordinates and the map provider's place identifier. In a shared cart, all of this is visible to the other members of the linked group, including which member ticked an item off.

Product and place searches. If you use Find It Nearby or add a store to your cart, the search terms you enter and your approximate location are sent to our search providers so we can return matching products and nearby stores. We store the results you choose to save (such as a store name, address, and coordinates) with your cart.

AI Assistant data. If you use the AI Assistant feature (Premium Plus), we send your messages to our AI provider, together with enough of your own data for the assistant to answer usefully: your upcoming tasks, your lists and habits, the names of the groups you are in and their current group tasks, your device's time zone, and your app language. If your request is about somewhere nearby, your approximate coordinates are sent as well. Depending on what you ask for, the assistant may also run a web search, look up sports fixtures, or look up nearby places in order to answer. Conversations are held on your device and are not stored on our servers. We do not use any of this for any purpose beyond delivering the AI feature to you, and our providers do not use it to train their models.

The assistant proposes changes as cards you confirm. If you switch on auto-apply, safe changes are made to your own tasks, lists, and habits without a confirmation step, and each one can be undone from the reply that made it. Suggestions built from a web search are never auto-applied.

Content moderation data. Text and images you submit to public groups and shared content are checked automatically before they are published (see Section 8). This means the text and images pass through our moderation providers. We store the outcome of that check so we can explain a rejection to you and act on repeat violations.

Calendar sync data. If you enable Calendar Sync, Todofun reads and writes calendar event data on your device (via iOS EventKit or Android CalendarProvider). We store identifiers linking your tasks to calendar events so sync can be maintained. Calendar data is not transmitted to any third-party service other than your device's native calendar.

Location data. When you enable Location Reminders (a Premium feature), Todofun requests background location access so it can trigger a notification when you arrive at a task location. Location data is used solely to fire those local notifications on your device and is not transmitted to our servers in real time. Registered geofence coordinates are stored in your account so reminders persist across app restarts.

Push notification tokens and install identifiers. To deliver task reminders and group updates, we store an Expo push token for each of your installs, together with a random identifier generated on that install so a rotated token replaces the old record rather than adding a second one. That identifier is generated by us, not read from your hardware, and it is discarded when you uninstall the app. Push tokens are held on our servers and are never handed to other members of your groups — notifications sent by one member to another are dispatched by our server, not from their device.

Time zone, language, and notification preferences. We store your device's time zone and language so reminders fire at the right local hour and notifications reach you in the language you read. If you change your notification settings, we store which categories you have switched off and any quiet-hours window you set.

Group and invite data. When you create or join a group, we store the group name, description, member list, and any invite links or QR codes generated.

Referral data. Each account is assigned a unique referral code. We store referral relationships (who referred whom) and the rewards earned, to administer the referral program.

Subscription information. Premium and Premium Plus subscriptions are processed by Apple (App Store) or Google (Google Play) and managed through RevenueCat. We receive a customer identifier and entitlement status from RevenueCat. We do not store your payment card details.

Device information. We may collect basic device identifiers (platform, OS version) to diagnose bugs and ensure compatibility.

Device integrity checks. Before certain expensive requests — the AI Assistant, product and place searches, and content moderation — the app may ask the operating system to confirm that it is a genuine, unmodified copy of Todofun running on a genuine device. On Android this uses Google's Play Integrity service; the check returns a short-lived token about the app and the device, not about you, which our server verifies and then discards. We use it only to stop automated abuse of those endpoints.

Progress counters. We store the counts behind your streak flame, your tree, and your achievement gallery: how many tasks you have completed, your current streak, the date you were last active, and how many days you have been active. Achievements themselves are worked out on your device from data you already have.

Promo code redemptions. If you redeem a promotional code, we store the code, your user ID, what it granted, and when — so a code cannot be redeemed twice and so we can support the campaign it belongs to.

Join requests. If you ask to join a group, activity, or challenge that requires approval, we store the request and its outcome so the organiser can decide on it and so you can see where it stands.

Home screen widget data. If you add a Todofun widget to your home screen, a snapshot of what it draws — the titles and times of your upcoming tasks, lists, group items and habits, and your streak — is written to storage the widget can read on your device. It stays on the device, is refreshed from data you already have, and is cleared when you sign out.

Product analytics. We record a limited set of in-app events — such as opening the app, creating your first task, viewing the paywall, starting or completing a purchase, hitting a free-plan limit, and unlocking an achievement — together with your account identifier and basic device information. We use this to understand which features are used and where people get stuck. These events record that an action happened, not the contents of your tasks, lists, messages, or photos. This is first-party analytics only: we do not track you across other apps or websites, and we do not use it for advertising.

