TODOforAI Privacy Policy
Last updated: November 5, 2026
At TODOforAI, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, services, and applications (collectively, the "Services").
Our goal is to provide as many options as possible to keep your data in your control. We don't want to train on your data and we store your data only to be able to provide you the best service. Also during the cooperation with 3rd parties (as you may know we don't have own LLMs and we believe that we should keep our service LLM independent so you can choose your LLM provider), but during our cooperation we are motivated to have privacy rights to be kept. But later on with OLLAMA it will be possible to reach zero-trust LLM service with us, which means you will share actually literally no sensitive data with us while using our service.
Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy.
a. Personal Information
We may collect personal information that you voluntarily provide to us when you register for an account, express an interest in obtaining information about us or our Services, or otherwise contact us. This information may include:
- Email address
- First name and last name
- Billing information
- Account credentials
- Profile information
- Cookies
- Usage data
b. Usage Data
We may also collect information about how you access and use our Services, including:
- IP address
- Browser type
- Device information
- Pages visited
- Time spent on pages
- Referring website
- Other diagnostic data
Tracking Technologies and Cookies
We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:
- Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.
- Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).
c. User Content
We collect and store the content you create, upload, or receive from others when using our Services, including TODOs, tasks, and any files or data you provide to our AI services for processing.
We use the information we collect for various purposes, including to:
- Provide, maintain, and improve our Services
- Process transactions and send related information
- Send administrative information, such as updates, security alerts, and support messages
- Respond to your comments, questions, and requests
- Personalize your experience and deliver content relevant to your interests
- Monitor and analyze trends, usage, and activities in connection with our Services
- Detect, prevent, and address technical issues, fraud, and other illegal activities
- Support and improve our AI-powered features and service quality
We may share your information in the following situations:
- With Service Providers: We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf.
- For Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
- With Your Consent: We may disclose your information for any other purpose with your consent.
- With Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
- With Business Partners: We may share your information with our business partners to offer you certain products, services, or promotions.
- To Comply with Law: We may disclose your information where required to do so by law or subpoena or if we believe that such action is necessary to comply with the law and the reasonable requests of law enforcement.
TODOforAI does not operate its own large language models. To generate responses, plan and execute your TODOs, transcribe voice, and generate images, we send the content you provide to third-party AI providers. This section explains exactly what is sent, to whom, and how you control it.
What data is sent
- The text of your messages, TODOs, tasks, and instructions
- Files, images, screenshots, and documents you attach or that your agent reads while working on a task
- Conversation history needed as context for the current request
- Voice audio when you use voice input or voice replies (transcription and text-to-speech)
- Business context you connect (for example your website content or connected tools) when a task requires it
We do not send your account credentials, password, or billing details to AI providers.
Who the data is sent to
Your request is sent only to the provider of the model that handles it. If a provider's model is never used, no request is sent to that model provider. The model picker shows which provider serves each model. Providers currently available include:
- Anthropic (Claude models)
- OpenAI (GPT models, realtime voice)
- Google (Gemini models, image generation)
- xAI (Grok models)
- Mistral AI (Mistral models, EU)
- Cerebras (fast models, including the voice assistant)
- OpenRouter, which routes the request to the provider serving the selected model, and other model hosts (for example DeepSeek, Moonshot, Xiaomi MiMo, Z.ai and others)
- Optional tool providers for speech-to-text and text-to-speech, music generation, web search and reading public web pages or social profiles: only when the agent uses that tool
These providers process your data to return the requested output and may keep it for a limited period under their own terms (for example for abuse monitoring). We have opted out of model training on every AI provider account we use, so providers do not use your inputs or outputs to train their models. The only exceptions are providers whose terms do not offer this opt-out; the model picker marks these models, and they are used only if you select them. Each provider protects your data under its own privacy policy and data processing terms. Providers may be added or removed over time. The full list, with each provider's location and transfer mechanism, is on our GDPR & Data Processing page; business customers can sign our Data Processing Agreement.
Provider restrictions (Team and Scale plans). On Team and Scale subscriptions, the organisation's owner may restrict which AI model providers process the organisation's data, in line with the organisation's internal policies, for example to providers that process data within the European Union and/or providers with zero data retention. When a restriction is in effect, requests are routed only to permitted providers, and models or features without a permitted provider are unavailable to the organisation's members.
Your permission and control
- Before your first AI request in our apps we show what will be shared and with whom, and ask for your consent. AI features are not used until you agree.
- You choose which model provider handles your requests in Settings.
- You can run models locally (for example via Ollama) so that no content leaves your machine.
- You can export or permanently delete your data at any time from Settings → Data Controls.
