Privacy
Todomu is built so that I can’t read your tasks. This page says exactly what I do see.
Who runs Todomu
Sebastian Vetter, Erich-Weinert-Str. 6, 10439 Berlin, Germany. Email: webmaster@todomu.app. Todomu is a private, non-commercial project. I run the app, this website and the sync server, and I am the controller under the GDPR.
On your device
Your lists, tasks and reminders are stored on your device, encrypted. Reminders and the widget are prepared on the device too. Nothing about them goes anywhere unless you sync.
Syncing and sharing
When you sync, your device sends your changes to Todomu’s server, sync.todomu.app, end-to-end encrypted: only the devices of the people on a list hold its key. I can’t read titles, notes, dates or anything else you write.
To decide who may read and write which list, the server does store:
- your public keys, a user id derived from them, and the day you first synced;
- for each list: the user ids of its members and its key owners, its share links’ public keys, and how many encrypted entries it has and how large they are;
- the encrypted entries themselves, each with the hour it arrived;
- if your device allows it, its push token from Apple, so the server can wake the app with an empty “sync now” message when one of your lists changes. The message contains nothing about the list or its contents. Tokens are deleted when Apple reports them invalid, or after 60 days without use.
There is no account: no name, email address or phone number. The server stores no IP addresses and keeps no request logs. It uses your IP address only briefly, in memory, to limit how often it can be called. The legal basis is Art. 6(1)(b) GDPR: it’s needed to provide the sync you asked for.
Your profile (the name and avatar you choose) is part of the lists you share, encrypted like everything in them: only the people on those lists see it.
When you add a device, your other device sends it your identity through the server, end-to-end encrypted to a one-time key only the new device holds. The server keeps it in memory for at most ten minutes, until the new device picks it up, and never on disk.
You can sync with no server at all (clear the server in Settings), or with your own.
Todomu in the browser
The web app at todomu.app/app keeps your lists in your browser's storage, encrypted, and your identity next to them, so you stay signed in. Use a private window if you want nothing left behind. A shared list opened from a link keeps nothing at all.
Contact and share links
The secret parts of Todomu links come after the #. Browsers never send that part to a server, so I don’t see it even when a link opens this website.
This website
No cookies, no analytics, no fonts or scripts from other sites, and no access logs.
Who else is involved
The server runs at Hetzner Online GmbH in Germany, which processes data on my behalf under a data processing agreement. Apple delivers the app through the App Store under its own privacy policy.
How long it’s kept
Encrypted list data stays on the server as long as the list is in use. Daily backups are kept for seven days.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object, and the right to complain to a supervisory authority. Because I can’t tell who is behind a user id, to exercise them send me your user id (Settings → About in the app).
Last updated: 6 November 2026.