Visits to this site
We do not use cookies or other browser storage to track you. When you open a page, we record the page, the site that sent you, the campaign tags in the link (such as utm_source), your country, and your device type.
We use your IP address and browser type to make an ID that changes every day. We do not store your IP address or browser type. After two days we delete the key that makes the ID, so we cannot link your visits across days.
If you turn off interface sounds, the site keeps that choice in one cookie. It has no other use.
Cloudflare, which hosts todos.sh, can set a __cf_bm cookie to tell people apart from bots. It expires after 30 minutes, and neither we nor Cloudflare use it to track you.
When you sign up
If you create an account within about two days of a visit, we save where that visit came from with your account: the source, the campaign tags, the first page you opened, and the ad click ID if the link had one. This shows us which channels bring people to todos.sh.
Your account
For your account we keep your name, email address, profile picture, sign-in methods, passkeys, API keys, and the work you add to your workspaces. A session cookie keeps you signed in. The app cannot work without it.
Why we use this data
We use visit and sign-up data because we have a legitimate interest in knowing what works and in making todos.sh better. We use account data to give you the service you signed up for.
How long we keep it
- Page views and sign-up events: 90 days.
- Where your sign-up came from: as long as your account exists.
- Account data: as long as your account exists.
Who processes it
Cloudflare hosts todos.sh and stores this data for us. Stripe processes payments. If you sign in with GitHub or Google, that provider confirms who you are. We do not sell your data, and we do not share it for advertising.
Contact
Questions about your data, or want it deleted? Email hello@todos.sh.