Privacy Policy

Todowl is an iOS app built and operated by Mustafa Barış İmdat, an individual developer based in Türkiye. For the purposes of the EU and UK General Data Protection Regulation, the developer is the data controller for the limited processing described here.

Contact for any privacy question, request, or complaint: mustafabarisimdat@gmail.com. This policy covers the Todowl iOS app and this website. It does not cover anything else you may reach from inside the app, such as the App Store.

Todowl stores your data locally on your iPhone, using the operating system’s own storage (SQLite and AsyncStorage). That includes:

• Your tasks, lists, due dates, completion state, and notes
• Your app settings and preferences
• Recent transcripts of what you said, kept only for the undo window described in section 6
• Generated daily brief text and the audio cached for playback

None of this is uploaded to a Todowl account, because there are no accounts. If you have iCloud device backup turned on, iOS may include Todowl’s data in your own encrypted device backup. That backup is Apple’s infrastructure under your control, governed by Apple’s privacy policy, and we have no access to it. Deleting the app removes its local data from the device.

Voice

When you record a voice capture, the raw audio is streamed in real time to Google (Gemini API) for transcription. Todowl does not save audio files or keep a copy of what was streamed; the audio is not retained once it has been transcribed. The language you are speaking is detected automatically, including Turkish, English, and others. Todowl receives only the resulting text.

Text transcripts

The text transcript is sent to OpenAI so a model can extract structured tasks from what you said and write the text of your daily brief. Only the transcript and the minimal context needed for that request are sent. No name, email, account identifier, contact list, location, or device advertising identifier is attached.

Brief audio

The text of your daily brief is sent to Google (Gemini API) for the sole purpose of generating spoken audio. Google receives the brief text, nothing else about you.

Model training

Under the API agreements we use with both OpenAI and Google, data sent through the API, including streamed audio, is not used to train their models. Providers may retain request data briefly for abuse monitoring under their own terms.

Subscriptions

Purchases are processed by Apple. Subscription state is managed for us by RevenueCat using a pseudonymous identifier the app generates. Your name, email address, and payment details never reach Todowl or RevenueCat. Apple does not share your payment method with us.

Our proxy

AI requests may route through a Cloudflare Worker operated by the developer. The proxy forwards your request to the AI provider, verifies that the request comes from a genuine copy of the app using Apple App Attest, checks subscription state, and applies rate limits. The proxy stores no message content. It stores App Attest public keys, request counters, and short-lived caches. Cloudflare processes network traffic on our behalf as an infrastructure provider and may log standard connection metadata such as IP address for security and abuse prevention.

• No user accounts, sign-ups, logins, or passwords
• No advertising and no ad networks
• No analytics SDKs, product telemetry, or session recording
• No tracking across apps or websites, and no use of the Advertising Identifier (IDFA)
• No selling or sharing of personal data, in any sense of those words
• No access to your contacts, photos, calendar, precise location, or health data

• Microphone. Needed to capture what you say while you hold the record control. Only active while you are recording.
• Notifications. Optional. Used only for local reminders you set. Nothing is sent from a server.

You can change or revoke any of these at any time in the iOS Settings app. Revoking the microphone or speech permission disables voice capture but the rest of the app keeps working.

These are the only third parties involved in running Todowl. Each acts as a processor or independent controller for a narrow purpose, under its own terms.

• Performance of a contract. Processing your transcript to produce tasks and a brief is how the app delivers the service you asked for.
• Legitimate interests. Verifying app authenticity, enforcing rate limits, and preventing abuse of the proxy, balanced against your rights and limited to what is necessary.
• Consent. Microphone, speech recognition, and notification permissions. You can withdraw consent in iOS Settings at any time.
• Legal obligation. Where we must retain or disclose something to comply with applicable law.

The developer is based in Türkiye. Our providers operate globally, so the limited data described in section 3 may be processed in the United States, the European Economic Area, or elsewhere. Where personal data from the EEA or UK is transferred outside those regions, our providers rely on the European Commission’s Standard Contractual Clauses or another approved transfer mechanism in their data processing terms. For users in Türkiye, processing is carried out consistently with Law No. 6698 on the Protection of Personal Data (KVKK).

Because there is no account and your content stays on your device, the fastest way to exercise most of these rights is directly in the app: edit or delete tasks, or delete the app to remove its local data. For anything else, email mustafabarisimdat@gmail.com and we will respond within 30 days.

If GDPR applies to you (EEA, UK)

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority

If CCPA and CPRA apply to you (California)

• Right to know what personal information is collected and why
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing. We do not sell or share personal information and have not done so in the preceding 12 months
• Right to limit use of sensitive personal information. We do not use personal information for any purpose beyond delivering the app
• Right not to receive discriminatory treatment for exercising these rights

We do not require identity verification for these requests, because we hold no identifying account data to verify against.

Todowl is not directed at children. You must be at least 13 years old to use it. Where the GDPR applies, you must be at least 16, or the minimum digital consent age set by your country if that is lower, or else have your parent or guardian’s consent. We do not knowingly collect data from anyone under these ages. If you believe a child has used the app in a way that involved us processing their data, email mustafabarisimdat@gmail.com and we will delete what we hold.

Data on your device is protected by iOS file protection and your device passcode. All network requests use TLS. Requests to our proxy are verified with Apple App Attest so that only genuine copies of the app can use it. We keep no content database, which means there is no central store of your tasks or transcripts to breach. No system is perfectly secure, and we cannot guarantee absolute security.

If this policy changes in a way that materially affects how your data is handled, we will update the effective date at the top and, where the change is significant, show a notice in the app before it takes effect. Continuing to use Todowl after a change means you accept the updated policy. Older versions are available on request.

Mustafa Barış İmdat, individual developer, Türkiye. Email: mustafabarisimdat@gmail.com.