- Stripe, Paddle, RevenueCat, Apple App Store, Google Play: payment processing (we never store full card numbers)
- Resend: transactional email (account and billing notifications)
- PostHog: product analytics (usage events, device type; no message content)
- Cloudflare: DNS, CDN and network security
- Expo: mobile push notifications
- Hetzner: hosting in the EU (Germany and Finland), storing your account data and TODOs
When you choose "Continue with Facebook", you sign in with Facebook Login and pick which Facebook Pages TODOforAI may use. We only access Pages you manage and grant, and the Instagram professional accounts linked to them.
- What we receive: the Page name and ID, a Page access token, the linked Instagram account ID and username, and the posts, captions and comments of those Pages and accounts.
- How we use it: to learn how your brand writes from its own posts, to publish posts you create or approve, and to read and reply to comments on your Pages and Instagram posts, only when you ask for it.
- Where it is stored: the Page token is stored on our servers and on the device you connected. We never sell this data, use it for advertising, or share it with anyone except the AI provider you choose when a task needs the post text (see 3a).
- Removing access: disconnect the Page in TODOforAI, or remove TODOforAI in Facebook Settings → Business Integrations. Deleting your TODOforAI account deletes every stored Page token and Page record immediately. When you remove TODOforAI in Facebook, Facebook asks us to delete this data and we do it right away; see Facebook and Instagram Data Deletion. To request deletion without an account, email privacy@todofor.ai.
The TODOforAI plugin in ChatGPT recommends ready-made TODOs for a business goal. It needs no TODOforAI account and does not sign you in.
- What we receive: only what ChatGPT sends to the plugin: your goal as written, and the business name and website if you mention them. Never your ChatGPT account, chat history or files.
- How we use it: to match your goal to TODO templates. The goal text is sent to DeepInfra (text embeddings) and to Vercel AI Gateway (ranking model) for this purpose only.
- What we log: the goal, business name, website, the recommended templates and which recommendation you opened. We use this log only to improve matching. It is not linked to any account, and never shown to other users, sold or shared.
- Deletion: email privacy@todofor.ai with the goal text you used and we delete the matching entries.
When you click "Connect" for Gmail, Google Calendar or Google Drive, you sign in with Google and approve the access shown on Google's consent screen. This section applies to all data we receive from Google APIs and takes precedence over sections 2 and 3 for that data.
- What we access: Gmail: your messages, threads, labels and drafts, to read, search, label and draft or send email. Google Calendar: your events, to list, create, update and answer them. Google Drive: your files and folders, to find, read, create, update and organise the files your requests are about. Your Google email address identifies the connected account.
- How we use it: only to provide the features you use in TODOforAI: answering your requests, preparing replies and drafts for your review, sending email or creating events you ask for, organising your inbox and showing incoming email in your Feed. An email is sent or an event is changed only when you ask for it, or by an automation you set up.
- Where it is stored: the Google sign-in token is stored only on the machine you connected (your computer or your TODOforAI cloud machine), never in our main database. Message and event content the agent reads while working on a task is stored as part of that task in your TODOforAI account, hosted in the EU (Hetzner, Germany and Finland), encrypted in transit and at rest.
- Who it is shared with: only the AI provider that handles the task (see 3a), to produce the response you asked for, under contracts that forbid using the data to train their models. We do not sell Google user data, use it for advertising, share it with business partners or data brokers, or let people read it, except with your explicit consent for a specific message, for security purposes (for example investigating abuse), to comply with applicable law, or in aggregated, anonymised form for internal operations.
- No AI training: we do not use Google user data to develop, improve or train generalised AI or machine-learning models, and we do not send it to any provider that does.
- Removing access and deletion: disconnect the account on the tool's tile in TODOforAI (this deletes the token on that machine), or revoke TODOforAI at myaccount.google.com/permissions. Deleting a task deletes the Google data it contains; deleting your TODOforAI account deletes all of it. To request deletion, email privacy@todofor.ai.
TODOforAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process, including encryption in transit and at rest, access controls and monitoring. Our Security page describes these measures.
We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.
Depending on your location, you may have certain rights regarding your personal information, such as:
- The right to access the personal information we have about you
- The right to request that we correct or update any personal information we have about you
- The right to request that we delete any personal information we have about you
- The right to request that we restrict the processing of your personal information
- The right to object to the processing of your personal information
- The right to data portability
You can export or permanently delete your data from Settings → Data Controls. See our Account Deletion page for step-by-step instructions. You can also contact us using the information below.
Our Services are not intended for use by children under the age of 13. We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we can take necessary actions.
Our Services may contain links to third-party websites and applications. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We advise you to read the privacy policy of every website you visit.
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
If you have any questions about this Privacy Policy, You can contact us:
- By email: privacy@todofor.ai
Last Updated: November 5, 2026
You can link your X, Instagram or Reddit account (todofor.ai/x, todofor.ai/instagram, todofor.ai/reddit) so that public posts and comments in which you tag @TODOforAI (X), @todoforai (Instagram) or u/TODOforAI (Reddit) become tasks in a group of your workspace. You link an account by posting a one-time code that tags us; we never ask for your password and get no access to your account.