LiTodo Privacy Policy

Effective date: November 8, 2026

한국어 · English

LiTodo (the “App”) is developed and operated by KiHoon Nam (남기훈), an individual developer in the Republic of Korea (the “Operator”). The Operator respects your privacy and complies with applicable laws, including the Korean Personal Information Protection Act and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR), as well as the Google Play Developer Policy and the Apple App Store Review Guidelines. This policy explains how the LiTodo apps for Android, iOS (including widgets), macOS (including widgets) and Windows, and the LiTodo websites, handle your information.

This English version is a translation of the Korean original. If they differ, the Korean version prevails, except where the law of your country requires otherwise.

1. Information we process

LiTodo has no sign-up, does not collect advertising identifiers, and uses no analytics, usage tracking or ads. The Operator’s servers do not store your tasks or account information.

1) Data stored on your device (required)

• What: the tasks you write, completion times, app settings (notifications, widgets, theme, etc.), and a random identifier for each device (used for sync, see 3 below).
• Where: your device’s internal storage (Android: the app’s private database; iOS and macOS: a private storage area shared only by the app and its LiTodo widgets; Windows: the %LOCALAPPDATA%\LiTodo folder).
• Leaving the device: unless you turn on cloud sync, the App does not send your tasks off your device. However, operating-system backup and transfer features that you have turned on (such as Google backup and device-to-device transfer on Android, or iCloud Backup and device transfer on iPhone) may include your tasks and settings. Your Google sign-in credentials are never included in such backups or transfers.
• On-device backups: so that you can bring back tasks deleted by mistake or removed by sync, the App automatically keeps copies of your tasks and deletion records in its private storage on your device. For the last 30 days it keeps one copy for each day you change your tasks plus one right before each bulk change (clearing completed tasks, syncing a deletion made on another device, an app update, etc.); after that it keeps one copy per month for up to one year and then deletes them. If the total size exceeds a set limit, the oldest copies are deleted first. However, the most recent copy of each kind of change is kept regardless of age so that it can still be restored (it is replaced when the same kind of change happens again). Backups are never sent off your device and are excluded from operating-system backup and device transfer.
• Diagnostic records: to help find the cause when something goes wrong, the App keeps a record of its activity (sync, sync signals, account connection, errors and similar) in its private storage on your device for 30 days (about 2 MB in total). It never records task text, account email or sign-in credentials. Diagnostic records are never sent off your device and are excluded from operating-system backup and device transfer; they leave your device only when you send them yourself by email in a problem report (see 6 below).
• Siri and Shortcuts (iOS): when you add a task with “Add to LiTodo”, Apple handles the speech recognition and the App only receives the recognized task text, which it stores on your device.

2) Google account connection and cloud sync (optional)

Processed only if you connect a Google account in Settings.

• What and where:
  • Your Google account email address: kept in the app settings on your device. Even after you disconnect, it stays on the device as the “previous account” so that, when you later connect a different account, the App can decide how to protect your existing tasks. It is deleted when you uninstall the App.
  • The task sync file (todonotification_backup.json, containing your tasks and the random identifier of the device that last uploaded it) and a device activity record (one empty file per device whose name contains the device’s random identifier and type — Android, iOS, Windows or macOS — and whose modification time serves as the last activity time): kept in a hidden app-specific folder (appDataFolder) in your own Google Drive.
• Purpose: syncing and backing up your tasks across your devices. The device activity record is used only to avoid sending real-time sync signals (see 3 below) when no other recently used device exists on the same account.
• Access scope: the App cannot access your Drive as a whole; it can only access the folder LiTodo created. The only Google permissions requested are access to that app folder (https://www.googleapis.com/auth/drive.appdata) and sign-in with email verification (openid, email).
• Google API Services User Data Policy: LiTodo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This information is used only to sync your tasks. It is not used for advertising, not sold, not transferred to third parties, and not used to develop, improve or train generalized artificial intelligence or machine learning models.
• Sign-in credentials: kept only on your device (Android: Google Play services; iOS: the device keychain, shared by the app and its LiTodo widgets so that widgets and Siri can sync without opening the app, usable only on that device and never moved by backup or device transfer; macOS: the device keychain, used only by the app; Windows: the %LOCALAPPDATA%\LiTodo\GoogleAuth folder).

3) Real-time sync signals

When a task changes on one device, the App sends a signal so that your other devices can fetch the latest data right away. The signal does not contain your tasks. Signals are sent and received only after you connect a Google account, and the App registers with the push services below only when you connect an account and removes that registration when you disconnect. If you do not connect an account, none of the processing in this section takes place.