Diagnostic and crash data. When the app hits an error it cannot recover from, we send a report containing the error message, the stack trace, and which screen or subsystem it happened in, along with your account identifier and basic device information. We use these reports only to find and fix faults.

2. How We Use Your Information

We use the information we collect to:

• Create and maintain your account and sync your tasks, lists, and shopping cart across your devices.
• Deliver time-based and location-based task reminders via push notifications.
• Sync your tasks and lists to your device's native calendar when calendar sync is enabled.
• Enable group collaboration — sharing task assignments, shopping cart items, and progress with your group members.
• Power competitive task features, including assigning sub-tasks and tracking leaderboard rankings.
• Track your habit check-ins and streaks, and remind you at the times you choose.
• Respect the notification categories you have switched off, and hold group notifications during any quiet-hours window you set.
• Show your group's tasks, competitions, activities, and challenges on a shared calendar, and add a period of it to your phone's calendar when you ask.
• Draw your home screen widget, and keep your streak, tree, and achievements up to date.
• Run activities and challenges — recording entries, scores, check-ins, votes, and leaderboard standings, and showing them to other participants.
• Display your posts, comments, reactions, and proof photos to the other members of the group they were shared with.
• Let you discover and join public groups, activities, and challenges, including ones near your region — currently switched off; see Section 7.
• Check submitted text and images against our content rules before publishing them, and review reports of content that breaks those rules.
• Apply age-appropriate restrictions to community features based on your age band.
• Find products and nearby stores when you search for an item to add to your cart, and remind you when you arrive at a shop you asked to be reminded about.
• Process task information through the AI Assistant to generate task planning suggestions.
• Administer the referral program — tracking referral relationships and awarding earned rewards.
• Validate promotional codes and apply what they grant, once per account.
• Verify your Premium or Premium Plus entitlement and unlock the corresponding paid features.
• Send account-related emails (e.g., email verification, password reset).
• Investigate bugs, prevent abuse, and improve the app, including by checking that requests to our costlier endpoints come from a genuine, unmodified copy of the app.
• Measure which features are used, and where people get stuck, through first-party product analytics.
• Diagnose crashes and errors from automatically generated fault reports.

We do not use your data for advertising, and we do not sell your personal information to third parties.

3. How We Share Your Information

With your group members. When you are in a group, other members can see your display name, profile photo, task assignments, completion status, your activity and challenge participation (entries, scores, check-ins, streaks, and leaderboard position), anything you post to the group's feed, and (for Premium Plus groups) shared shopping cart items.

Publicly, in public groups. Public groups are open to anyone using Todofun. If you create or join a public group, or post an activity, challenge, entry, comment, reaction, or proof photo inside one, that content — together with your display name and profile photo — is visible to any Todofun user who finds the group through Discover. Do not post anything to a public group that you would not want a stranger to see. Groups you create are private by default; the app tells you which mode you are choosing.

Extra protection for teens. If your age band is 13–17, proof photos you submit are not shown publicly — only the group organiser can see them.

Service providers. We rely on the following third-party services to operate Todofun:

• Supabase — cloud database, authentication, and image storage that holds your account, task, list, habit, activity, challenge, community, shopping cart, and referral data.
• RevenueCat — subscription management and purchase verification. RevenueCat receives a user identifier and purchase receipts from Apple or Google.
• OpenAI — powers the AI Assistant. Receives the task text and questions you send to the assistant. OpenAI does not use this content to train its models.
• Google Cloud Vision — automated image moderation. Receives images you upload to shared or public content in order to screen them for explicit material.
• Google Maps Platform (Places & Geocoding) — finds and resolves nearby stores and task locations. Receives your search terms and approximate coordinates.
• SerpAPI — product search for the shopping cart. Receives the item terms you search for.
• Tavily — web search used by the AI Assistant when your request needs current information. Receives the search query derived from your request.
• TheSportsDB — sports fixture lookup used by the AI Assistant when you ask about a match or event. Receives the team or event terms derived from your request.
• Expo — delivers push notifications. Receives your push token and the notification content.
• PostHog — product analytics, crash reporting, and remote configuration. Receives the in-app events and fault reports described in Section 1, your account identifier, and basic device information, and returns the configuration that decides whether a promotional banner is currently running. PostHog processes this on our behalf and does not use it for advertising.
• Google Play Integrity (Android) — confirms that the app is a genuine, unmodified build on a genuine device before certain requests. Produces a token about the app and device, not about you.
• Apple / Google — if you sign in with Apple or Google, they handle authentication and share limited profile information with us per their own privacy policies. Calendar Sync on iOS uses Apple EventKit; on Android it uses the Android CalendarProvider — neither sends data to our servers beyond what we already store.

