Privacy policy — todox

Last updated: 12 August 2026.

What we store

• Your account: email, username, display name, and a password hash. The hash is scrypt and we cannot read your password.
• Your projects, tasks, log entries, context notes, and project memberships — the data you put into todox.
• Session cookies that keep you signed in. They are HTTP-only, signed, and expire when you sign out or after 30 days of inactivity.
• Server logs with your IP address and request path, kept for 30 days for abuse detection and debugging.

What we do not do

• We do not run third-party analytics, ad networks, or tracking pixels in the app.
• We do not sell or share your data with marketers, data brokers, or social networks.
• We do not train AI models on your projects, tasks or notes.

Sub-processors

todox itself is the only processor of your data. We use a small set of infrastructure sub-processors to run the service:

• Hostinger — a virtual server in Frankfurt, Germany. The application and the PostgreSQL database both run on it, so your projects, tasks and notes stay on that one machine.
• Resend — transactional email for verification and password reset. Only the recipient address and the message itself are handed over, and Resend processes them in its Tokyo (ap-northeast-1) region.

How long we keep your data

We keep your account and your projects for as long as the account exists. Deleting your account deletes your projects, tasks, log entries, and notes; session records are removed within 30 days. Server logs are deleted after 30 days.

Your rights

You can export your data and delete your account from the Account page. To exercise rights that are not covered by the UI — for example, a data access request on behalf of someone else — open a GitHub issue.

Changes to this policy

When this policy changes in a way that affects what we collect or how we use it, the change is announced in the GitHub release notes before it takes effect.