Legal

Privacy Policy

TODO-ish  ·  Operated by Sound Zone Trade LLC  ·  Effective date: August 20, 2026

TODO-ish is operated by Sound Zone Trade LLC (“we”, “our”, or “the app”). This Privacy Policy explains how TODO-ish collects, uses and protects your information. By using TODO-ish, you agree to the practices described below.

1. Information we collect

We collect only what is necessary to operate the app:

  • Account data: email address and display name when you create an account or sign in with Google or Apple.
  • User-generated content: tasks, notes, due dates, zones, steps, time tracking sessions and file attachments you create inside the app. Attachments are stored in Firebase Storage (Google).
  • Photos and media you select: photos and videos you choose from your photo library, and images you upload as zone icons, are uploaded to Firebase Storage. The app accesses only the items you explicitly select; it does not scan or index your photo library.
  • Content shared into the app: content you share into TODO-ish from other apps via the iOS share sheet — text, links, photos, files — is stored in your account in the same way as content you add inside the app.
  • Usage data: basic technical information such as app version, device type and operating system, used to diagnose crashes and improve performance.

We do not collect location data, contacts or advertising identifiers.

2. Biometric data

TODO-ish offers optional Face ID and Touch ID features (App Lock and biometric confirmation for sensitive actions). All biometric authentication is handled entirely by iOS using Apple’s LocalAuthentication framework. We never access, receive, store or transmit your biometric data. It never leaves your device.

3. Microphone and speech recognition

If you use voice input to create tasks, the app accesses your microphone and uses Apple’s Speech Recognition framework. Audio is processed by Apple on their servers in accordance with Apple’s privacy policy. We do not store or have access to your voice recordings.

4. File attachments

Files you attach to tasks are uploaded to Firebase Storage, a Google service, and are associated with your account. They are accessible to you and, for tasks in a shared zone, to the members of that zone. Upon account deletion, your files are removed within 30 days.

5. Calendar and Reminders integrations

All three integrations below are optional and require your permission.

  • Google Calendar. If you connect your Google Calendar, the app reads your events to display them alongside your tasks. We access only event titles, times and calendar names. We do not modify, delete or share your Google Calendar data. Access is governed by Google’s Privacy Policy.
  • Device calendar. With your permission, the app reads events from your device calendar (Apple EventKit) to display them alongside your tasks. This data is read on your device and is not uploaded to our servers.
  • Apple Reminders. With your permission, the app can read your Apple Reminders so you can import them as tasks. Imported items are stored in your TODO-ish account; nothing is written back to Reminders.

6. Shared zones

When you create a shared zone and invite others, or accept an invitation, the tasks, notes and attachments in that zone become visible to every member of the zone. Members also see the display name and email address of the other members.

Removing a member ends their access to the zone. Content they already downloaded to their own device is outside our control.

7. Handing over a task

When you hand a task to someone in your People list, its title, note and due date are sent to their account so they can accept or decline it. Both of you then see each other’s display name and the status of that task. Declining or completing it notifies the sender. A handed-over task cannot be recalled once the other person has accepted it, though either of you can delete your own copy.

8. Push notifications

With your permission, TODO-ish sends push notifications about tasks you have handed to other people — when they accept, complete or decline them.

To deliver them we register a notification token for your device with Firebase Cloud Messaging (Google) and store it with your account. The token identifies the device, not you personally, and is removed when you sign out or turn notifications off in iOS Settings. We do not use push notifications for advertising.

9. Product updates by email

If you opt in — in Settings, or when the app offers it — we may email you about new features, tutorials and updates. This is optional, off by default, and never a condition of using the app. We record the moment you gave consent so we can show when and how it was given.

You can withdraw consent at any time in Settings, or by using the unsubscribe link in any email. We do not sell or share your address with anyone.

10. Subscriptions and purchases

TODO-ish Premium is an auto-renewable subscription sold through the Apple App Store. Payments are processed by Apple; we never receive or store your payment card details.

To keep your subscription status in sync across your devices we use RevenueCat, Inc., a subscription-management provider. RevenueCat receives your app user identifier and the purchase information Apple provides — product purchased, purchase and expiry dates, renewal and cancellation status. It does not receive your tasks, notes or attachments. See RevenueCat’s privacy policy.

11. How we use your data

  • To operate and sync your tasks across devices
  • To authenticate your identity
  • To send reminders and notifications you have set up
  • To make shared zones work for the people you invite
  • To transfer tasks you hand to other people and keep both sides updated on their status
  • To manage your subscription status
  • To diagnose technical issues and improve the app
  • If you have opted in, to send you product updates by email
  • To fulfil legal obligations if required

We do not use your data for advertising, behavioural profiling, or sale to third parties. Ever.

12. Third-party services

  • Firebase Authentication (Google) — user sign-in and identity
  • Cloud Firestore (Google) — cloud storage for your tasks and settings
  • Firebase Storage (Google) — storage for file attachments
  • Firebase Cloud Messaging (Google) — delivery of optional push notifications
  • Firebase Crashlytics (Google) — crash reports used to diagnose and fix failures
  • Google Sign-In — optional authentication via Google account
  • Sign in with Apple (Apple Inc.) — optional authentication via Apple ID
  • Google Calendar API — optional display of your calendar events
  • Apple EventKit — optional reading of your device calendar and Reminders
  • Apple Speech Recognition — optional voice-to-text for task creation
  • RevenueCat, Inc. — subscription management
  • Apple App Store — app distribution and in-app purchases

Each third-party service is governed by its own privacy policy. We do not integrate any advertising networks or social analytics platforms.

13. Guest mode

You can use TODO-ish in the app without creating an account. In guest mode, all your data is stored locally on your device only and is not transmitted to our servers. If you uninstall the app, guest data is permanently deleted.

14. Using TODO-ish in a browser

TODO-ish is also available at todoish-4ab1b.web.app. The web version uses the same account and stores the same data in the same place as the app. Signing in is required — guest mode is not available in a browser, because data kept only in browser storage would be lost the moment that storage is cleared. Subscriptions cannot be purchased in the browser; Premium bought in the app applies there as well.

15. Data security

Your data is transmitted over encrypted connections (TLS) and stored securely using Google Firebase infrastructure. We apply reasonable technical and organisational measures to protect your information from unauthorised access.

16. Data retention and deletion

You can delete your account at any time from within the app (Settings → Delete Account). Upon deletion, your personal data and task content are removed from our servers within 30 days.

If a Premium subscription ends, files that exceed the free-plan limits are deactivated after a three-day grace period and kept for a further 30 days, so that resubscribing restores them. After that period they are permanently deleted. You are notified before each of these steps.

Backup copies of the database are kept for up to 7 days, and previous versions of stored files for up to 30 days, to protect against accidental loss. Data you delete disappears from the app immediately and from these copies as they age out.

17. Your rights

Depending on your location, you may have the right to access, correct, export or delete your personal data. Residents of California (CCPA) and the European Economic Area (GDPR) may exercise these rights by contacting us. We respond within 30 days.

18. Children’s privacy

TODO-ish is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

19. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

20. Contact

If you have any questions or requests regarding this Privacy Policy, please contact us at support@it4music.com, or through the contact page.

Sound Zone Trade LLC, registered in FL, United States.