• LiTodo relay server (operated on Cloudflare Workers)
  • Sent: a hash value derived from your account email (not the email itself) and the device’s random identifier.
  • Purpose: delivering sync signals to your other devices on the same account.
  • Retention: not stored. To avoid duplicate deliveries, the hash value and request time are kept in memory for a few seconds only. Cloudflare may process network information (such as IP addresses) while handling requests.
• Firebase Cloud Messaging (Google; Android and iOS apps)
  • Processed: the device registration token (Firebase installation ID, created when you connect an account; the token and installation ID are deleted when you disconnect) needed for push delivery and a subscription topic made from the hash value above (created after you connect an account). On iOS, the Apple Push Notification service (APNs) device token is processed as well.
  • Device information processed with it: when registering, Firebase also receives device information such as the device model, OS version, app version, language and time zone. Google states that it uses this information to deliver push messages and to understand platform and version adoption, and that it does not link it to a user or device identifier.
  • Purpose: delivering the relay’s signals to Android devices and to iOS devices (when the app is not on screen). On Android nothing is displayed. On iOS the signal arrives as a silent notification; the device syncs on its own and then fills the notification with tasks already stored on the device (the signal itself contains no tasks). If you have not allowed notifications on iOS, nothing is displayed and the App only syncs.
• Apple Push Notification service (Apple; iOS app)
  • Processed: the signal above (no tasks) and the APNs device token.
  • Purpose: delivering signals sent by Firebase Cloud Messaging to iOS devices.
• Signal reception on Windows, macOS and iOS (the relay server above)
  • The Windows and macOS apps keep a connection to the relay server while running, and the iOS app while it is on screen. When the iOS app is not on screen, it receives signals through push instead.
  • Used: only the hash value above. Neither your email nor the device identifier is used for the connection.
  • Retention: connection information exists only in the relay server’s memory while the connection lasts and disappears when it closes. Cloudflare may process network information (such as IP addresses) during the connection.

4) App update check

When you open the app screen, the App downloads one public file — identical for every user — from the LiTodo website (hoonest.net, hosted on GitHub Pages) to check whether your version is still supported.

• Sent: nothing. The request contains no account, device identifier or tasks.
• Purpose: telling you to update if your version is no longer supported.
• Retention: the App stores only the minimum version value on your device. GitHub may process network information (such as IP addresses) while handling the request.

5) Website visits

The LiTodo websites (hoonest.net, litodo.hoonest.net) have no sign-up, forms, analytics or ads. Hosting providers (GitHub, Cloudflare) may process visitors’ network information (such as IP addresses and browser information) to deliver the pages.

6) Questions and problem reports (optional)

Processed only when you contact the Operator through [Send feedback] in the App’s settings or by writing an email yourself.

• What we receive: your email address and what you write. If you choose [Report a problem], a diagnostic file made by the App is attached to the email. It contains the app version, device model, OS version, language and time zone, app settings, permission states (notifications, battery usage, etc.), free storage, sync state and error codes, the number of tasks and completed tasks with each item’s random identifier, state and times (no task text), the random device identifier, the first part of the account hash value (to check whether your devices are connected to the same account), the kinds and last activity times of devices connected to the same account, the number and times of on-device backups, the diagnostic records described in 1 above, and crash information recorded by the App. On Android it also includes the system log entries written by the App. The diagnostic file never contains task text, the account email itself or sign-in credentials, and user names in file paths and text that looks like an email address are masked.
• How it is sent: the App only fills in the recipient, subject, body and attachment in your email app; you send the email yourself from that app, and you can open, remove or edit the attachment before sending. On Windows the App saves the diagnostic file on your device and shows it so that you can attach it yourself.
• Purpose: answering your questions, and finding and fixing the problems you report
• Storage: kept in the Operator’s mailbox (Gmail). Email sent to litodo@hoonest.net is forwarded to that mailbox through Cloudflare Email Routing.

2. Purposes and legal bases

We use the information above only to:

• show your tasks in persistent notifications, home screen, lock screen and desktop widgets, the menu bar, the system tray and the compact bar;
• sync and back up your tasks across your devices through Google Drive when you ask us to;
• keep your app settings;
• tell you when an outdated version is no longer supported;
• answer your questions and find and fix the problems you report.

