01 Preamble and Data Controller
This Privacy Policy describes how Banse Bruno, an independent developer based in Abidjan, Côte d'Ivoire ("we," "the Publisher"), acting as data controller, collects, uses, and protects the personal data of users of the TasksToDo mobile app and its associated services.
This policy is established in compliance with:
- The General Data Protection Regulation (GDPR — EU Regulation 2016/679) for users located in the European Union;
- Law No. 2013-450 of June 19, 2013 on the protection of personal data in Côte d'Ivoire;
- The regulations and standards applicable in the countries where the app is distributed via the Google Play Store.
Contact for data protection and support: contact@taskstodo.app
02 The Core Principle: Local-First Architecture and Data Minimization
TasksToDo was designed from the ground up around Privacy by Design and an offline-first architecture:
- Your data stays on your device: Your goals, tasks, personal notes, and time logs are stored locally in the SQLite database on your smartphone.
- No mandatory account creation: The app is usable immediately, with no sign-up form and no need to enter your last name, phone number, or a password.
- No ad profiling: We do not integrate any third-party ad network or location tracker, and we do not resell any personal data.
03 Data Processed and How It Is Collected
| Category | Data involved | Storage / processing | When collected |
|---|---|---|---|
| Organization & Projects | Task titles, descriptions, subtasks, goals, due dates, priorities, color labels. | 100% local (SQLite database tasktodo.db). |
When entered by the user. |
| Time Tracking & Focus | Timed sessions, estimated durations, actual elapsed time, Pomodoro cycle history. | 100% local, on your device. | When the timer is started. |
| AI Task Generator | Text description of the goal entered in the prompt field (e.g., "Organize a house move"). | Sent encrypted and ephemerally to the language model API. Not durably stored on our servers. | Only when a generation is requested. |
| Google Drive Backup | Archive of the local database (tasktodo.db). |
Transferred exclusively to the private app folder (drive.appdata) of your own
Google Drive account. |
Only on manual action (Settings → Back up). |
| Purchases & Premium Status | Google Play order ID, lifetime license validation status. No banking data. | Google Play Billing / local storage of activation status. | When purchasing the Premium plan. |
| Reminders & Notifications | Time and label of scheduled alerts. | Processed locally by the operating system
(flutter_local_notifications). |
When scheduling a reminder. |
| App Preferences | Display mode (Light / Dark / System), configured Pomodoro durations, sound settings. | Stored locally (SharedPreferences). |
When changing settings. |
| User Support | Sender's email address, message content, app version, and device model. | Technical support inbox. | When you voluntarily reach out. |
04 Purposes of Processing
Data processed by TasksToDo is used exclusively to:
- Provide the app's features: organizing your schedule, managing priorities, precise time tracking, and the Pomodoro timer;
- Generate AI action suggestions: turning a goal stated in natural language into actionable subtasks;
- Ensure your data is backed up: allowing your database to be restored to your personal Google Drive if you change devices;
- Manage Premium licenses: validating unlimited access to advanced features via Google Play Billing;
- Provide technical support: answering your questions and resolving any issues.
05 Legal Bases for Processing
| Processing activity | Legal basis (GDPR) |
|---|---|
| Local app operation (tasks, time, Pomodoro) | Performance of a contract (the app's Terms of Service) |
| Purchasing the Premium license via Google Play | Performance of a contract |
| Connecting to and backing up on Google Drive | Explicit consent (revocable at any time) |
| Using the AI task generator | Consent / direct user request |
| User support and technical assistance | Publisher's legitimate interest |
| Compliance with accounting and tax obligations | Legal obligation |
06 Recipients and Subprocessors
Your personal data is never sold, rented, or transferred to third parties for marketing or advertising purposes.
To power certain optional connected services, the app relies on trusted technical providers:
| Provider | Role & service | Location & safeguards |
|---|---|---|
| Google LLC (Google Play Billing) | Secure processing of in-app payments and Premium license validation | International (Data Privacy Framework / Standard Contractual Clauses) |
| Google LLC (Google Drive API / Google Sign-In) | Hosting the backup file in the user's personal space (restricted appdata folder) |
International (Data Privacy Framework / user's private space) |
| AI Model Provider (OpenAI / LLM API) | Ephemeral processing of the text prompt to break a goal down into tasks | International (Data Privacy Framework / TLS encryption, not used to train public models) |
07 Data Transfers Outside the European Union
When requests pass through services operated by Google LLC or the AI API provider based outside the European Union, these transfers are governed by legal mechanisms recognized by the European Commission, notably the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).
08 Data Retention Period
- Local data (tasks, projects, time): Kept on your device for as long as you use the app. You can edit or delete it at any time. Uninstalling the app or clearing its system data removes all local data.
- Google Drive backups: Kept in your Google Drive space until you choose to overwrite or delete them, either from the app's settings or from your Google account.
- AI requests: Goal descriptions sent for generation are processed only for the time needed to generate the response and are not archived by us.
- Google Play proof of purchase: Kept for the periods required by applicable tax and accounting law.
- Support exchanges: Kept for a maximum of 24 months after the request is closed.
09 Security and Confidentiality
The Publisher applies rigorous technical measures to protect your data:
- App sandboxing: The local SQLite database is isolated by the mobile operating system (Android) and inaccessible to other unauthorized apps.
- Encrypted communications: All interactions with external services (Google Drive API, AI API, Google Play) occur exclusively over secure, encrypted protocols (HTTPS / TLS).
- Restricted Google Drive scope: The app exclusively uses the
https://www.googleapis.com/auth/drive.appdatascope. It cannot read, modify, or access any other files, photos, or documents in your Google Drive.
10 Your Rights
In accordance with applicable data protection regulations (GDPR and Ivorian law No. 2013-450), you have the following rights:
- Right of access and control: You have direct, permanent control over all your data stored locally in the app.
- Right to erasure ("right to be forgotten"): You can delete a task, a goal, or all your data at any time by resetting the app from your Android settings.
- Right to portability: You can export and back up your local database to your Google Drive to transfer it to another device.
- Right to withdraw consent: You can disconnect from Google Drive at any time from the app's settings screen.
For any question or to exercise your rights, you can contact us directly at: contact@taskstodo.app.
If you believe your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority:
11 Protection of Minors
Use of TasksToDo is reserved for individuals at least 16 years old (or the legal age of consent for data processing in your country). If you are a minor, you must obtain prior authorization from a parent or legal guardian before using the app or making in-app purchases.
12 Changes to This Privacy Policy
This Privacy Policy may be updated at any time to reflect changes to the app (for example, the addition of new connected features) or changes in the law. The "last updated" date at the top of this document will be revised accordingly. We encourage you to review it periodically from the app's settings.
13 Contact
For any information request, question, or complaint regarding this Privacy Policy:
Banse Bruno — Independent developer
Abidjan, Côte d'Ivoire