Skip to content
Todoly
Sign inStart for free

Privacy policy

This translation is for information only; the German version is legally binding.

In short: you do not need an account in the app for iPhone and iPad; what you plan stays on your device and, with iCloud, in your own iCloud storage. If you use Todoly in the browser, you create an account; your data is then stored on our server in Germany. If you also sign in to the app with this account, the app syncs with it. There are no ads, no tracking and no sharing with third parties.

1. Controller

Marcze Media UG (haftungsbeschränkt)
Marienstraße 15
12459 Berlin
Deutschland

Email: hallo@todoly.de

2. Visiting the website

When you visit todoly.de, our host processes data that is technically necessary: IP address, date and time, the address requested, the amount of data transferred, browser and operating system. This is needed to deliver the page and to protect it from misuse (Art. 6(1)(f) GDPR).

The website does not embed any fonts, scripts, videos or maps from other servers, does not count visits and sets no cookies.

3. Hosting

The website, web app and email of todoly.de run on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data center in Germany. IONOS processes the data on our behalf (Art. 28 GDPR).

4. The app for iPhone, iPad and Apple Watch

Your tasks: The app stores tasks, events, goals, templates, notes, focus sessions and settings on your device. It only sends this data to us if you sign in to your account in the app (see “Account in the app”). Widgets, the Live Activity and Apple Watch read a summary of your day from the same device.

iCloud: If you turn on “Sync with iCloud”, the app puts a copy of your data in your own iCloud storage so that your iPhone and iPad have the same data. Apple processes this data; Apple’s privacy policy applies. We have no access to it.

Account in the app: If you sign in to your todoly.de account in the app under More → Account, the app syncs tasks, goals, areas, templates, daily notes and focus sessions with your account so that you have them in the browser too (Art. 6(1)(b) GDPR). Section 5 applies to this. When you sign in, the app receives a random key, which it keeps in your device’s keychain; for this session we store the device type and the app version (for example “iPhone · Todoly 1.0”). Settings, calendars and calendar subscriptions stay on the device. If you sign out, the app deletes the key; your data stays on the device and in your account. You can delete your account in the app under More → Account or in the browser.

Calendar: If you allow access, the app reads the events of the calendars you choose on the device and shows them in your day. The events do not leave your device. If you add a task to your calendar or edit an event, the iOS editor opens for this. If you move a task that you created from an event, the app also changes that event in your calendar on the device.

Trello: If you connect Todoly to Trello, you sign in on a page run by Atlassian (the provider of Trello). The app then receives an access token that lets it read your boards and cards and mark cards as complete when you check them off in Todoly. The app talks to Trello directly for this; we see neither your cards nor your access token. The token is kept in your device’s keychain. Atlassian’s privacy policy applies to your data at Trello. If you disconnect, the app deletes the token; tasks it has already fetched stay in Todoly.

Voice input: If you tap the microphone in Quick add, the app records until you stop speaking, and Apple’s speech recognition turns your words into text on the iPhone. The recording does not leave your device and is not stored. The first time, iOS downloads a speech model from Apple for this.

Calendar subscriptions: If you subscribe to a calendar by URL, the app fetches the file directly from that URL, for example from Google, Apple or Microsoft. As with any request, the provider behind the URL learns your device’s IP address.

Apple Reminders: If you import tasks from Apple Reminders, the app reads your open reminders on the device after you have allowed access.

Notifications: Reminders before tasks, the morning reminder to “Plan your day” and the notification at the end of a focus session are scheduled by the app itself, on the device. There are no notifications from a server.

Siri and sharing: What you say to Siri is processed by Apple according to your Siri settings; the app only receives the text of the new task. If you share text from another app with Todoly, it stays on the device.

Premium: You buy Premium through the App Store. Apple handles the payment; Apple’s privacy policy applies to it. The app verifies the purchase signed by Apple on the device. We learn neither your name nor your payment details; Apple only provides us with aggregated sales figures.

Crash reports: If you have allowed analytics data to be shared with app developers in your iPhone settings, Apple provides us with crash reports that are not linked to you personally. The app itself does not collect any usage data.

5. Todoly in the browser and your account

At todoly.de/app, Todoly runs in the browser. To use it, you create an account (Art. 6(1)(b) GDPR). For this, we store the following on our server at IONOS in Germany:

  • Your account: email address, first name (if you provide it), language, your password only as a hash (Argon2id; we never know the password itself) and when you signed up, confirmed your address and last signed in.
  • Your planning data: tasks, goals, areas, templates, daily notes and focus sessions, so that they are there in every browser you are signed in to. Calendar subscriptions and settings stay in your browser.
  • Sessions: for each sign-in, a random key (stored only as a hash), when the session was created, when it was last used and when it expires (in the browser after 30 days, in the app after one year without use). Your browser keeps the key in the cookie “todoly_sitzung”; it is technically necessary to keep you signed in (§ 25(2) TDDDG) and is not used for anything else.
  • One-time links: links for confirming your address (valid for 48 hours) and for setting a new password (2 hours), stored only as a hash.
  • Protection against misuse: So that nobody can try out passwords, we briefly count sign-in and sign-up attempts using a hash of the IP address or of the email address (Art. 6(1)(f) GDPR). We delete these counters after 24 hours at the latest.

To confirm your address and to set a new password, we send you an email from hallo@todoly.de. We do not send any other emails.

You can download your data at any time in the web app under Settings → Account. You can also delete your account there or in the app under More → Account: your account, planning data and sessions are then deleted immediately and permanently. Accounts that are never confirmed are deleted automatically after 7 days.

In addition, the web app keeps your data in your browser’s local storage so that it starts quickly and keeps working for a short while without a connection; when you sign out, it removes the data from there. So that Todoly can start without a connection, the browser also keeps the web app’s files in its cache.

Calendar subscriptions in the browser: Many calendar providers do not allow browsers to fetch their subscription URLs directly. In that case, our server fetches the calendar file on your behalf and passes it on to your browser unchanged. For this, the web app sends the calendar URL in the body of the request rather than in the requested URL, so that it does not appear in the access log. We store neither the URL nor the events. To prevent misuse of the service, we count requests for one minute using a hash of the IP address (Art. 6(1)(b) and (f) GDPR).

6. Email

If you email us, we use your address and your message to reply to you (Art. 6(1)(b) GDPR, for general questions (f)). Once the inquiry has been dealt with, we delete it after one year, or immediately on request.

7. Your rights

You have the right to access your data (Art. 15 GDPR) and to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). Just send us an email about it. In the app, your tasks are only on your devices; there you can export them (More → Save backup) or delete them (More → Delete everything and start again) yourself at any time. You can download your browser account in the web app under Settings → Account or delete it there.

You can also complain to a data protection authority, for example the one in your federal state (Art. 77 GDPR).

Last updated: October 2026