Privacy Policy

Version: 1.5 | Effective: September 2026 | Last updated: September 21, 2026

Last updated: September 21, 2026

TodoHub is a brand of RTec Desenvolvimento de Softwares LTDA (“we”, “our”, or “company”). We respect the privacy of TodoHub users and visitors to our institutional channels. This Privacy Policy describes how we process personal data in line with Brazil’s General Data Protection Law (Law No. 13,709/2018 — LGPD), and with other laws that may apply depending on your region (such as the GDPR where relevant).

Using the TodoHub application or our website implies that you have read this policy. Additional rules may apply under the Google Play Store, Apple App Store, or contracts we enter into with you.

1. Controller and contact

The controller of personal data processed in connection with TodoHub is RTec Desenvolvimento de Softwares LTDA, registered with the Brazilian Federal Revenue under CNPJ No. 17.280.026/0001-33.

For privacy requests or questions: privacy@todohub.com, contact@todohub.com, or +55 (11) 97481-5293.

2. Scope of this policy

This policy applies to the TodoHub mobile and web services, authentication flows, push notifications, and our institutional website (including contact channels). Features that rely on Google sign-in or calendar integrations may involve processing by Google under its own terms; when you connect external calendars, their providers’ policies also apply.

3. Data we may collect

Depending on how you use TodoHub, examples include:

Account and sign-in (via Google): identifiers, name, and email address as provided by Google when you choose Google sign-in. We do not collect or store account passwords for TodoHub through this policy’s scope, and we do not collect profile photos for the purposes described here.
Tasks and scheduling: task titles, descriptions, dates, priority, and status; appointment or calendar-related information you create. Data read from or written to a connected Google Calendar is described in detail in Section 5.
Technical data: IP address, device type, operating system, browser or app version, and similar data needed for security, troubleshooting, aggregated metrics, and service operation.

4. Purposes and legal bases

We process personal data to:

Provide TodoHub features (tasks, calendar-related functionality, and related productivity tools);
Sync bidirectionally with Google Calendar when you choose to connect it (read events for planning and write TodoHub-related events to the calendars you enable);
Authenticate users through Google and maintain your account;
Send push notifications when you opt in (via OneSignal);
Process purchases or subscriptions through the Google Play Store or Apple App Store, according to those platforms’ rules;
Meet legal or regulatory obligations;
Protect the security of the service and prevent abuse;
Improve stability and communication channels.

Depending on the situation, we rely on bases such as performance of a contract or preliminary procedures at your request, compliance with a legal obligation, consent where required (for example, optional integrations or notifications), or legitimate interest when compatible with your rights and expectations.

We do not sell your personal data. We do not share data for unrelated third-party advertising as described in this policy.

5. Google user data and Google Calendar integration

Connecting your Google Calendar is optional. This section describes exactly what Google user data TodoHub accesses, how we use it, where we store it, and how you can disconnect it at any time.

5.1 Scopes we request and why

userinfo.email and userinfo.profile — to sign you in and to identify which Google account is connected (login scopes; not used beyond identifying the connected account for calendar sync).
calendar.calendarlist.readonly — to show you the list of calendars you own so you can choose which ones to sync.
calendar.events.owned — to read and write events on calendars you own and select (includes reading events and creating, updating, or deleting TodoHub-related events on those calendars).

You choose which calendars you own to sync. We read events from those calendars to occupy the planner, and we write only TodoHub-related events and changes to synced fixed tasks on those calendars. We do not create calendars, we do not request full Calendar access (auth/calendar), we do not access calendars shared with you by others that you do not own and select, and we do not write to calendars you did not enable.

5.2 Data we access and store

Google account email address.
Calendar identifier, calendar name, and whether it is your primary calendar.
Event data: identifier, title, description, start and end date/time, time zone, all-day flag, recurrence rule (RRULE), recurring-series references, status, and colour. Our servers persist title, start and end date/time (including time zone and all-day flag), and RRULE as needed for synchronization.
Synchronization metadata: sync tokens, change-notification identifiers, and event version identifiers, used to keep the synchronized copy consistent. We do not keep a raw copy of the full event payload returned by Google.
OAuth access and refresh tokens, stored encrypted on our servers so synchronization can continue without asking you to sign in again.

5.3 How we use it

To import your Google Calendar events into TodoHub so you see tasks and commitments in one place.
To treat those events as busy time when TodoHub suggests slots for your tasks — the scheduling engine uses only the start and end times, never the content.
To create, update, and delete events in the Google calendars you enabled, representing TodoHub tasks (fixed tasks with a schedule and placed smart-task projections) so your day is visible without opening TodoHub.
To keep synchronization up to date in both directions: changes in Google Calendar on TodoHub-related events may update the corresponding task in TodoHub, and changes you make in TodoHub are reflected on those calendars.
We do not export reminders, unplaced smart tasks, or the internal smart-task definition (frequency ranges) to Google Calendar. We do not create new calendars.

5.4 Limited Use

The use of raw or derived user data received from Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy and the Google API Services User Data Policy, including the Limited Use requirements.

