todoai-legal

Privacy Policy

Effective Date: 2026-05-29

This Privacy Policy explains how Mehmet AK (“we”, “us”, “Service Provider”) handles personal information when you use the TodoAI mobile application (“the Application”) on iOS and any related services.

We respect your privacy. TodoAI is designed so that your content stays with you. Your tasks, lists, notes, attachments, and settings are stored in your own Apple iCloud account and are not accessible to us as the developer.

1. Information We Collect

We process the following categories of data:

1.1 Information You Provide

Account information — your name and email address as provided by Apple via the App Store account (used for receipt validation and support correspondence only).
User content — tasks, lists, notes, tags, templates, routines, board cards, attachments (photos, files, drawings) you create or import. This content is stored in your private Apple iCloud database; we cannot read it.
Voice input transcripts — when you use the voice add feature, audio is transcribed on your device using Apple’s Speech Framework. The transcript becomes task content stored in your iCloud.
AI prompts — when you use AI features (Assistant, suggestions, natural-language parsing, AI Board), the text you type or speak is sent to the AI service provider configured for your tier (see Section 4).
Calendar event data — if you opt in to calendar integration via EventKit, task titles and due dates are written to a calendar of your choice. We do not read your other calendar events.

1.2 Information from Apple

Subscription status — when you purchase Pro Monthly or Pro Yearly via Apple In-App Purchase, Apple shares your subscription status, renewal date, and trial eligibility with the Application via StoreKit. Apple processes all payments; we do not see your payment information.

1.3 Information We Do NOT Collect

We do not collect:

Your device identifier (IDFA / advertising ID)
Your IP address
Your geographic location
Your contacts or address book
Your browsing history
Analytics about how you use the Application (we use no Google Analytics, Firebase Analytics, Mixpanel, Amplitude, or any other third-party analytics)
Data for tracking you across other companies’ apps or websites

We do not show advertisements and do not sell or rent your personal data to anyone.

2. How We Use Information

Purpose	Data Used	Legal Basis (GDPR Art. 6)
Provide and operate the Application	User content, account info	Contract performance (Art. 6(1)(b))
Sync your data across your devices	User content (via Apple CloudKit)	Contract performance
Process Pro subscription payments	Apple subscription status	Contract performance
Provide AI features (Assistant, etc.)	The text you type/speak as AI prompts	Consent (you opt in by using the feature)
Provide calendar integration	Task titles + due dates	Consent (you opt in via system prompt)
Respond to support requests	Email correspondence	Legitimate interest (Art. 6(1)(f))
Comply with legal obligations	Limited records as required	Legal obligation (Art. 6(1)(c))

3. Data Storage — Apple iCloud (CloudKit)

Your tasks, lists, notes, attachments, and settings are stored in your personal Apple iCloud private database using Apple’s CloudKit technology.

We (the developer) cannot read this data. Apple’s privacy model isolates each user’s data inside their own iCloud account; only you and Apple can access it.
Data is encrypted in transit (TLS) and at rest by Apple.
You manage this data through your own Apple ID. To delete it, sign out from iCloud or delete the Application; iCloud will remove the data per Apple’s policy.
Apple’s iCloud privacy practices apply: https://www.apple.com/legal/privacy/

When you share a list with another user via CKShare, Apple manages the sharing handshake and stores the shared list in Apple’s “shared” CloudKit database. You control who has access via the share invitation.

4. Artificial Intelligence (AI) Services

The Application integrates AI services to power features such as natural-language task parsing, intelligent suggestions, the AI Assistant, and AI Board recommendations.

4.1 Default AI Provider (Pool)

By default, AI requests are routed to Groq, Inc. using a Llama 3.1 8B model. When you use an AI feature without configuring your own API key:

The text you type or speak (the “prompt”) is sent to Groq’s servers (United States).
Groq processes the prompt and returns a response.
Daily and monthly rate limits apply per tier (Free, Trial, Pro) and are visible in Settings → AI Service.
Groq’s privacy policy: https://groq.com/privacy-policy

4.2 Optional Bring-Your-Own-Key (BYOK) Providers

You may optionally configure your own API key for one of the following providers in Settings → AI Service. When BYOK is active, prompts are sent directly to the provider you selected, and the default pool provider is not used:

Provider	Privacy Policy
OpenAI	https://openai.com/policies/privacy-policy
Anthropic (Claude)	https://www.anthropic.com/privacy
Google (Gemini)	https://policies.google.com/privacy
Alibaba Cloud (Qwen)	https://www.alibabacloud.com/help/en/legal/privacy-policy

Your API key is stored securely in your device’s Apple Keychain and is not transmitted to us.

