Privacy Policy

This policy explains what Very Simple Todo collects, why, and what you can do about it. It is written plainly and describes what the app and service actually do. It is not legal advice.

Who we are

The Very Simple Todo iPhone app and the service at verysimpletodo.com are provided by Portfoliobox Stockholm AB ("we"), org. no. 556894-4382, Rånövägen 30, 168 39 Bromma, Sweden. We are the data controller for the personal data described here. Contact: verysimple@portfoliobox.net.

What we store

• Your account. When you sign in with Apple or Google, we receive a stable account identifier and, where you allow it, your email address and name. You can add a profile picture in the app; it is stored with your account. We never receive your Apple or Google password.
• Your todos. Each todo's title, its notes, whether it is done and when, whether it is starred, and when it was created and last edited. Stored so your list syncs across your devices and so an assistant you connect can work with it.
• Sign-in sessions. A hashed session token per signed-in device, with when it was created, last used and expires.
• Connection tokens. For each assistant you connect: a hashed token, the name you or the app gave it, which app it came from, and when it was created and last used. Never the token itself.
• Connect codes. Short-lived, hashed one-time codes used while an app connects. They expire within minutes.
• Your subscription. Apple tells us whether you have an active subscription, whether you are in the free trial, and its renewal or expiry. Apple handles the payment; we never see your card.
• Minimal technical data. Ordinary server logs needed to run and secure the service. We do not use advertising or tracking SDKs.

What we do not do

We do not sell your data. We do not share your todos with anyone except the assistant you choose to connect. We do not use your todos to train AI models. We show no ads.

Where your data lives

Your todos and account are stored in a PostgreSQL database hosted by Fly.io in Amsterdam, in the European Union. Traffic is encrypted in transit (HTTPS), and the database's storage is encrypted at rest by the host. Access tokens and sign-in session tokens are stored only as hashes, so a database copy alone does not reveal them.

Connecting an assistant

When you connect an AI assistant (such as Agent Heim), you create a personal API token that lets that assistant read your list and add, edit, check off and uncheck todos on your behalf. You can see and revoke every token in the app under Account. Revoking it cuts off that assistant immediately.

Your rights

Under the GDPR you can access, correct, export, or delete your data. You can edit or delete any todo in the app at any time. You can delete your whole account in the app under Account; it removes everything at once. To export everything, email verysimple@portfoliobox.net and we will action it. See our GDPR page for detail.

Retention

We keep your todos and account for as long as your account exists. Delete a todo and it is removed; delete your account and we remove your todos, account, sessions, tokens and subscription record.

Children

The app is rated 4+ but is intended for general audiences. It is not directed at children, and we do not knowingly collect data from children under the age of digital consent without a parent's involvement.

Changes

If this policy changes we will update this page and its date. Continued use after a change means you accept the updated policy.