Privacy Policy

Last Updated: September 11, 2026

1. Introduction & Data Controller

This Privacy Policy describes how Unforgettable Management Ltd ("we," "us," or "our"), as the Data Controller, handles information when you access or use 123 ToDo via our website (123todo.com), web application (app.123todo.com), or Progressive Web App (PWA) (collectively, the "Service").

Unlike conventional SaaS productivity applications that ingest, index, and store your life's schedule on centralized cloud databases, 123 ToDo is built as a local-first, client-side web application. This document explains the precise technical mechanisms used to protect your privacy across all application features.

2. Technical Architecture & Data Storage Breakdown

A. Core Task, Note & Preference Data (Local Storage)

• Storage Engines: Your task titles, detailed notes, creation timestamps, completion timestamps, subtasks, project assignments, and UI preferences (such as light/dark mode, date formats, task character limits, and swipe gesture bindings) are stored exclusively within your web browser's local databases (primarily IndexedDB and LocalStorage).
• Domain Isolation: Web browsers enforce strict same-origin security policies. Your 123 ToDo data cannot be inspected or read by any other website or domain.
• Zero Server Transmission: Under standard operation, your unencrypted task and note data is never transmitted to, routed through, or stored on our servers.

B. Photo Attachments (Local Client Storage)

• In-Browser Processing: When you snap a picture with your device camera or attach an image from your library, the image file is processed and compressed client-side (using an in-memory HTML5 Canvas element) directly within your browser.
• IndexedDB Persistence: Compressed photos are stored locally in your browser's IndexedDB. They are not uploaded to any central media server.
• Encrypted Sync Payload: If you enable optional cloud sync, attached photos are encrypted client-side alongside your task data before transmission.

C. Voice Dictation ("Talk" Feature)

• Native Browser Web Speech API: The "Talk" dictation feature operates using your browser's native W3C Web Speech API (such as webkitSpeechRecognition or SpeechRecognition).
• Zero 123 ToDo Audio Handling: 123 ToDo does not run audio servers, audio streaming gateways, or speech-to-text transcription servers. Voice audio captured during dictation is handled directly by your browser engine or operating system (e.g., Apple Speech Recognition on iOS/macOS, or Google Speech Services on Chrome/Android) subject to your device's platform privacy settings.
• Live Text Append Only: 123 ToDo only receives the resulting finalized text string emitted by your browser, which is inserted directly into your local task title or notes field.

D. Automated Local Shadow Backups & Photo Storage

• To safeguard against accidental user edits, 123 ToDo automatically creates localized daily snapshot backups.
• These shadow snapshots reside exclusively in protected local storage within your own browser on your device, and are never transmitted across the network unless you explicitly enable zero-knowledge cloud sync.
• Photo attachments are compressed and handled entirely client-side: high-resolution image binaries reside in your browser's private IndexedDB database (123TodoPhotoDB), while visual thumbnails are preserved in your local shadow backups.

E. Actionable Links (Telephone & Email)

• Telephone Links (tel:): Clicking a detected phone number hands the number directly to your device's native phone dialer. No telephony logs are recorded.
• Email Links (mailto: / Webmail): Clicking an email address opens your operating system's default email client or routes to your configured webmail provider (e.g., Gmail, Outlook, or Yahoo Mail) in a new browser tab. No email metadata or drafts are intercepted or stored by 123 ToDo.

3. Optional Multi-Cloud Sync — Zero-Knowledge Cryptography

If you choose to sync your tasks and notes across multiple devices, 123 ToDo provides optional integration with Cloudflare Workers KV, Google Drive, or custom WebDAV servers.

• End-to-End Zero-Knowledge Encryption (E2EE): All synchronization payloads are encrypted on your device prior to leaving your browser using authenticated AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode).
• Cryptographic Key Derivation: Your encryption key is derived locally in your browser using PBKDF2 (Password-Based Key Derivation Function 2) with SHA-256, utilizing a cryptographically random salt and a high iteration count (100,000+ rounds).
• Zero Server Visibility: Your master encryption passphrase is never transmitted across the network, never sent to our servers, and never saved in unencrypted cloud files. The storage endpoints (whether Cloudflare, Google Drive, or WebDAV) only ever receive and store opaque, undecryptable ciphertext blobs.
• Google OAuth 2.0: If you use Google Drive Sync, authentication is handled directly through Google Identity Services. We only request scoped permission to read and write a dedicated application file in your personal Google Drive. We never receive or store your Google password.

