YOUR INFORMATION

ToDoArc — Privacy Policy

Effective date:: 12 October 2026
Last updated:: 12 October 2026

Your tasks, notes and schedules can reveal a lot about your life. At ToDoArc, we aim to handle that information carefully and explain clearly what happens to it. This Privacy Policy applies to our website, Android and iOS applications, and the web application when available. It should be read with our Terms of Use.

1. Who is responsible for your data?

The operator of ToDoArc and the controller of personal information processed for the consumer Service is:

Galaxyway AI Ltd
Company number: 15966090
Registered address: Holly Hill Road, Erith, England, DA8 1QD, United Kingdom
Privacy enquiries: support@todoarc.com
Website: https://todoarc.com

Where we later provide a separately contracted business workspace, we may act as a processor on behalf of a business customer for some workspace content. Any applicable data processing agreement will explain those roles.

2. Scope

This Policy explains our handling of personal information relating to the ToDoArc website, mobile apps, account creation and sign-in, task and list management, offline storage, cloud synchronisation, reminders, support, and any available integrations or paid features. Functionality may vary between devices and releases. The sections addressing optional future functionality apply only when you choose to use it after it becomes available.

3. In brief: how ToDoArc handles information

Guest use is local-first. Some task content may remain solely on your device and never reach our servers.
Account sync is different. When you sign in and enable cloud synchronisation, supported content is sent to our cloud infrastructure so it can appear on your authorised devices.
Your tasks belong to you. We process them to provide the features you request; we do not claim ownership of them.
We do not sell your task content or use it to target advertising based on the contents of your lists or notes.
Reminders may be device-local. We store the reminder information needed for your account features and use device notifications where you permit them.
You can request access, correction or deletion by contacting us. Account deletion is also available through the applicable app or the website deletion process.

4. Information we receive and why

4.1 Account and authentication information

When you register or sign in, we process your email address, account ID, authentication provider, sign-in status, session and token metadata, account creation and update times, and security-related sign-in events. We use these to create and protect your account, send one-time verification codes or magic links, keep sessions working and respond to account requests. You are not required to create a conventional password where passwordless sign-in is provided.

4.2 Tasks, lists and planning content

Information you choose to enter may include titles, descriptions, notes, priorities, due dates, start times, estimated durations, reminders, recurrence rules, completion status, list or space membership, projects, and planning settings. We process this information to save and display tasks, calculate your schedule, deliver the requested functions and synchronise authorised devices when enabled.

4.3 Offline, installation and synchronisation records

The application may create a local installation identifier, stable guest identity, local account partition, record identifiers, versions, edit timestamps, queued operations, synchronisation cursors, deletion records (tombstones), conflict history, last-sync information and associated error codes. These help prevent duplicated tasks, keep accounts separated, reconcile changes made on different devices and recover from interrupted sync. Local storage can exist without us receiving the associated content.

4.4 Reminders and notification information

We process reminder dates, times, linked task IDs and preferences needed to schedule reminders. The device may maintain its own local notification IDs and permission state. Where push notification services are used, the relevant device or push token and delivery status may be processed. We use this information only to support notifications and related security or troubleshooting.

4.5 Device, security and diagnostics

Depending on the app version and services enabled, technical information may include operating-system and device type, application version, language, time zone, network and connection status, IP address in server logs, error or crash information, performance metrics, security events and approximate timestamps. We use this information to diagnose problems, prevent abuse and keep the Service secure. We aim not to put task titles, notes, one-time codes or authentication tokens into analytics and routine crash reports.

4.6 Preferences

We process settings you choose, including light or dark mode, language, time format, week start, planning window, default task duration, notification preferences and account-sync preferences. Some preferences may remain on your device; others may follow you between devices when cloud sync is enabled.

4.7 Messages and support requests

When you contact support, we receive the email address and content of your request and any information you choose to supply, such as screenshots, attachments or diagnostic details. Please redact confidential information that is not necessary to resolve the issue.

