Privacy Policy

Last updated: 2026-10-26

1. Introduction

This Privacy Policy explains how Applika GmbH, Chaltenbodenstrasse 16, 8834 Schindellegi, Switzerland (company number CHE-299.623.889), which provides Todoless ("we", "us", "our"), collects, uses, stores, and shares your personal information when you use our task management application ("the Service"), available at todoless.app and in our iOS and Android apps. Applika GmbH is the controller responsible for this processing. This policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP), and the California Consumer Privacy Act (CCPA).

2. Information We Collect

Information you provide:

Information collected automatically:

Information from third parties:

We do not collect sensitive personal data such as health information, biometric data, racial or ethnic origin, political opinions, or religious beliefs. Multi-Factor Authentication uses time-based codes (TOTP), not biometric data. If you turn on Face ID, Touch ID or fingerprint unlock in the mobile app, your device's operating system performs the check and we never receive any biometric data.

A photo you send to Photos to tasks can show such data, about you or about other people (for example a prescription or a medical appointment). We process it only with your explicit consent and only to read the text and propose tasks, and we delete the photo as soon as it has been read (see Section 5).

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

Providing your email address is necessary to create an account and use the Service; without it we cannot provide the Service. All other information is optional, and not providing it only means that the related feature is not available to you.

4. How We Use Your Information

We use the information we collect to:

5. AI and Automated Processing

Our AI-powered features process the task titles, descriptions, and project context you submit to generate suggestions such as subtasks, plans, project templates, and smart filters. This processing runs on Amazon Bedrock, operated by Amazon Web Services, and stays within AWS data centres in the European Union. The companies that develop the AI models have no access to your requests or the results. By default Amazon Bedrock does not store the requests and results it processes, and we have configured our accounts so that it keeps no copy of them; content that the automated abuse detection of Amazon Web Services flags as abusive may nonetheless be kept and reviewed by Amazon Web Services for the limited time and purposes it describes for abuse detection.

We do not use your personal data or content to train machine learning models. AI features are optional — you can choose not to use them without any impact on the core functionality of the Service. No automated decisions with legal or significant effects are made based on your data.

AI weekly planner

The AI features of the weekly planner, available with a Premium or Team plan and during the trial, propose a schedule for your week, write your daily brief and can suggest tasks to review and priorities. To do this the planner sends to Amazon Bedrock, only in AWS data centres in the European Union, the title, due date, duration, priority, age, number of postponements and activity score of the tasks it works on, which larger task a step belongs to, your free working time calculated as described in Section 2 and your planning preferences (working days, capacity and, if you turned them on, your energy windows); once you have used the planner for a while, also what it learned from your past weeks: how often and on which days you complete tasks, how accurate its time estimates were and which kinds of tasks tend to slip. It never sends descriptions, notes or comments. Using what the planner learned from your past weeks to plan your next one is a form of profiling: it only serves to schedule your tasks and has no legal or similarly significant effect on you. The activity score is calculated by the planner from how long a task has waited and how often it was postponed, and is stored with the task. Task titles are first checked by an automated safety filter; if the check cannot be completed, the AI model is not used and you get a simpler result built with fixed rules.

In autonomous mode the planner applies its plan on its own, without asking you to approve each change: it schedules and moves the tasks you are responsible for (your own tasks and those other people assigned to you) in the week it plans and, if priority suggestions are on, sets the priority of your own tasks whose priority you never chose. It never changes tasks you assigned to other people or a priority you chose. It acts only after you agree to its consent screen, only when it is confident, and everything it does is listed in "What the planner did", where you can undo it: a change of schedule until the end of that week, a change of priority for 14 days. If you agreed to an earlier version of the consent screen, it does not change priorities until you agree to the current one. We keep the version of the consent text you accepted and its date with your planner settings, until you delete your account, so that we can show which text you agreed to. You can turn it off at any time by choosing "Assisted" or "Manual" in the planner settings.

Priority suggestions. If you turn on "Suggest priorities" in the planner settings (it is off by default), the planner reviews your own open tasks when you ask for it, at most three times a day, and shortly before it prepares a plan automatically. It suggests a priority for tasks whose priority you never chose (and, for tasks created before we started recording who chose a priority, for tasks still at the default priority) and may suggest lowering a high priority that has gone untouched for a long time. Fixed rules based on due dates and activity decide first; the remaining tasks go to the AI model with their title, current priority, due date and its kind, age, activity score, number of open subtasks and whether they repeat, identified by short temporary codes instead of their identifiers. A priority changes only when you accept the suggestion, or in autonomous mode as described above; a priority you chose yourself is never changed automatically. To respect your choices we store, with each task, whether its priority was chosen by you, set from the default priority or set by the planner.

