Privacy policy

Last updated: 11 October 2026

Todolist is a to-do app for you and the people you share lists with. This page says what data Todolist keeps about you, why, who else sees it, and what you can ask for. In short: we keep only what the app needs to work, we never sell your data, and we show no ads.

Who runs Todolist

Todolist is run by Equivalent Slovakia s.r.o., a company in Slovakia. The company is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data, write to info@equivalent.work.

What we keep

• Your account: your name, your email address, your password (stored only as a one-way hash, never in plain text), the avatar you picked, and when you verified your email.
• Sign in with Google: if you use "Continue with Google", we get your Google account ID, your name and your email address from Google. We do not get your Google password, contacts, files or anything else.
• What you put in the app: your lists, their names and colors, the items, when they were done and by whom, and reminders.
• Sharing: who is a member of which list, and the email addresses you invite.
• Technical data: the server logs each request, with your IP address and the time, so we can find errors and stop abuse. We keep these logs only for a short time, as long as we need them for this.

The apps keep your sign-in token and a copy of your lists on your device, so the app opens fast and works offline. Signing out removes them. The website uses no cookies and no analytics.

Why we keep it

• To give you the service you signed up for: your account, your lists and sharing them (GDPR Article 6(1)(b), a contract).
• To keep the service safe and working, with the server logs (Article 6(1)(f), a legitimate interest).
• To send you emails the service needs: email verification, password reset, sign-in links, and the note that someone shared a list with you. We send no newsletters or marketing.

Who else sees your data

• People you share a list with see that list, its items, and your name, email address and avatar. People you invite see your name in the invitation email.
• Hetzner Online GmbH (Germany) runs the server and stores the database, in the EU.
• An email sending service delivers the emails described above.
• Google, only when you use "Continue with Google".
• Gravatar (Automattic): if your avatar is set to Gravatar, the apps load your picture from gravatar.com with a hash of your email address. DiceBear: if you picked a DiceBear avatar, the apps load it from api.dicebear.com with your name. You can switch to initials, which sends nothing.
• Link previews: when an item is a link, the Todolist server opens that page to read its title and picture. The page's owner sees a visit from our server, not from you.

We never sell your data and never give it to advertisers. We share it with the authorities only when the law makes us.

Data from Google

Todolist uses the data it receives from Google only to sign you in and to set up your account. Todolist's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for ads, and we do not let people read it.

How long we keep it

We keep your account and your lists for as long as you have an account. When you ask us to delete your account, we delete it and the lists you own within 30 days. Items you added to other people's lists stay in those lists, without your account. Server logs are deleted after a short time.

Your rights

You can ask us to show you, correct, export or delete your data. You can also object to how we use it, or ask us to use it less. You can change your name, email, password and avatar in the app at any time. For anything else, including deleting your account, write to info@equivalent.work. We answer within 30 days.

If you think we handle your data wrongly, you can complain to the Slovak data protection office, the Úrad na ochranu osobných údajov Slovenskej republiky, or to the office in your own EU country.

Children

Todolist is for people aged 16 or older. We do not knowingly keep data about younger children. If you think a child has an account, write to us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters for you, we tell you by email or in the app before it starts.