4.8 Website and web-app use

When you visit todoarc.com or use a browser-based version of ToDoArc, web servers may receive IP address, browser/device information, requested pages, time of access and technical security events. Essential cookies or comparable storage technologies may maintain a session, remember a preference or protect the website. Non-essential technologies, if introduced, are addressed in section 12.

4.9 Optional purchases

If subscriptions or purchases are introduced, we may receive plan, entitlement, billing status, store or payment-provider transaction ID, renewal and cancellation information. Apple, Google or a payment provider may process payment details under their own privacy practices; we do not need your complete payment-card number to deliver an app-store subscription.

4.10 Optional future integrations, sharing and AI

If you connect an external calendar, share a workspace, upload an attachment, enable voice capture, use a location-based reminder or request an AI-assisted function, we may need relevant data and permissions for that feature. We will explain the access requested at the time and update this Policy where the processing changes materially. These features are not necessarily active in the current app.

5. Local-only guest use versus an authenticated account

Guest mode. The app may save tasks and preferences in SQLite or other storage on your device. We may not have a copy of this content. Guest data may be lost if you uninstall the app, clear storage or lose your device, subject to any device-level backup you independently enable.

Signed-in cloud mode. When authorised cloud sync is enabled, supported data is transmitted to cloud infrastructure and associated with your account. The Service may also store operational information about versions, queues, deletions and conflicts. Data may not upload immediately while offline or when sync is blocked; consult the displayed sync status. Changing accounts on a shared device should keep account data partitioned, but you should also protect the device and sign out where appropriate.

6. Lawful bases for processing

For users covered by the UK GDPR, our main purposes and lawful bases are:

Purposes, data categories and lawful bases
Purpose	Main data categories	Legal basis
Set up and maintain your account	Email, identifiers, session data	Performance of a contract
Provide tasks, lists, planning and account sync	User Content, preferences, sync records	Performance of a contract
Send requested reminders	Task/reminder details, local or push tokens	Performance of a contract; device permission as applicable
Provide requested support	Support messages, relevant diagnostics	Contract and/or legitimate interests
Detect fraud, security issues and service abuse	Access logs, device and account signals	Legitimate interests and/or legal obligation
Diagnose errors and improve stability	Crash and limited performance data	Legitimate interests, subject to consent or device-access rules where required
Administer subscriptions and accounts	Entitlements and transaction records	Contract and legal obligation
Keep required accounting and legal records	Relevant transaction and correspondence records	Legal obligation
Send optional marketing	Email and marketing choice	Consent or another basis permitted by applicable marketing law
Handle legal claims	Information relevant to a specific claim	Legitimate interests or legal obligation

Where we rely on legitimate interests, these include protecting the Service, investigating misuse, improving reliability and handling enquiries. We consider the potential effects on individuals and their rights. You may object to processing based on legitimate interests in circumstances provided by law.

A device permission does not, by itself, replace the need for an appropriate legal basis under data-protection law.

7. Sensitive information in tasks

You may choose to write a task or note that mentions health, religion, political views or other information receiving special protection under data-protection law. ToDoArc does not request this information as a condition of ordinary task management. Please do not use the app as a medical-record, password or highly confidential document repository.

We do not intentionally analyse task content to infer protected characteristics or use it for behavioural advertising. If a feature requires intentional processing of special-category data, we will assess and apply the additional lawful condition and safeguards required before enabling it. You may contact us about a sensitive-content concern at support@todoarc.com.

8. Where personal information comes from

We receive information from you, your devices and your authorised use of the app; from our authentication, hosting or technical providers; from app stores for relevant transactions; from support messages; and, when enabled, from calendar or other providers you deliberately connect. For future shared spaces, another authorised participant may add content involving you.

Where you provide personal information about another person, you should have a lawful reason and authority to do so.

9. Who receives information

We use providers that supply functions needed to operate the Service. Based on the existing ToDoArc architecture, these include:

Supabase, for cloud database, authentication and account synchronisation services.
Expo and related mobile build/update infrastructure, as relevant to app build, distribution or updates. Not every Expo service necessarily receives private task content.
Email-delivery and support providers, to deliver sign-in codes, support responses or essential service messages.
Apple and Google, for app distribution, platform services and purchases where used.
Hosting, security and diagnostics services, as enabled in the deployed mobile apps or website.
Payment or calendar providers, only where a relevant purchase or integration is enabled.

