Privacy Policy

1. Introduction

This Privacy Policy explains how 123 ToDo, operated by Unforgettable Management Ltd ("we," "us," or "our"), handles your information. Unlike most privacy policies that explain what data is collected, ours explains what we DON'T collect — and is transparent about the limited, user-controlled data that optionally flows through Google Drive Sync.

2. Information We DON'T Collect

123 ToDo does not collect, store, transmit, or process any of the following:

• Personal information - No names, emails, phone numbers, or addresses
• Account data - No usernames, passwords, or login credentials (Google OAuth is handled directly by Google)
• Task data - Your tasks, notes, and todos are never sent to our servers in any form
• Usage analytics - No tracking of how you use the app
• Device information - No device IDs, operating system info, or hardware details
• Location data - No GPS coordinates or location tracking
• Browser data - No cookies, fingerprinting, or tracking pixels
• IP addresses - No logging of your network information

3. How Your Data Is Stored

123 ToDo uses a layered, privacy-first storage approach:

Local Storage (Default — All Users)

• Your tasks are stored in your browser's localStorage and IndexedDB
• Data never leaves your device unless you explicitly enable Google Drive Sync
• We have zero access to your locally stored data
• Clearing browser data will delete your local tasks permanently

Shadow Backups (Automatic — All Users)

• A secondary copy of your data is maintained automatically within your browser
• This exists entirely on your device and is not transmitted anywhere
• It provides a safety net against accidental data loss within the same browser

Google Drive Sync (Optional — User-Initiated)

• If you choose to enable Google Drive Sync, your data is encrypted on your device using AES-256 encryption with a passphrase only you know, before being uploaded to your personal Google Drive
• We never receive, see, or store your unencrypted task data or your passphrase
• The encrypted file is stored in a dedicated folder in your Google Drive account — not ours
• This feature requires you to sign in with your Google account via OAuth 2.0 — a standard, secure authentication method managed entirely by Google
• You can revoke 123 ToDo's Google Drive access at any time via your Google Account security settings
• Data stored in your Google Drive is subject to Google's Privacy Policy

4. No 123 ToDo Servers — What This Really Means

123 ToDo operates entirely client-side in your browser. We do not operate:

• Application servers that process your task data
• Database servers that store your information
• Analytics servers that track your usage
• Cloud storage services for your tasks (Google Drive Sync uses your Google Drive, not ours)

The only server interaction with our infrastructure occurs when your browser initially loads the app's static files (HTML, CSS, JavaScript). After that, everything runs locally. Google Drive Sync communicates directly between your browser and your Google Drive — we are not an intermediary.

5. Third-Party Services

123 ToDo's core app does not integrate with any third-party tracking or analytics services. Specifically, we do not use:

• Analytics services (Google Analytics, Mixpanel, etc.)
• Advertising networks
• Social media tracking pixels
• Payment processors (the app is completely free)
• Email marketing services

Google Drive (optional sync only): If you enable Google Drive Sync, your browser communicates with Google's APIs to store your encrypted data in your personal Google Drive. This is governed entirely by Google's Privacy Policy and Terms of Service. We only request the minimum OAuth permissions necessary to read and write a dedicated sync file in your Drive.

6. Progressive Web App (PWA) Functionality

When you install 123 ToDo as a PWA, the app uses service workers to enable offline functionality. Service workers cache the app's files locally on your device so it works without internet. This caching happens entirely on your device and does not transmit data to our servers.

7. Export/Import & Backup Features

123 ToDo provides multiple ways to manage and protect your data:

• Manual Export: Download your tasks as a JSON file saved directly to your device — no data transmitted to us
• Manual Import: Restore from a previously exported file or import tasks from Todoist CSV — processed locally on your device
• Google Drive Sync: Automatic encrypted backup and cross-device sync via your own Google Drive (opt-in)
• Shadow Backup: Automatic local redundancy within your browser

8. Data Security & Encryption

Your data security depends on the storage method you choose:

Local Storage

• Isolated per domain — only 123todo.com can access its own localStorage data
• Cannot be accessed by other websites
• Remains on your device unless you explicitly clear it
• Security is as strong as your device's own security (screen lock, passwords, biometrics)

Google Drive Sync

• Data is encrypted on-device using AES-256 zero-knowledge encryption before upload
• Only you — with your passphrase — can decrypt it. Not even Google can read it
• Your passphrase is never transmitted, stored, or recoverable by us

Security Note: If someone gains physical or remote access to your unlocked device and browser, they could potentially access your local localStorage data. Keep your device secure with passwords and biometrics. For enhanced security across devices, Google Drive Sync provides encrypted cloud storage that requires your passphrase to access.

9. No Cookies

123 ToDo does not use cookies of any kind:

• No session cookies
• No authentication cookies
• No tracking cookies
• No third-party cookies

Google OAuth authentication for Drive Sync uses Google's own secure session management — not cookies set by us.

10. Children's Privacy

Because we don't collect any personal data, 123 ToDo is safe for users of all ages, including children under 13. We comply with COPPA (Children's Online Privacy Protection Act) by virtue of not collecting any personal information from anyone.

11. GDPR Compliance

For users in the European Union, 123 ToDo is fully GDPR-compliant because:

• We don't process or control any personal data on our servers
• No consent is needed for the core app (nothing to consent to)
• Google Drive Sync is entirely opt-in and can be revoked at any time
• No data subject access requests are necessary (we have no data)
• No data portability issues (your data stays in your hands)
• No right to erasure concerns (you control deletion via browser settings and Google Drive)

12. California Privacy Rights (CCPA)

For California residents, 123 ToDo complies with CCPA because:

• We don't sell personal information (we don't have any)
• We don't collect personal information for business purposes
• No opt-out mechanisms are needed (nothing to opt out of)

13. Data Breaches

Because we don't collect or store user data on our servers, there is no centralized data that could be breached by us. Your local data security depends entirely on your device security. Your Google Drive Sync data is protected by AES-256 encryption, meaning that even if your Google Drive were compromised, your task data would be unreadable without your passphrase.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

However, our core privacy principle will never change: We will never collect, store, or transmit your personal data to our own servers.

15. Transparency

123 ToDo is built with transparency in mind. You can inspect the source code to verify that we're not tracking or collecting data. We encourage technical users to review the code and hold us accountable.

16. Your Control Over Data

You have complete control over your 123 ToDo data:

• Export - Download your tasks as JSON anytime
• Delete Local - Clear browser data to remove all local tasks
• Google Drive Sync - Encrypted automatic backup and cross-device sync (opt-in)
• Revoke Google Access - Remove 123 ToDo's Drive access via your Google Account settings at any time
• Transfer - Move data between devices using export/import or Google Drive Sync
• Access - View all your data directly in the app

17. Contact

If you have questions about this Privacy Policy or how 123 ToDo handles data, please visit our website at www.123todo.com.

18. Legal Basis

Because 123 ToDo does not collect or process personal data on our own servers, we do not require a legal basis for data processing under privacy regulations like GDPR. The optional Google Drive Sync uses your explicit consent (opt-in) as its legal basis for processing, which you may withdraw at any time.