The suggestions are stored without the titles of your tasks (the app matches them with your tasks on your device), together with their reasons, how confident the planner is and your decision, and are deleted automatically 14 days after the review. Your decision (accepted or dismissed) and any priority the planner changed or put back are also recorded in the history of the planner's actions. A review that uses the AI model uses AI credits; tasks that other people assigned to you are never reviewed.

Legal basis. We generate plans and briefs, and apply them in autonomous mode, to provide the Service you chose to use (Art. 6(1)(b) GDPR); the consent screen of autonomous mode lets you decide whether the planner acts on its own. Priority suggestions are processed on the basis of your consent, given by turning on "Suggest priorities" (Art. 6(1)(a) GDPR; for Switzerland, your consent under the FADP). You can withdraw it at any time by turning the switch off: no further review takes place, and suggestions already stored are deleted after 14 days. Withdrawing consent does not affect processing that took place before.

AI assistant

Todoless includes an optional AI assistant, available with a Premium or Team plan and during the trial, that answers questions about how to use Todoless and about your own tasks. You can use it only after you have agreed to the assistant's consent screen, and you can withdraw that consent at any time in Settings > Privacy. On the Free plan the assistant is not available; our guides at todoless.ch/guides and our support team remain available to everyone.

What the assistant processes. When you send a message, we process the text of your message, the previous messages of the same conversation (to keep the context), your language, time zone, platform and app version, and, if your question is about your tasks, the tasks and lists (their names) the assistant reads to answer: their titles, statuses, priorities, dates, repetition, subtasks and the list they belong to and, when it needs them to answer, their descriptions, notes and labels. The assistant reads the tasks in lists you own, in lists other people share with you, and the tasks assigned to you: the same ones you see in the app. They can include titles and content written or edited by other people. Descriptions, notes, labels and tasks in other people's lists are read only if you agreed to the consent text that mentions them. If you have connected an external calendar and agreed to the consent text that mentions it, the assistant also uses the free time slots found in that calendar to suggest a time that does not clash with your commitments: only the free intervals, never the titles, descriptions, locations or participants of your events.

How the answer is produced. Your message, the tasks the assistant reads (with their descriptions, notes and labels) and the names of the lists and, if you connected an external calendar and agreed to the consent text that mentions it, its free time slots (never the event titles) are sent to Amazon Bedrock, a service operated by Amazon Web Services, where a language model developed by Anthropic generates the answer. The request is processed only in AWS data centres located in the European Union. The company that developed the model has no access to your messages, your tasks or the answers. The assistant never changes your tasks by itself: it can only propose a change, which is applied only if you confirm it in the app. Questions about payments, refunds, prices, cancellation, what a plan includes as a matter of contract, or legal matters are not answered by the assistant; it directs you to our support team instead.

Automated safety checks. Every message and every answer is checked automatically for attempts to misuse the assistant and for harmful content. If several of your messages in one day are blocked as attempts to manipulate the assistant, the assistant is paused for you until the end of that day (UTC). Amazon Web Services also runs automated abuse detection on Amazon Bedrock. By default Amazon Bedrock does not store the requests and answers it processes; we have configured our accounts so that Amazon Bedrock keeps no copy of them. Content that the automated systems of Amazon Web Services flag as abusive may nonetheless be kept and reviewed by Amazon Web Services for the limited time and purposes it describes for abuse detection; it is not shared with the company that developed the model.

Ratings and reports. You can rate an answer and report it (for example because it is offensive or wrong). We store your rating or report with the answer's identifier, the reason you chose, your language and platform and the help articles the answer cited, but not the text of your question or of the answer. Your ratings and reports are part of your account data: they are included when you export your data and deleted when you withdraw your consent or delete your account.

Who can read your conversations. Todoless staff do not read your conversations, except to handle an answer you reported, to handle a support request you sent us, or when it is necessary to keep the service secure (for example to investigate an attack). A report is kept for 90 days even if you delete the conversation, so that it can still be handled; after you delete the conversation the report contains no question or answer text.

Legal basis. We process your assistant messages on the basis of your consent (Art. 6(1)(a) GDPR; for Switzerland, your consent under the FADP). Withdrawing consent does not affect processing that took place before. The automated safety checks and the pause rule are necessary to provide the assistant securely (Art. 6(1)(b) and (f) GDPR).

Your choices. You can delete a single conversation at any time. Withdrawing your consent deletes all your conversations, messages, ratings and reports immediately; only the counter of blocked messages of the current day is kept until it expires (at most 2 days), so that withdrawing consent cannot be used to lift a pause. If your plan changes to Free, you can still read and delete your existing conversations and withdraw your consent.