We do not share your data with any other third parties except when required by law.

4. Location Data

Todofun uses location in four separate, individually optional ways. Before we request background location access, the app shows you an in-app explanation of what is collected and why, and you must accept it before the system permission prompt appears.

Location Reminders (background). This is the only feature that needs "Always On" (background) access. The permission is used exclusively to monitor the geofences you set and to trigger a local notification when your device enters one. Arrival is detected on your device; we do not receive a stream of your position, and we do not build a location history. The geofence coordinates you choose are stored in your account so reminders survive app restarts.

Challenge check-ins (foreground, one-off). If you take part in a challenge that records check-in location, we read your position at the moment you tap check in and store it with that check-in, as described in Section 1. Other participants see the place label, not raw coordinates.

Shop arrival reminders (background). A shopping cart item or a pinned shop can be set to remind you when you get there. This uses the same background permission and the same on-device geofencing as location reminders above, and stores the shop's coordinates so the reminder survives a restart. For a shop shared with a group, arming the reminder is a decision each member makes on their own device — the organiser pinning the shop does not switch it on for anybody else. Where you ask to be reminded about a type of shop rather than a specific one, the app looks up matching shops near your current position when it refreshes the reminder; that lookup goes to our mapping provider (see Section 3).

Nearby search (foreground, one-off). When you search for a product or store, your approximate coordinates are sent to our search and mapping providers to return relevant results (see Section 3). If you ask the AI Assistant something about somewhere nearby, your approximate coordinates are sent with that request.

We do not use location for advertising, and we do not sell it. Outside of the cases above, we do not share your location with other users or third parties.

You can revoke location access at any time in your device's Settings. Revoking this permission will disable location-based reminders but will not affect any other app functionality.

5. Calendar Sync

When you enable Calendar Sync, Todofun requests read and write access to your device's calendar. This allows the app to create and update calendar events that correspond to your tasks and lists, and to reflect changes you make to those events back in Todofun. Calendar data is processed locally on your device via iOS EventKit or Android CalendarProvider. We store only the calendar event identifiers needed to maintain the sync link — we do not transmit your raw calendar data to our servers.

Group items are separate. From a group's Calendar tab you can add a period's tasks, competitions, activities, and challenges to your phone's calendar. Those events are written to their own "Todofun Groups" calendar, as a one-way copy — nothing is read back from them, and they are not part of the two-way sync above — so you can hide or delete that calendar without touching your own tasks. You can also share a picture of a calendar period through your phone's share sheet; where that picture goes is decided by you and the app you send it to.

You can disable Calendar Sync at any time from your Profile settings. Revoking calendar permission in device Settings will also stop sync. Events already added to your calendar are not removed automatically; you can delete them from your calendar app directly.

6. Push Notifications and Home Screen Widgets

Todofun sends push notifications to remind you about upcoming tasks and to notify you of group activity (e.g., a member completing a task). Notifications triggered by another member's action are composed and sent by our server, so your push token is never given out to the people you share a group with. You can turn individual categories off, and set a quiet-hours window that holds group notifications overnight, from Profile → Notification settings; your own reminders still ring during quiet hours. You can also turn notifications off entirely in your device settings. Disabling notifications will stop reminders but will not affect your account or data.

Todofun also offers home screen widgets. A widget draws from a snapshot stored on your device, as described in Section 1 — nothing is sent anywhere to render it. Bear in mind that a widget puts task titles, and anyone else's names that appear on them, on a screen that can be read without unlocking your phone. Remove the widget if that is not what you want.

You can save or share images the app generates — a recap card, an achievement, or a group calendar period — through your phone's share sheet or to your photo library. Doing so hands that image to whichever app or person you choose; from that point it is outside Todofun.

7. Public Groups and Discover

Currently unavailable. Public groups and the Discover screen are switched off in the released app. New groups are private, and Discover cannot be opened. This section describes how those features work, and continues to apply to the small number of public groups that already existed when they were switched off. We will update this policy before turning them back on.