Providers receive information appropriate to their role, subject to applicable contracts and protections. We may also disclose information to professional advisers, courts, regulators or law-enforcement authorities where lawfully required, and as part of a business sale or reorganisation subject to applicable safeguards.

We do not sell personal information or private task content to advertisers. We do not permit third parties to use synced task content to target ads to you.

10. International processing and transfers

Our providers may store or process some information outside the United Kingdom. Where UK law requires safeguards for an international transfer, we use an applicable adequacy decision, the UK International Data Transfer Agreement or UK Addendum, or another lawful mechanism, together with assessments and additional measures where required. Contact support@todoarc.com to ask about relevant transfer safeguards.

The location of a provider's corporate headquarters does not necessarily determine the region in which your data is hosted.

11. Security

We apply technical and organisational measures appropriate to the information and risk, which may include encrypted network connections, provider-side encryption at rest, secure storage of authentication secrets on mobile devices, database access controls, Row Level Security, account-scoped local data, testing, access restrictions and operational monitoring.

Local-first does not mean all task content is end-to-end encrypted. Unless a feature expressly says otherwise, you should not assume that only you hold decryption keys. No method of storage or transmission can guarantee absolute security. Keep your email account and device secure, install updates, and do not share sign-in codes.

12. Cookies, web storage and similar technologies

Our website and web app may use strictly necessary storage and access technologies to operate security controls, remember essential preferences, keep you signed in and maintain sessions. The mobile apps also use local device storage required for offline task management and authentication.

If we introduce non-essential analytics, advertising, tracking pixels or comparable technologies, we will provide the information and consent or objection mechanism required by the UK Privacy and Electronic Communications Regulations and other applicable law. Where consent is required, these technologies will not activate before valid consent. Browser and device controls may also allow you to manage stored information. An applicable cookie notice or settings page will provide more specific details when non-essential technologies are used.

13. Automated planning and AI

ToDoArc may use scheduling rules to suggest times, prioritise tasks or create a daily plan. Suggestions are aids to organisation; they can be incorrect and should be reviewed. We do not intend these ordinary scheduling functions to make decisions that have legal or similarly significant effects on you.

If a future feature sends task information to an external AI service or uses it for a materially different purpose, we will provide additional information before introducing that use, including relevant recipients and available controls. We do not use private task content to train general-purpose AI models as part of the described current task-management service.

14. Marketing and communications

We use your email to send requested sign-in codes and essential security, account or service notices. These are distinct from optional promotional communications. Where we send marketing, we will meet applicable consent and unsubscribe requirements. You can opt out of promotional messages without losing necessary account and security notices.

15. Retention and deletion

We keep personal information only for as long as reasonably necessary for the purposes described here, taking account of your choices, account status, legal requirements and legitimate security or dispute needs. The main criteria are:

Data retention principles
Data	Retention principle
Account profile and synced User Content	Generally while your account is active, until you delete an item or request account deletion, subject to lawful exceptions
Local guest records	Until removed from the device, the app's storage is cleared or device-backup behaviour applies; they may not be accessible to us
Pending sync operations and tombstones	Until processing, reconciliation and reasonable multi-device deletion protection are complete
Conflict/recovery records	As long as reasonably needed to resolve or recover conflicts, then removed on the relevant cleanup cycle
Session and authentication records	For session security and a limited period necessary for fraud detection and investigation
Crash, server and security logs	For a limited period tied to troubleshooting, security and legal needs
Support correspondence	Until the enquiry and any appropriate follow-up, dispute or legal retention needs end
Transaction and accounting records	As required by applicable tax, accounting and consumer law
Backups	Until their scheduled rotation and expiry, subject to disaster recovery and applicable legal holds

Following a verified account-deletion request, we remove the account and associated active cloud User Content without undue delay, subject to lawful exceptions and the practical time necessary to process the request. Residual backup copies may remain until the normal backup rotation completes; if restored for disaster recovery, deletion requests must be re-applied. Where information must be retained for a legal obligation or claim, we restrict its use accordingly.