If the GDPR applies to you, we rely on the following legal bases: providing the features you request (Art. 6(1)(b) GDPR) for storing and syncing your tasks and delivering sync signals, and our legitimate interests in operating the App securely and keeping it up to date (Art. 6(1)(f) GDPR) for the update check, for the network information processed by our hosting providers, and for answering the questions and problem reports you send us and keeping them for one year. We do not make decisions based solely on automated processing, including profiling.

3. Retention and deletion

4. Sharing and service providers

LiTodo does not provide, sell, rent or share your personal information or tasks with third parties, including “selling” or “sharing” as defined under California law. The sync file is stored, at your request, in your own Google account.

To provide the App’s features, we use the following service providers (processors). All transfers are encrypted (HTTPS).

5. International transfers

The providers above are located outside Korea, and the following information is transferred abroad while you use the App. Transfers happen whenever needed while you use the App, over encrypted connections (HTTPS).

• How to refuse and its effect:
  • If you do not connect a Google account, no transfers to Google, Apple or Cloudflare (account email, tasks, device identifiers, push registration) take place; you can use your tasks on the device only (without sync). After connecting, you can stop at any time with [Disconnect Google account] in Settings, which also removes the push registration.
  • Emails to the Operator are transferred only when you send them; if you do not send one, no transfer takes place.
  • There is no setting to turn off the network information (such as IP addresses) processed for the update check and website visits. If you do not want this, you can stop using or uninstall the App. If you use the App offline, the update check does not happen, but you will not be told when your version is no longer supported.
• Safeguards: these providers state that they protect such transfers with recognized safeguards, such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses. See each provider’s privacy policy linked above for details.

6. Your rights and how to exercise them

You may at any time access, correct or delete your personal information, or ask us to stop processing it. If the GDPR applies to you, you also have the rights to restrict processing, to object, and to data portability, and you may lodge a complaint with the data protection authority in your country. Because LiTodo’s data is only on your devices and in your own Google Drive, you can do most of this yourself:

• Access and correction: view and edit your tasks in the task and completed lists of the App.
• Deleting data on the device: when you permanently delete a task it disappears from your lists immediately, and from on-device backups once their retention period ends (usually up to one year; the most recent copy of each kind of change stays until it is replaced by a newer one). To delete everything, including backups, right away, uninstall the App or clear its data (on Windows, delete the %LOCALAPPDATA%\LiTodo folder).
• Stopping processing (disconnecting sync): use [Settings] → [Disconnect Google account] at any time. Your tasks stay on the device; cloud sync and real-time sync signals stop.
• Deleting cloud data: in Google Drive on the web, go to [Settings] → [Manage apps], find LiTodo and choose Delete hidden app data. This deletes the sync file and device activity records stored in Drive.
• Portability: the sync file in your Drive app folder is a JSON file containing your tasks.
• Revoking Google access: revoke LiTodo’s access at any time on the Google Account permissions page.
• Deleting emails you sent us: to have a question or problem report you sent deleted, ask through the contact in section 11. We delete it right away.
• Requests: send any other request to the contact in section 11. We will reply within 10 days. The Operator cannot access your tasks or Drive data, so please handle that data yourself using the methods above.

7. Security measures

• All network transfers are encrypted with HTTPS (TLS).
• Google permissions are limited to the app folder and email verification; your other Drive files are never accessed.
• Google sign-in credentials are kept only in the secure storage provided by the operating system (such as the keychain) or the app’s private folder, and are excluded from backups.
• Your email address itself is never sent to the Operator’s server; sync signals use only a hash value.
• The Operator’s servers do not store your tasks or account information.
• On-device diagnostic records and the diagnostic files for problem reports never contain task text, account email or credentials, and user names in file paths and text that looks like an email address are masked.

8. Cookies and similar technologies

The App does not use cookies or similar tracking technologies. The websites do not use cookies; they only store the display theme you choose (light or dark) in your browser, which is deleted when you clear site data in your browser.

9. Children

LiTodo is not directed to children under 14 (or under the minimum age for digital consent in your country) and does not knowingly collect their personal information.

10. Changes to this policy

If the App’s data processing changes, we update this policy and its effective date before the change takes effect. Previous versions are available in the change history.

11. Privacy officer and contact

Please send questions about this policy, complaints and requests about your personal information to:

• Privacy officer (controller): KiHoon Nam (남기훈), LiTodo operator (individual developer), Republic of Korea
• Email: litodo@hoonest.net

12. Remedies for users in Korea

To seek remedies for infringements of personal information, users in Korea may contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)