TodoHub offers AI-assisted features for the tasks you create inside the app. Those requests are processed by a third-party AI provider. Data received from Google APIs — including events read from or written to Google Calendar, and any data derived from them — is excluded from those features by design: it is blocked in code before any AI request is made and is never transmitted to any AI provider.

Specifically:

We do not sell Google user data, and we do not transfer it to third parties except as necessary to operate the bidirectional synchronization feature (read and write), to comply with the law, or as part of a merger or acquisition after obtaining your explicit consent.
We do not use Google user data for advertising, marketing, or ad personalization.
We do not use Google user data — raw, aggregated, or derived — to develop, train, improve, or fine-tune generalized artificial intelligence or machine learning models, and we do not send it to third-party AI providers.
Humans do not read your Google user data, except with your explicit consent for a specific support request, to investigate a security incident or abuse, or where required by law.

5.5 Retention, disconnection, and deletion

Google user data is retained only while your Google account remains connected to TodoHub.
When you disconnect the account in TodoHub, we revoke the OAuth tokens with Google, delete the stored tokens, stop the change subscriptions, and delete the events and synchronization records stored on our servers for that calendar. Events already written to your Google Calendar remain in Google unless you delete them there; TodoHub stops managing them after disconnect.
You can revoke TodoHub’s access at any time at myaccount.google.com/permissions.
Deleting your TodoHub account also deletes the Google user data associated with it on our servers. Residual copies may persist in encrypted backups for a limited period before being overwritten by the backup rotation.

6. Suggestions, rules-based logic, and AI-assisted processing

This section does not apply to Google user data. Raw or derived information received from Google APIs, including Google Workspace APIs, is never used to develop, train, improve, or fine-tune AI or machine learning models, and is never sent to third-party AI providers — see Section 5.

TodoHub may suggest or pre-fill information (for example, titles, times, priorities, categories, or arrangements) based on the tasks and settings you create inside TodoHub. Some processing uses deterministic rules and conventional algorithms; other features may use machine learning or other AI methods. AI-assisted suggestions for those in-app tasks are processed by OpenAI through our self-hosted automation layer. OpenAI does not use data submitted through its API to train its models. We may combine approaches, and the technical mix can evolve as the product improves.

These outputs are assistive: they help you organize your agenda and tasks; they are not a substitute for your own choices. You can review, edit, or disregard any suggestion. We do not aim to make solely automated decisions about you that produce legal or similarly significant effects without your meaningful involvement; where a feature could materially affect you, you stay in control to accept, adjust, or dismiss it.

If the law applicable to you grants specific rights regarding automated decision-making or profiling (for example, explanation, human intervention, or objection), contact us through the channels in Section 10 and we will handle your request in accordance with that law.

7. Sharing of data

We may share data with essential service providers, strictly as needed for the purposes above:

Infrastructure: hosting on virtual servers or cloud/VPS providers (without committing to a specific vendor name);
Authentication: Google, when you use Google sign-in;
Calendar integration: the Google Calendar API, when you choose to connect a calendar;
AI processing: OpenAI, limited to the tasks you create inside TodoHub — never Google Calendar data;
Payments: Google Play Store and Apple App Store handle payment processing for in-app purchases and subscriptions under their terms;
Communications: OneSignal for push notifications.

Google user data is not part of this sharing. It is not sent to OneSignal, OpenAI, or any other AI provider, and it is not shared with third parties beyond the infrastructure strictly required to operate the synchronization feature, as described in Section 5.

International transfers may occur when providers or platforms operate outside Brazil. When required, we use safeguards compatible with applicable law.

8. Security and retention

We adopt reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or improper alteration. Specific technologies may evolve over time; we do not warrant a particular encryption standard in this document.

We keep data for as long as necessary for the purposes stated, to comply with legal obligations, or to defend rights in administrative or judicial proceedings. Indicative periods: account-related data while your account is active; user content may be retained for a short grace period after closure where needed for deletion or backup cycles; access logs for a limited period consistent with security needs; records related to transactions may be kept as required by tax or commercial law (often several years where applicable).

Retention and deletion of data received from Google APIs follow the specific rules in Section 5.5.

9. Your rights

Subject to LGPD and other applicable laws, you may request confirmation of processing, access, correction of incomplete or inaccurate data, anonymization, deletion or portability where applicable, information on sharing, and withdrawal of consent when consent is the legal basis, among other statutory rights.

Where those laws provide rights related to automated processing or profiling (including explanation or review), you may exercise them through the same contact channels, subject to verification and legal limits.

10. How to exercise your rights and contact information

To exercise your rights, contact us at privacy@todohub.com or contact@todohub.com, or call +55 (11) 97481-5293. We may ask for reasonable information to verify your identity before fulfilling a request.

General and privacy-related inquiries use the same channels: privacy@todohub.com and contact@todohub.com.

11. Location of processing

Data may be processed and stored in Brazil (São Paulo), the United States, and Europe. We do not specify individual regions or data centers in this policy.

12. Cookies and similar technologies

Our website may use cookies or similar technologies for basic operation or analytics (for example, through tags such as Google Tag Manager / analytics tools). You can manage preferences in your browser; additional consent mechanisms may be added over time and this policy may be updated accordingly.

13. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. Please revisit this page periodically. The last update date is shown at the top of this document.