Privacy Policy

Last updated: October 2026

Your privacy matters to us. This policy explains what data we collect, why we collect it, how we store it, and what rights you have.

1. Who We Are

tingdo is operated by:

SCI Ltd. Alamein Road St. Julians, Pembroke PBK 1776 Malta

SCI Ltd. ("we", "us", "our") is the data controller for the personal data processed through this service.

For privacy-related inquiries, contact us at: simon (at) tingdo.app

2. What Data We Collect

Account data

When you create an account, we collect your name, email address, and an encrypted password. Authentication is handled by Firebase Authentication. We never store your plain-text password.

Content data

The core of the service is the data you create: tasks, projects, notes, contexts, images you add to a task description, and related metadata (such as deadlines, status, and timestamps). This data is yours and is created entirely by you.

Images are private to your account. We do not scan them, share them, or make them accessible to anyone else.

Technical data

When you use the service, we automatically collect limited technical data: device type, browser type, and basic usage events (e.g. app opens, feature usage). This helps us understand how the service is used and where to improve it.

Feedback and support requests

When you send us feedback or ask for help in the app, we store your rating, the reason if you picked one, what you wrote, where in the app the form was opened, the platform, the app version and the time. If you are signed in, we also store your account ID, your name and your email address, so that we can answer you, and technical details that help us understand a problem: the browser or app build, screen size, display mode, time zone, language, connection, your plan, how many tasks, projects, contexts and areas you have (never their content), and the last few errors the app ran into. If you wrote something, a copy reaches our inbox by email, and if you are signed in, you get one too.

To read feedback, we use an internal overview built with Claude by Anthropic. It shows the rating, the reason, the text, where the form was opened, platform, version and date. It never shows your name, email address, account ID or the technical details; those stay in our database.

3. How We Use Your Data

We process your data for the following purposes:

• Providing the service: storing and syncing your tasks, projects, and notes across your devices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Account management: authentication, session management, and account recovery. Legal basis: performance of a contract.
• Service improvement: understanding usage patterns to improve features and fix issues. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Feedback and support: reading and answering your messages, and improving tingdo based on them. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); where you ask for help with your account, also performance of a contract (Art. 6(1)(b) GDPR).
• Deadline notifications: sending push notifications for tasks with deadlines, if you have enabled notifications. Legal basis: consent (Art. 6(1)(a) GDPR).

We do not use your data for advertising. We do not sell your data to third parties. We do not profile you for marketing purposes.

4. Where Your Data Is Stored

Your data is stored on Google Cloud infrastructure through Firebase (Firestore, Firebase Authentication, Cloud Functions, and Cloud Storage for the images you add to tasks). Google Cloud operates data centers in the EU and globally, and processing may occur outside the EU under Google's standard contractual clauses and data processing terms.

Offline storage

The app keeps a local copy of your data on your device to enable offline access. This data remains on your device and is not transmitted to any third party. Images you add while offline are held on your device until a connection is available, and images you have already opened stay cached locally so they remain visible without a connection.

5. Sub-processors

We rely on the following third-party services to operate tingdo:

If we introduce additional sub-processors (for example, for AI-powered features), we will update this policy before doing so.

6. Data Retention

• Active accounts: Your data is retained for as long as your account exists.
• Deleted content: When you delete a task, project, or note, it is removed from our database at once. The app has no trash. Deleting an image, or the task that holds it, removes the stored file as well.
• Backups: Deleted data stays in our backups for up to 30 days, and we use them only to repair a technical fault.
• Feedback and support requests: deleted 24 months after you send them.
• Account deletion: When you delete your account, all associated data (tasks, projects, notes, images, account information) is permanently deleted. Feedback and support requests you sent are anonymised instead: we remove your account ID, name, email address and the technical details, and keep the rating and what you wrote, without anything that links them to your account. If you wrote something about yourself into the text, it stays as you wrote it; write to us and we remove it. This process may take up to 30 days to propagate through all backup systems. What remains is a number: that one account was deleted on that day, counted together with all other deletions of the day and without anything that points to you.

7. Your Rights

Under the GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate data in your account.
• Erasure: request deletion of your account and all associated data.
• Data portability: export your data in a machine-readable format. The app provides a built-in export feature for this purpose.
• Restriction: request that we limit processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interest. For the statistics in the app and on this website, use the switches described in section 8.
• Withdraw consent: where processing is based on consent (e.g. push notifications, or analytics cookies on this website), you can withdraw it at any time.

