Privacy Policy

Last updated: 16 July 2026

This policy says what Todoing stores, where it lives, who can see it, and what your rights are. Short version: your plan data belongs to your team, it's hosted in the EU, we run no ad trackers, and the only third party that ever sees task text is Anthropic, and only to generate AI briefs, on paid plans.

1. What we store

Account: your name, email and avatar (from Google or your sign-in email).
Workspace content: tasks, projects, milestones, scrum notes, briefs, member roles, and activity records (who changed what, visible to workspace admins' tooling).
Billing: a billing email and plan status. Payments are handled by Stripe; we never see or store your card numbers.

2. Where it lives

All workspace data is stored with Supabase (Postgres) in the EU (London, eu-west-2). Workspaces are isolated from each other at the database level (row-level security per organisation). The app is served via Vercel. We may use Sentry for error monitoring; when enabled it receives technical crash reports (stack traces, the page address, your user id and workspace name) so we can fix bugs, but never your task content. We take reasonable technical measures to protect your data, but no online service is completely secure, and we cannot guarantee absolute security.

3. AI features, the important disclosure

On the Enterprise plan (and during trials), two features send workspace text to Anthropic's Claude API to be processed: the morning brief (task titles, project and milestone names, assignee first names, schedule shape) and scrum reconcile (the notes you paste plus that day's task titles). This happens server-side, only to generate the output you asked for. Per Anthropic's commercial API terms, this data is not used to train their models. Free and Pro workspaces never have data sent to Anthropic.

4. What we don't do

No advertising trackers, no analytics cookies from ad networks, no selling data, ever.
No reading your workspace content, except when you ask us to for support, or as required to operate the service (e.g. abuse investigation).
Estimation analytics are aggregate by design and never used to score individuals.

5. Cookies

Only what sign-in requires: an authentication session (Supabase Auth) and a preference for light or dark mode. That's it.

6. Your rights (GDPR)

You can ask us to export or delete your personal data, correct it, or object to processing; email support@todoing.co and we'll act within 30 days. Workspace content is controlled by your workspace owner; deletion requests for team data go through them. The data controller is Todoing (contact above). You may also complain to your local data-protection authority.

7. Retention and deletion

Workspace data is kept while the workspace exists. When a workspace is deleted, its content is removed from the live database immediately and from backups on their rotation schedule.

8. Changes

If this policy changes materially, workspace owners get notified by email or in-app before the change takes effect.

← Back to todoing.co