Todofun has both private and public groups. Private groups are invite-only and their content is visible only to members. Public groups can be found and joined by any Todofun user through the Discover screen, either globally or filtered to a region.

Anything you publish in a public group — the group itself, activities, challenges, entries, comments, reactions, proof photos, and your display name and profile photo — is public content. It can be seen by people you have not met and who are not in your contacts. Treat it as you would a post on any public social platform.

If you filter Discover to your region, we determine your approximate region from your device to show nearby groups. We use this to sort and filter results, not to build a location profile.

You can leave a public group at any time. Content you already posted may remain visible to the group until you or the organiser deletes it.

8. Content Moderation and Safety

Because public groups carry user-generated content, we screen that content. Text you submit is checked automatically against our content rules, and images you upload to shared or public content are screened by an automated image-moderation service before they are published. Content that fails a check is rejected and you are asked to edit it — it is never posted.

Every user can report content and block other users from inside the app. Reports are confidential and reviewed by our team within 24 hours. We store reports and the associated content so we can investigate; if we find a violation, we remove the content and may suspend or remove the account responsible.

Blocking a user hides their content from you and prevents them from interacting with you. We store the block relationship for as long as it is in effect.

You can also report a reply from the AI Assistant, from the reply itself. When you do, we store the reply you reported, the message you sent that produced it, the reason you chose, any note you add, and your user ID, so we can review the reply and improve the assistant. These reports are kept separately from the content reports above and are not visible to other users.

We ask for your date of birth once, before you first use community features, and keep only the resulting age band. Users under 13 cannot access public group features. Users aged 13–17 are subject to stricter moderation thresholds, and their proof photos are visible only to the group organiser rather than publicly.

9. Referral Program

Todofun's referral program assigns a unique referral code to each account. When you share your referral link and a new user signs up through it, we store the referral relationship (your user ID and theirs) to track reward eligibility. We do not share referral relationship data with third parties. Referral rewards (free premium months) are applied directly to your account.

10. Premium Subscriptions

Todofun Premium and Todofun Premium Plus are monthly auto-renewing subscriptions purchased through the App Store or Google Play. Payment is charged to your Apple or Google account at confirmation of purchase. Your subscription renews automatically each month unless cancelled at least 24 hours before the end of the current period.

You can manage or cancel your subscription at any time through your App Store or Google Play account settings. Cancelling stops future renewals; you retain access to your tier's features until the end of the paid period.

11. Data Retention

We retain your account and task data for as long as your account is active. You can permanently delete your account from the Profile section of the app. Deleting your account removes your personal information, tasks, lists, habits, shopping cart data, uploaded images, and group memberships from our servers within a reasonable period, subject to any legal obligations to retain certain records.

Note that content you contributed to shared groups (e.g., task assignments, shopping cart items, posts, comments, or challenge entries you created) may remain visible to other group members until the group owner removes it. Content you posted in a public group may remain visible publicly on the same basis.

Images that are no longer attached to anything are removed from storage automatically. Reports and moderation records may be retained after the related content is deleted, so that we can enforce against repeat violations. Records of promotional codes you have redeemed are kept for as long as needed to stop a code being redeemed twice. Push records for installs that no longer exist are pruned automatically.

12. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, or delete your personal data. You can:

• Delete your account from Profile → Edit Profile → Delete Account.
• Update your profile (display name, photo) at any time in the app.
• Revoke location access in your device Settings.
• Revoke notification access in your device Settings, or turn off individual notification categories and set quiet hours from Profile → Notification settings.
• Disable Calendar Sync from your Profile settings or by revoking calendar access in device Settings, and delete the "Todofun Groups" calendar from your calendar app.
• Remove a home screen widget at any time from your device's home screen.
• Delete content you posted — your posts, comments, challenge entries, and uploaded images — from within the app.
• Leave a public group at any time, and switch groups you own between private and public.
• Block or report another user from any piece of their content.
• Request a copy or deletion of your data by contacting us at the address below.

13. Children's Privacy

Todofun is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Community features — public groups, Discover, and the public feed — are gated behind a one-time date-of-birth check. Users who indicate they are under 13 are blocked from those features entirely. Users aged 13–17 can take part but receive stricter content moderation, and their proof photos are shown only to the group organiser, never publicly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and, for significant changes, notify you within the app. Continued use of Todofun after changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, want a copy of your data, or want your data deleted, email us at pfengstudio@gmail.com. You can also reach us through the Support page or the Contact page on this website, or from Profile → Support inside the app.

Todofun is published by pfengstudio.