To exercise any of these rights, contact us at: simon (at) tingdo.app

You also have the right to lodge a complaint with a supervisory authority. In Malta, the competent authority is the Office of the Information and Data Protection Commissioner (IDPC).

8. Cookies and Analytics

We measure how the app and this website are used, to see what helps and what to improve. There are two kinds of statistics: our own, which only we see, and Google Analytics. You decide how much of it runs:

• both (the default),
• only our own statistics, or
• nothing.

In the app, you choose under Account → Privacy: "Google Analytics" switches Google Analytics, "Help improve tingdo" below it switches our own statistics. On this website, you use the two buttons in this section. Switching off our own statistics also stops Google Analytics.

Apart from that, the app uses cookies and storage on your device only to keep you signed in and to work offline. Nothing here is used for advertising.

Our own statistics

What we count. In the app: events such as opening the app, creating or completing a task, emptying the inbox or starting a weekly review, how quickly the app loaded and reacted, and for a crash the kind of error. On this website: page views, clicks on buttons that lead to the app, how long a page was visible, loading times, and addresses that do not exist. A sign-up also carries the campaign values of the link you came from.

What we keep. The event, the page or screen in a general form (never which task), the domain you came from, the device class, browser and operating system, the country, time zone and language, and the app version and build. We do not store your IP address, your account ID, your email address, anything you wrote, or any identifier, so no record can be linked to another one or to you. Your IP address is used only for a moment: to look up the country in the free database of DB-IP ("IP Geolocation by DB-IP", db-ip.com, CC BY 4.0), which we keep on our own server, and to limit how many messages one address can send per minute.

Where and how long. Google Cloud processes the data on our behalf, in Cloud Functions in Belgium and BigQuery in the EU. Nobody else receives it. The records are deleted after 25 months.

Legal basis. Our legitimate interest in understanding, in aggregated form, how the app and this website are used (Art. 6(1)(f) GDPR).

Your right to object. Switch off "Help improve tingdo" in the app, or use the button below on this website. Your choice is stored on your device (on this website in your browser's local storage as tingdo-stats) and applies to that device or browser. Because we store no identifier, we cannot find or remove the records of earlier use.

Google Analytics

We also use Google Analytics 4 (Firebase Analytics in the app), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to compare its numbers with our own. Google signals and advertising features are turned off. Google Analytics deletes event data after 14 months. Google may process data in the United States; Google LLC is certified under the EU-US Data Privacy Framework. You can read how Google handles this data at policies.google.com/privacy and policies.google.com/technologies/partner-sites.

In the app, Google Analytics receives the same events, except errors: those stay in our own statistics. Once you have verified your email address, they are linked to your account ID, together with your plan and whether you finished the introduction. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). To object, switch off "Google Analytics".

On this website, what is collected depends on your choice in the cookie banner (Google Consent Mode):

• With your consent, Google Analytics sets the cookies _ga and _ga_<ID>, kept for up to 2 years, to recognise returning visits. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Without your consent, it sets no cookies. Your browser still sends Google short measurements without cookies (the page, the page you came from, browser, device type and screen size), and they reach Google together with your IP address. Google uses them in aggregated form. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• If your browser sends Global Privacy Control or Do Not Track, Google Analytics sets no cookies and the banner does not ask. The measurements without cookies are still sent. Our own statistics do not read these signals.

We also count how often the cookie question is shown and how it is answered, to compare two designs of it. Your choice is saved in your browser's local storage (tingdo-consent) for 12 months. You can change or withdraw your consent at any time with the button below. Withdrawing does not affect processing that took place before.

Daily account counts

Once a day we count accounts: how many were active, created, deleted, in a trial or paying, and how many fall into groups, for example by age, sign-up week, plan, how much they are used, whether push notifications are on, and where the sign-up came from. For this we read what your account already stores (creation date, last activity, plan and subscription status, the counts of your tasks, projects and reviews, and whether a push notification token exists, never the token itself). Two things are stored with your account only for these counts: the campaign values of the link that led to your sign-up, and a mark for each day you opened the app, deleted after about 90 days. Only the totals per group are kept, with no reference to any account, without a time limit. Legal basis: our legitimate interest in knowing how many people use tingdo (Art. 6(1)(f) GDPR).

9. Children

tingdo is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When we make significant changes, we will notify you through the app or by email. The "last updated" date at the top of this page indicates the most recent revision.