You may ask about the specific retention period or deletion status that applies to your account at support@todoarc.com. Before publication, our production retention configuration should be checked against these criteria.

16. Account deletion

You may initiate account deletion through the applicable in-app account settings, visit https://todoarc.com/account-deletion, or contact support@todoarc.com. We may need to verify that you control the account. Deleting the app alone does not delete an account or remote data.

Account deletion is intended to remove the account and personal information associated with it from active services, except where retention is required or permitted by law. Some items shared with other users may need special handling, and we will explain any material exception. Deleting an account does not necessarily cancel an Apple or Google subscription; you should also manage app-store subscriptions with the relevant store.

17. Access, correction, portability and export

You can view and edit much of your task information directly in ToDoArc. You can also request access to your personal information, correct inaccurate information or request a copy in an appropriate format by emailing support@todoarc.com. We may verify your identity and may lawfully withhold information that would adversely affect another person's rights.

An in-app export feature may become available; you do not need to wait for that feature to exercise a legal right of access or portability where it applies.

18. Your data-protection rights

Subject to the requirements and exceptions of applicable law, you may have rights to:

Be informed about how your personal information is processed.
Access a copy of information held about you.
Correct inaccurate or incomplete information.
Request erasure in relevant circumstances.
Restrict certain processing.
Object to processing based on legitimate interests.
Receive certain data in a portable format.
Withdraw consent where processing depends on consent, without affecting earlier lawful processing.
Object to direct marketing.
Challenge certain qualifying solely automated decisions.

Email support@todoarc.com to exercise a right. We will respond within the period required by applicable law, generally within one month for UK GDPR requests, subject to permitted extensions, exemptions and identity checks. Rights are not absolute, and we will explain any refusal where required.

19. Children

ToDoArc is intended for people aged 13 and over and is not directed at younger children. We do not knowingly seek account registrations from children under 13. If you believe a child has registered contrary to this Policy, contact us. If we introduce family accounts or child profiles, we will review age-appropriate protections, parental authority and the associated processing before launch.

20. Business and shared workspaces

If organisation or shared workspace features are introduced, the relevant organisation or workspace administrator may determine membership and access. When a business determines the purpose and manner of its workspace data processing, additional controller/processor arrangements and a data processing agreement may apply. The workspace's members should follow their organisation's privacy and confidentiality rules.

21. Personal data incidents

We maintain procedures for responding to security incidents. Where an incident is a reportable personal-data breach, we will notify the relevant regulator and affected individuals when applicable law requires it. Reporting periods depend on the seriousness and legal circumstances of the incident.

22. Your choices and device controls

You may be able to change privacy-related controls by:

Using ToDoArc settings to change reminder, planning and sync preferences.
Using device settings to control notifications and permissions.
Disconnecting optional third-party integrations where available.
Managing marketing preferences or eligible website cookies.
Requesting data access, export or account deletion.

Turning off cloud synchronisation does not necessarily delete data that has already been stored remotely. Use the deletion process where you want associated cloud information erased.

23. Independent third parties

Links from the Service may lead to websites or services operated independently of Galaxyway AI Ltd. Their own privacy notices apply to their processing. We do not control every third party's privacy practices, but we remain accountable for our own data-protection obligations.

24. Changes to this Policy

We may update this Policy to reflect product changes, new providers, new processing, law or security practices. The date at the top will change. If a material change affects how we use personal information, we will provide an appropriate notice before applying the new use and obtain consent if required.

25. Complaints and contact

If you have questions or concerns, please contact us:

Galaxyway AI Ltd
Company number: 15966090
Registered address: Holly Hill Road, Erith, England, DA8 1QD, United Kingdom
Email: support@todoarc.com
Website: https://todoarc.com

You can also complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/. Contacting us first may help resolve the issue, but you are not required to surrender your statutory right to complain to a regulator or pursue a legal remedy.

This Policy covers features that are available and explains how optional features would be handled when enabled. Actual providers, storage technologies, deletion operations and retention schedules must match the deployed app and website.