Photos to tasks (AI)

Todoless can turn a photo or an image, such as a handwritten list, a whiteboard, a note, a printed page or a screenshot, into proposed tasks. The feature is optional and available on every plan: the Free plan includes 3 photos per calendar month, and on paid plans and during the trial each photo uses AI credits. You can use it only after you have agreed to its own consent screen, and you can withdraw that consent at any time in Settings > Privacy.

What is sent. Before the photo leaves your device, the app reduces its size and saves it as a new image without its metadata, such as the place where it was taken (GPS) or camera details; our server removes any remaining metadata again. With the image we send your language, time zone, date format and first day of the week, the names of your labels (up to 100) and of the list you chose for the new tasks, so that the proposals can use them, and a random identifier of the request. Your name, your email address and your other tasks are not sent. The app keeps the photo and the proposals only in memory while you review them and does not save them on your device. If you leave the screen or close the app while the photo is being read, the app saves on your device only the random identifier of the request, so that it can retrieve the proposals from our server for up to one hour, and deletes it when the request has ended or when you sign out.

How the photo is read. The image is sent to Amazon Bedrock, a service operated by Amazon Web Services, where a model developed by Anthropic works in two steps: first it reads the text in the image, then, without seeing the image again, it turns that text into proposed tasks with details such as dates, duration, priority and labels. Web links found in the photo are removed from the proposals. The request is processed only in AWS data centres located in the European Union, and the company that developed the model has no access to your photos, the text or the proposals. Nothing is created automatically: you review every proposal, can change it, and only the tasks you confirm are created in your account, where they are ordinary tasks. If a proposal names the person responsible for a task, the app compares that name with the members of the shared list on your device; the members' names are not sent with the photo and never reach the AI model.

What is not kept. While it waits to be read, your photo is held for a short time, normally a few seconds and never more than one hour, in an encrypted processing queue on our servers in the European Union, and it is deleted as soon as it has been read. If processing fails repeatedly, the photo can be kept in a separate encrypted queue for at most one day so that we can investigate the failure, and is then deleted automatically. The text read from the photo exists only in memory during processing. The proposed tasks are kept, encrypted and linked to your account only through a one-way fingerprint, for up to one hour, so that you can retrieve them if the app is closed or loses its connection while the photo is being read; they are deleted when you have reviewed them, or automatically after that hour. We do not write the photo, the text or the proposals in our logs and we do not use them to train AI models. By default Amazon Bedrock does not store the requests and answers it processes, and we have configured our account so that it keeps no copy of them. To recognise a request sent twice and to let you retrieve its result, we keep a technical record identified by a one-way fingerprint (hash) of your account and of the request; besides the proposals described above, it contains only a fingerprint of the image, from which the image cannot be reconstructed, and the outcome of the request, never the image or the text read from it, and it expires within 24 hours (one hour after the request has ended). Our technical logs of the feature contain only counts, outcome codes and timings, and identify you only by a one-way fingerprint of your account.

Automated safety checks. The text read from the photo, the names of your labels and the proposals are checked automatically for attempts to manipulate the AI, such as instructions written in the photo, and for harmful content: a photo whose text fails the check is not processed further, and a proposal that fails it is withheld. If several of your photos in one day are blocked as attempts to manipulate the AI, the feature is paused for you until the end of that day (UTC); for this we keep a counter of blocked photos, identified by a one-way fingerprint of your account, which is deleted automatically after about 2 days. Amazon Web Services also runs automated abuse detection on Amazon Bedrock: if an image appears to contain child sexual abuse material, Amazon Bedrock blocks the request, and Amazon Web Services may keep and review the flagged image only to determine whether it is such material and may report it to the National Center for Missing and Exploited Children (NCMEC) or a relevant authority.

Legal basis. We process the photos you send on the basis of your explicit consent (Art. 6(1)(a) GDPR and, for special categories of data such as health data that a photo may show, Art. 9(2)(a) GDPR; for Switzerland, your explicit consent under the FADP). Withdrawing consent does not affect processing that took place before. Other people's data that appear in a photo, such as names on a whiteboard, are processed only to propose your tasks and are kept only for the short periods described above, on the basis of your and our legitimate interest in turning a document you already have into tasks (Art. 6(1)(f) GDPR). The credit charge, the automated safety checks and the pause rule are necessary to provide the feature securely (Art. 6(1)(b) and (f) GDPR).

