Privacy Policy

Last updated: November 02, 2026

What we never do

No AI on your task content — not our models, not third-party services. We won't start.
No trackers, no analytics beacons, no browser fingerprinting. If we measure anything, it's first-party counters in our own database.
No ads. Your data is never sold, rented, or shared.
Your task content never leaves our servers — not to AI, not to Google, nowhere.
The only data that leaves this app: your email address, to our transactional mail provider, for delivery — and, only if you choose to sign in with Google, the sign-in exchange (your verified email, display name, and account ID).

The rest of this policy explains exactly what we do, in plain language.

1. Overview

This Privacy Policy describes how 1ptodo collects, uses, and protects your information when you use this application ("the App").

1ptodo is a hosted task management application operated by WebHarbor Technologies LLC, 28 Church St, Ste 14 #6383, Winchester, MA 01890, which is the data controller for all personal data collected through the App. You access the App through a web browser; we operate and secure the infrastructure on which your data is stored.

2. Information We Collect

Account Information

When you create an account, we collect:

Email address (required)
Display name — defaults to the local part of your email; you can change it in the App
Password — stored as a cryptographic hash; never stored in plain text
If you sign in with Google: the email address Google verifies for your account, your display name, and a stable account identifier

Content You Create

Tasks: description, keyword, area (work/personal/health/relationship), importance level (1–5), deadline, completion status
Groups and members: group name, member user IDs, roles, join timestamps

Automatic Information

Login activity: email address (display name for Google sign-ins), login timestamp
Session cookies: a Flask session cookie for authentication (see Section 7)
Server logs: HTTP method, URL path, client IP address, user ID, and whether a session is active. Task content is never written to server logs.

Information We Do NOT Collect

No analytics tracking (no Google Analytics, Plausible, Hotjar, Mixpanel, or any other analytics provider)
No telemetry or error reporting to external services
No tracking cookies or pixels
No third-party assets (all JavaScript and CSS is served from our own domain)
No browser fingerprinting or device profiling

3. How We Use Your Information

We use your information solely to:

Authenticate you and manage your session
Store and display your tasks and groups
Deliver transactional email (account activation, password reset)
Log access for security and troubleshooting

Lawful Basis for Processing (GDPR)

Under applicable data protection laws, including the GDPR, our lawful bases for processing your personal data are:

Performance of a contract (GDPR Art. 6(1)(b)): Processing is necessary to provide the App to you — storing your tasks, groups, and account credentials.
Legitimate interests (GDPR Art. 6(1)(f)): Logging access for security, troubleshooting, and rate limiting. If we ever integrate the App with other services operated by WebHarbor Technologies LLC, the processing that integration requires will be described in an updated Privacy Policy, and we will notify you by email before the change takes effect.

4. Third Parties — The Complete List

Your data is processed only by us and the companies below. This is the complete list — there are no others.

Company	What they receive	Why
Cloudflare	Sits between your browser and our servers for attack and DDoS protection. It sees connection traffic in transit (including your IP address) but does not store your data, and we do not give it any.	Protecting the App from attacks
DigitalOcean	Hosting of our servers. Your data stays on our volumes in their data centers (United States).	Where the App runs
Amazon SES	Your email address and the text of a transactional email (account activation, password reset).	Delivering your account emails
Google	Only if you choose "Sign in with Google": your verified email, display name, and account ID — exchanged once at sign-in. Google never sees your tasks or groups.	The optional, password-free sign-in

We do not use any other analytics, advertising, AI, or support tools that receive your data.

5. Data Storage, Security, and Retention

All user data is stored in a relational database on our servers, located in the United States. Data is retained until you delete your account or request deletion (see Section 6).

Security

All traffic is encrypted in transit (TLS); browsers are told to always use HTTPS (HSTS).
Passwords are stored as bcrypt hashes. We never store your password in plain text, and we cannot read it back.
Data at rest on our servers is encrypted at the storage level.
Server-side rate limiting on login, registration, and email, plus per-request audit logs.
We audit our security posture regularly — the last full egress and retention audit was 2026-09-25.

Retention

Data	How long we keep it
Account, tasks, groups	Until you delete — self-service in the App, immediate. After deletion, your data is gone from backups as they roll over.
Dormant accounts	If your account is inactive for 12 months (no login), we may send you a reminder email and, if there is no response, anonymize or delete your data.
Server logs	App log: rotated at 10 MB × 3 files (≈40 MB cap). System journal: 14 days. Auth-event lines include your email address; task content never appears in logs.
Backups	Daily; 14-day rolling, plus 12 monthly copies.
Activation link	30 minutes. Single-use — a new link supersedes the old one.
Password reset link	1 hour. Single-use — a new link supersedes the old one.
Remember-me login	30 days, up to 5 devices (see Section 7).
Group invitations	30 days, or until accepted or revoked.

Rate-limiting and mail-queue entries keyed by your email address expire within an hour.

In the event of a data breach affecting your personal data, we will notify you as required by applicable law.

International Data Transfers

Your data is stored on servers in the United States. If you access the App from the European Economic Area, the United Kingdom, or other jurisdictions outside the US, your data will be transferred to the US. We implement appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) adopted by the European Commission, to ensure your data receives protection equivalent to that guaranteed under EU data protection law.

6. Your Rights

Under applicable data protection laws (including GDPR for EU residents, CCPA/CPRA for California residents, and other applicable laws), you have the right to:

Access: Request a copy of all your personal data stored in the App. Contact us at [email protected].
Rectification: Correct inaccurate or incomplete data. Contact us at [email protected].
Erasure: Delete your account and all associated data — self-service in the App, immediate (see Automated Data Deletion below).
Portability: Export your data in a machine-readable format — a one-click JSON export from the App.
Object: Object to processing based on legitimate interests (GDPR Art. 21). Contact us at [email protected].
Limitation of Processing: Request restriction of processing of your personal data (GDPR Art. 18).
Non-Discrimination: We will not discriminate against you for exercising your data protection rights (CCPA/CPRA).

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

Right to Lodge a Complaint

If you believe your data has been processed in violation of applicable law, you have the right to lodge a complaint with a data protection supervisory authority. For EU residents, this is the supervisory authority in your member state of residence, place of work, or the place of the alleged infringement. For California residents, complaints may be filed with the California Privacy Protection Agency.

Automated Data Deletion

You can delete your account and all associated data directly through the App. This action immediately removes your user record, tasks, and group memberships from the database, and your data is removed from backups as they roll over.

7. Cookies

The App uses only one cookie:

Flask session cookie (session): Used for authentication.
- Attributes: HttpOnly, Secure, SameSite=Lax, path=/
- Duration: 30 days (sliding on activity) if you select "Remember me" or sign in with Google; otherwise until you close your browser
- Purpose: Maintain your authenticated session
- This cookie is essential for the App to function

If you choose "Remember me," your browser also keeps a login token in localStorage (not a cookie). We store only its SHA-256 hash on the server — never the token itself. Remember-me logins last 30 days, up to 5 devices, and are never used to track you.

There are no tracking cookies, advertising cookies, or third-party cookies.

8. Data Sharing

We do not sell, rent, or share your personal information with third parties. The only external data transfers are to the providers described in Section 4.

We do not share your data with other companies at this time. If we ever do, we will update this Privacy Policy and notify you via email before the change takes effect.

9. Children's Privacy

This App is not directed to individuals under the age of 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date.

11. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at [email protected].

Data Controller: WebHarbor Technologies LLC [email protected]