4.3 What Data Is Sent to AI Providers

When you use an AI feature, the prompt may include:

The text you type or speak
The titles and metadata of related tasks (for context-aware features like the Assistant)
The current date and time

We recommend that you do not include sensitive personal data (medical, financial, government identifiers, etc.) in AI prompts.

4.4 AI Transparency

You can disable AI features entirely in Settings → AI Service → Parser Mode → “Prefix-only”. When disabled, no prompts are sent to any AI provider.

4.5 User Responsibility and Disclaimer for AI Features

By using any AI feature of the Application, you acknowledge and agree to the following terms:

Lawful use only. You will not submit prompts, content, or files that:
- violate any law of your jurisdiction or the jurisdiction of the AI provider’s servers;
- infringe the intellectual property rights (including copyright, trademark, trade secrets) of any third party;
- constitute defamation, harassment, hate speech, incitement to violence, or terrorism;
- depict or describe child sexual abuse material (CSAM) or any other unlawful content;
- violate the acceptable-use policy or terms of service of the AI provider (Groq, OpenAI, Anthropic, Google, or Alibaba Cloud, as applicable).
No special-category or highly sensitive data. You will not submit, and the Application is not designed to handle, the following data via AI features:
- Health, medical, or genetic information;
- Financial-account credentials, full credit-card numbers, or banking details;
- Government-issued identification numbers (TC Kimlik No, SSN, passport, driver’s licence, etc.);
- Biometric data;
- Personal data of children under 13;
- Trade secrets or confidential information you are not authorised to disclose.
Submitting such data is at your sole risk and may result in disclosure outside our control.
No professional advice. AI-generated output (suggestions, summaries, plans) does not constitute legal, medical, financial, psychological, or other professional advice. You should not rely on AI output for decisions requiring professional judgment.
AI provider’s terms govern processing. Once your prompt reaches the AI provider, its processing is governed by that provider’s terms of service and privacy policy (linked in Section 4.1 and 4.2). We are not a party to, and have no control over, that processing.
Limitation of liability. To the maximum extent permitted by applicable law, the Service Provider:
- disclaims all warranties (express or implied) regarding AI output, including accuracy, completeness, or fitness for any particular purpose;
- is not liable for any direct, indirect, incidental, consequential, or punitive damages arising from your use of AI features, your reliance on AI output, or any third-party claim related to content you have submitted;
- is not liable for the acts or omissions of any AI provider.
Indemnification. You agree to indemnify and hold the Service Provider harmless from any third-party claim, loss, or damage arising out of your violation of this Section 4.5, including reasonable legal fees.
No agreement, no use. If you do not agree to these conditions, you must not use AI features. You can disable them entirely in Settings → AI Service → Parser Mode → “Prefix-only”.

5. In-App Purchases and Subscriptions

The Application offers Pro Monthly and Pro Yearly auto-renewing subscriptions, with a 14-day free trial for new subscribers.

All payments are processed by Apple through the App Store. We do not see your payment method or billing details.
Apple shares subscription status (active, trial, expired, grace) with the Application via StoreKit so that we can unlock Pro features.
You can manage or cancel your subscription anytime via Settings → Apple ID → Subscriptions on your device.
Apple’s billing privacy policy applies: https://www.apple.com/legal/internet-services/itunes/

Subscription receipt data is validated locally on your device using StoreKit 2; no receipt data is sent to our servers.

6. Apple Platform Services and iOS Permissions

The Application uses the following Apple system services. Each iOS-protected resource requires your explicit consent via a system prompt the first time it is requested. You may revoke any permission at any time in iOS Settings → TodoAI.

Service	Why we use it	iOS Permission (Info.plist key)
CloudKit	Synchronise your tasks, lists, notes, and attachments across your Apple devices and securely store shared lists when you invite others.	Apple ID (system-level; no separate prompt)
StoreKit 2	Process Pro Monthly / Pro Yearly subscription purchases and validate receipts locally on your device.	Apple ID (system-level; no separate prompt)
Speech Framework	Convert your voice into task text when you tap the microphone button. Transcription is performed on-device whenever possible; audio is not sent to our servers.	Microphone (`NSMicrophoneUsageDescription`) and Speech Recognition (`NSSpeechRecognitionUsageDescription`) — two separate prompts the first time you use voice input.
EventKit	Optionally write your task titles and due times to a calendar you choose, so reminders also appear in your Calendar app. We do not read other calendar events.	Calendars (`NSCalendarsUsageDescription` / `NSCalendarsFullAccessUsageDescription` on iOS 17+) — only requested when you toggle calendar sync on.
PhotoKit (PhotosPicker)	Attach photos from your library to a task. The system picker shows only the items you select; we do not browse your library.	Photo Library (`NSPhotoLibraryUsageDescription`) — only requested when you tap “Attach photo”.
Files / Document Picker	Attach documents (PDF, etc.) you select from Files.	None (system file picker handles access).
UserNotifications	Show local reminders for due dates and Focus Timer phases.	Notifications (`NSUserNotificationUsageDescription` is automatic) — system prompt on first reminder scheduling.
Apple Keychain	Securely store your optional AI API key (BYOK). Hardware-backed encryption is used where available.	None (system-managed).
PencilKit	Allow you to add hand-drawn notes as task attachments. Drawings are stored as task content in your iCloud.	None (no system permission required).

The Application does not use the camera and does not include NSCameraUsageDescription in its Info.plist. If a future version adds camera capture, this Privacy Policy will be updated and a separate camera-permission prompt will be added.

7. Third Parties

We do not sell or rent your personal data to anyone.

We share data only with:

Apple — for the platform services described in Sections 3, 5, and 6
AI providers — only the prompts you send when you use AI features (Section 4)
Law enforcement or government authorities — only when required by valid legal process

We do not use any analytics, advertising, attribution, or marketing SDKs.

8. Your Rights

You have the following rights regarding your personal data. To exercise any of these rights, contact us at mehmetak78@gmail.com. We will respond within 30 days (or as required by applicable law).

8.1 General Rights

Access — request a copy of personal data we hold about you
Rectification — request correction of inaccurate data
Erasure — request deletion of your data
Portability — request your data in a portable, machine-readable format
Restriction — request that we limit processing
Objection — object to processing based on legitimate interests
Withdraw consent — for any consent-based processing
Lodge a complaint — with your local data protection authority

For data stored in your iCloud (Section 3), you can also exercise these rights directly via your Apple ID settings (managing or deleting iCloud data).

You have all rights under Articles 15–22 of the General Data Protection Regulation (GDPR / UK GDPR). You also have the right to lodge a complaint with your national supervisory authority.

8.3 CCPA/CPRA Rights (California Residents)

You have the right to:

Know what personal information is collected
Delete personal information
Opt out of sale or sharing — we do not sell or share personal data
Non-discrimination for exercising your rights

To exercise these rights, contact us at mehmetak78@gmail.com.

8.4 KVKK Hakları (Türkiye Kullanıcıları)

6698 sayılı Kişisel Verileri Koruma Kanunu (“KVKK”) Madde 11 uyarınca aşağıdaki haklara sahipsiniz:

Kişisel verilerinizin işlenip işlenmediğini öğrenme;
Kişisel verileriniz işlenmişse buna ilişkin bilgi talep etme;
Kişisel verilerinizin işlenme amacını ve bunların amacına uygun kullanılıp kullanılmadığını öğrenme;
Yurt içinde veya yurt dışında kişisel verilerinizin aktarıldığı üçüncü kişileri bilme;
Kişisel verilerinizin eksik veya yanlış işlenmiş olması hâlinde bunların düzeltilmesini isteme;
KVKK’nın 7. maddesinde öngörülen şartlar çerçevesinde kişisel verilerinizin silinmesini veya yok edilmesini isteme;
Düzeltme, silme veya yok etme işlemlerinin, kişisel verilerinizin aktarıldığı üçüncü kişilere bildirilmesini isteme;
İşlenen verilerin münhasıran otomatik sistemlerle analiz edilmesi suretiyle aleyhinize bir sonucun ortaya çıkmasına itiraz etme;
Kişisel verilerinizin kanuna aykırı olarak işlenmesi sebebiyle zarara uğramanız hâlinde zararın giderilmesini talep etme.

Veri Sorumlusu: Mehmet AK (Türkiye’de mukim gerçek kişi geliştirici) Faaliyet bölgesi: Sarıyer, İstanbul, Türkiye E-posta (birincil iletişim): mehmetak78@gmail.com Posta adresi: Tebligata elverişli tam posta adresi, KVKK Madde 11 kapsamındaki yazılı taleplerinizi takiben e-posta yoluyla yapacağınız adres talebine 7 (yedi) iş günü içinde tarafınıza bildirilir. Bu yöntem, Veri Sorumlusu’nun kişisel güvenliği ile KVKK Madde 13 uyarınca size 30 (otuz) gün içinde geri dönüş yükümlülüğümüzü dengelemek için tercih edilmiştir.

Acil ve resmî bildirimleriniz için Kişisel Verileri Koruma Kurumu’nun (https://www.kvkk.gov.tr) “Veri Sorumluları Sicil Bilgi Sistemi” (VERBİS) üzerinden de iletişime geçebilirsiniz (kayıt yükümlülüğümüz oluştuğunda VERBİS kayıt bilgilerimiz burada paylaşılacaktır).

Taleplerinizi e-posta yoluyla iletebilirsiniz. Talepleriniz, KVKK’nın 13. maddesi uyarınca en geç 30 gün içinde ücretsiz olarak sonuçlandırılır (talebin niteliği işlem maliyeti gerektiriyorsa Kurul’un belirlediği tarifedeki ücret yansıtılabilir).

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including:

United States — Groq, OpenAI, Anthropic, Google (for AI features when active)
Singapore — Alibaba Cloud (if you select Qwen as your BYOK provider)
Apple’s global data centers — for CloudKit, StoreKit, and other Apple services

For transfers originating from the EEA/UK, we and our processors rely on the European Commission’s Standard Contractual Clauses (SCCs) or recognized adequacy decisions where applicable. Apple and the AI providers maintain their own transfer mechanisms which apply once data reaches them.

10. Data Retention

Data	Retention
User content (in your iCloud)	Retained as long as you keep the Application installed and your iCloud account active. Deletion is controlled by you via iCloud.
AI prompts	We do not store AI prompts. AI providers may retain them per their own retention policies (see links in Section 4).
Subscription metadata	Retained for the duration of the subscription plus any period required by Apple for receipt validation, refunds, or accounting (typically up to 2 years).
Support correspondence	Up to 24 months from last contact, then deleted.
Legal compliance records	Retained as required by applicable law.

11. Security

We rely on Apple’s CloudKit, StoreKit, and Keychain security infrastructure to protect your data:

All CloudKit and StoreKit communication is encrypted in transit using TLS 1.2+.
iCloud data is encrypted at rest by Apple.
BYOK API keys are stored in the Apple Keychain with hardware-backed encryption (Secure Enclave on supported devices).
We do not maintain our own data servers for your user content; we have no servers to be breached.

While we apply industry-standard practices, no method of electronic storage or transmission is 100% secure.

12. Children

The Application is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data through the Application, please contact us at mehmetak78@gmail.com and we will take appropriate action, including deletion of the child’s data.

If you are under 16, your parent or guardian must provide consent on your behalf where required by applicable law.

13. Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law (e.g., GDPR Article 33–34, KVKK Article 12), including the nature of the breach, the likely consequences, and the steps being taken to address it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available at the URL referenced in the Application’s Paywall, Settings, and App Store listing. Material changes will be highlighted with an updated Effective Date. Continued use of the Application after a change becomes effective constitutes acceptance.

Previous versions are available upon request.

15. Account and Data Deletion (Apple Guideline 5.1.1(v))

The Application does not require you to create an account with us. You sign in using your existing Apple ID, which is managed by Apple. All your content is stored in your own Apple iCloud private database (see Section 3); we do not store it on our servers.

To delete all your data from the Application:

In-app deletion — open the Application and delete individual items, lists, templates, or routines you no longer need.
Delete the Application — uninstall TodoAI from your device(s). Local caches are removed immediately.
Remove iCloud data — on your device, open Settings → [Your Name] → iCloud → Manage Account Storage → TodoAI → Delete Data. Your synced tasks, lists, and attachments are removed from Apple’s iCloud across all your signed-in devices.
Cancel subscription (if active) — open Settings → [Your Name] → Subscriptions → TodoAI Pro → Cancel Subscription. Apple manages the cancellation.
Email confirmation (optional) — write to mehmetak78@gmail.com if you want written confirmation that no other personal data is held by us, or to exercise your KVKK / GDPR erasure rights described in Section 8.

Because we do not maintain our own servers for your user content, there is no developer-side data store for us to purge — Apple manages the entire data lifecycle. Subscription metadata held by Apple is governed by Apple’s retention practices.

16. Contact

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us:

Service Provider: Mehmet AK (individual developer based in Türkiye) Region of activity: Sarıyer, İstanbul, Türkiye Email (primary contact for all inquiries): mehmetak78@gmail.com Postal address: A postal-deliverable address for service of legal notices is provided within 7 business days upon written email request. This balances the Service Provider’s personal safety with the controller-identification requirements of GDPR Article 13(1)(a) and KVKK Article 10. Application: TodoAI (iOS)

For privacy-related questions or requests, please use the email above. We aim to respond within 30 days, in line with GDPR Article 12(3) and KVKK Article 13(2).

Last updated: 2026-05-30