Your choices. You choose every photo you send. Avoid photographing health documents or other people's data when your tasks do not need them. Withdrawing your consent in Settings > Privacy stops any further photo from being read; the tasks you have already created stay in your account like any other task. The record of your consent (the version of the consent text you accepted and its date) is stored with your profile and removed when you withdraw your consent or delete your account. So that we can prove your consent, we also keep a history of each time you gave or withdrew it, containing only the version of the consent text and the dates: each entry is kept for 3 years from the change it records, also after you withdraw your consent or delete your account, and is then deleted automatically. We keep this history because we must be able to demonstrate your consent (Art. 7(1) GDPR) and to establish, exercise or defend legal claims (Art. 6(1)(f) and Art. 17(3)(e) GDPR). Your consent record and this history are included when you export your data.

Google user data

Todoless's use and transfer of information received from Google APIs, including Google Calendar, adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements. We do not use, transfer or sell Google user data, whether raw, aggregated or derived, to create, train or improve generalized or foundational artificial intelligence or machine learning models. Only three kinds of data received from Google Calendar can reach the AI models on Amazon Bedrock, and only to produce the answer you asked for, under the conditions described in this section. If you connect Google Calendar to the AI planner, we read from your events only when they start and end, their type, whether they show you as busy and whether you declined them, never their titles, descriptions, locations or other participants; the AI models receive only the working time you still have free, calculated from your busy minutes aggregated per day, never the events themselves. If you use the AI assistant and agreed to the consent text that mentions your external calendar, the assistant receives only the free time slots found between your events, never the events themselves, and uses them only to suggest a time that does not clash. When you use an AI feature, task data that may come from Google Calendar (for example a task title or date you changed in Google Calendar) is sent with your request.

6. Data Storage and Security

Your data is stored in the European Union (AWS region eu-central-1, Frankfurt) using Amazon Web Services infrastructure. We employ multiple layers of security: DynamoDB with encryption at rest (AES-256) for application data; S3 with server-side encryption for file attachments; AWS Cognito for secure authentication with support for MFA (TOTP); TLS 1.2+ encryption for all data in transit; automated malware scanning for all uploaded files; and regular automated backups kept for up to 35 days.

While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We continuously monitor and improve our security practices but cannot guarantee absolute security.

7. Information Sharing and Sub-processors

We do not sell, rent, or trade your personal information. We never use your data for advertising purposes. We may share your information only in the following limited circumstances:

A current list of our sub-processors is available upon request at privacy@todoless.app.

8. International Data Transfers

Your primary data is stored in the EU (Frankfurt, Germany), and AI requests are processed only in AWS data centres within the EU. Some processing services, such as analytics queries, may operate in other AWS regions (e.g., us-east-1). Some recipients are located outside Switzerland and the EU/EEA, in particular in the United States (for example Google, Expo, RevenueCat and, for some services, Amazon Web Services) and in the United Kingdom (Paddle). These transfers rely on adequacy decisions of the European Commission and the Swiss Federal Council, including the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework for certified recipients, or, where no adequacy decision applies, on the Standard Contractual Clauses of the European Commission, as recognized by the Swiss FDPIC. Google reCAPTCHA v3 processes a limited subset of technical signals (IP, browser characteristics, interaction patterns) on Google LLC infrastructure in the USA. You can request a copy of the safeguards at privacy@todoless.app.

9. Data Retention

We retain your data according to the following schedule:

10. Your Rights

Under the GDPR (EU/EEA) and the Swiss FADP:

Under CCPA/CPRA (California residents):

11. Cookies and Tracking Technologies

On your first visit from the EU/EEA, the UK or Switzerland, or when your region cannot be determined, a cookie consent banner lets you choose which non-essential tracking categories to accept or reject. In other regions the banner is not shown automatically and those categories may be active by default. Your region is taken from the language and region settings of your browser or device. Your preferences are stored locally and remembered for subsequent visits. You can change your preferences at any time via the cookie consent banner (accessible from Settings > Privacy).

Cookie and tracking categories:

Additional information:

12. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you become aware that a child under 16 has created an account, please contact us at privacy@todoless.app and we will promptly delete the account and associated data.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes in the app and, where appropriate, by email before they take effect. Where a change requires your consent, we will ask for it before applying it to your data. We maintain a changelog of significant updates. The date at the top of this page shows when the policy was last updated.

14. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or wish to request our current sub-processor list, please contact us at privacy@todoless.app, by post at Applika GmbH, Chaltenbodenstrasse 16, 8834 Schindellegi, Switzerland, or by phone at +41 76 700 45 18. For formal Data Subject Access Requests (DSAR), please include "DSAR" in the subject line to ensure timely processing within the 30-day statutory period.

15. Change history

Significant changes to this policy, newest first: