Privacy policy
Last updated 21 September 2026
Toodly is a to-do list. It needs your tasks to work, and almost nothing else. This page says exactly what is collected, why, and how to get rid of it.
Who we are
Toodly is made by Digital Highrise Ltd, a company registered in England and Wales. For UK GDPR we are the data controller. Email us at hello@toodly.app.
You can use Toodly without an account
If you tap "Skip for now", everything stays on your phone. No account, no sync, nothing sent to us except anonymous app analytics. Sign in later and your existing tasks move to your account.
What we collect
| What | Why | Kept until |
|---|---|---|
| Your email address, and your name if you give one | To create your account and sign you in | You delete your account |
| Your tasks, notes, categories, dates and reminders | So they sync to your other devices and are not lost if you lose your phone | You delete them, or delete your account |
| Who a shared list is shared with | So the right people see the list | The share ends or the account is deleted |
| Whether you are a Pro subscriber | To unlock the features you paid for | You delete your account |
| Anonymous usage events and crash reports | To see which screens work and to fix what breaks | 12 months |
What we never collect
- Card or bank details. Google Play takes the payment. We only receive a yes or no about your subscription.
- Your location, contacts or photos.
- Advertising identifiers. Toodly has no ads and no ad tracking.
Microphone and calendar
If you use voice add, Toodly uses your microphone through your phone's own speech service to turn what you say into a task. If you turn on calendar events, Toodly reads your phone's calendar to show them in Upcoming. Both only happen after you allow them. The audio and the events stay on your phone. We never store or receive them.
Analytics, in plain terms
Toodly sends anonymous events such as "a task was created" or "the paywall was viewed" to PostHog, on servers in the EU. Each install gets a random id. That id is not your email, not your device id and not linked to a person profile. Your task titles and notes are never sent. If something crashes, the error message is sent so it can be fixed.
Where your data is kept
- Your account and tasks: Supabase, on servers in London (AWS eu-west-2).
- Analytics and crash reports: PostHog, on servers in the EU.
- Subscription status: RevenueCat, in the United States, under standard contractual clauses.
- Sign-in with Google or Apple: only if you choose it, and only to confirm it is you.
Our legal bases
- Contract: your account, your tasks and your subscription. Without these the app cannot do its job.
- Legitimate interests: anonymous analytics and crash reports, to keep the app working and worth using.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Two of those you can do yourself, right now, in the app:
- A copy: Me, then Your data, then Export my tasks.
- Deletion: Me, then Account, then Delete account. It removes the account and everything in it. See the account deletion page.
For anything else, email hello@toodly.app and we will reply within 30 days. If you are not happy with the answer you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Toodly is not aimed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, the app will say so before the change applies. The date at the top always shows the current version.