4. Information We Do NOT Collect

To provide absolute clarity, 123 ToDo does NOT collect, harvest, monitor, or monetize any of the following:

• No Personal Identifiers: No names, email addresses, phone numbers, or physical addresses are required to use the app.
• No Account Credentials: No master passwords, usernames, or security questions.
• No Task Content or Photos: We cannot view what you write, plan, schedule, or photograph.
• No Third-Party Analytics Trackers: We do not embed Google Analytics, Mixpanel, Amplitude, Hotjar, or any behavioral tracking SDKs.
• No Advertising Trackers or Pixels: No Meta Pixel, TikTok Pixel, Google Ads remarketing tags, or third-party ad networks.
• No Browser Fingerprinting: We do not collect canvas hashes, audio context signatures, font lists, or battery status.
• No Sale of Data: We have never sold, and will never sell, lease, or monetize user data.

5. Cookies & Local Browser Storage

123 ToDo does not use tracking cookies or marketing cookies.

We do not set first-party tracking cookies or permit third-party advertising cookies. As detailed above, the application utilizes modern HTML5 client storage mechanisms (IndexedDB, LocalStorage, and Cache Storage via Service Workers) strictly for essential functionality: persisting your tasks locally, remembering your UI theme, and enabling offline Progressive Web App (PWA) operation without internet connectivity.

6. Edge CDN Infrastructure & Ephemeral Logs

When you load the static files of 123 ToDo (HTML, JavaScript, CSS, and SVG icons), requests are routed through Cloudflare's global content delivery network (CDN).

Like all web infrastructure, Cloudflare edge nodes process standard, transient HTTP request headers (including your IP address and user-agent) solely for the purposes of content caching, SSL termination, and mitigating automated DDoS attacks. These technical network logs are managed by Cloudflare in accordance with their strict privacy standards, are retained only ephemerally for security analysis, and are never correlated with user activity or task contents.

7. Future Monetisation & Payment Information Disclosures

While 123 ToDo is currently free to access, Unforgettable Management Ltd reserves the right to introduce optional paid features, subscriptions, or commercial tiers in the future.

Third-Party Payment Gateways: In the event that commercial services, subscription tiers, or paid licenses are introduced:

• All financial transactions and payment processing will be handled entirely by established, certified PCI-DSS Level 1 compliant third-party payment processors (such as Stripe, Lemon Squeezy, or official platform app stores).
• Zero Financial Data Retention: Unforgettable Management Ltd will never collect, process, or store your raw credit card numbers, debit card details, CVV codes, or bank account credentials on our servers.
• Any transition to paid services will be accompanied by updated commercial disclosures, and users will always retain the free right to export all their existing data prior to changes taking effect.

8. Your Rights Under GDPR, UK GDPR, and CCPA / CPRA

Depending on your location, you hold statutory rights under data protection legislation, including the General Data Protection Regulation (EU GDPR), the UK Data Protection Act 2018 (UK GDPR), and the California Consumer Privacy Act (CCPA/CPRA).

Because 123 ToDo operates on a decentralized, local-first architecture, your rights are fulfilled instantaneously through self-service app features:

• Right to Access & Portability: You can access your complete data at any second directly within the interface, or click Settings ⚙️ ➔ Import / Export Data ➔ Export Backup to instantly generate and download a complete, unencumbered JSON copy of your entire dataset.
• Right to Erasure ("Right to Be Forgotten"): You can permanently erase all local tasks, notes, and photos at any time by clearing your browser's site data / cache, or by tapping "Clear All Data" in settings. For cloud sync, you can delete your sync file or revoke access directly with your provider.
• Right to Rectification: You can edit, modify, or correct any task, note, or timestamp directly within the app.
• Right to Non-Discrimination: We do not discriminate against any user for exercising their privacy rights.

9. Children's Online Privacy Protection (COPPA)

123 ToDo does not knowingly collect, solicit, or maintain personal information from children under the age of 13 (or under 16 in the European Union). Because the application collects no personal identifiers or account registrations from any user, it is fundamentally safe for users of all ages.

10. Data Security & User Responsibilities

While we implement strict cryptographic zero-knowledge standards for cloud sync, the security of your local data depends on your device security:

• Device Passcodes & Biometrics: Ensure your phone, tablet, or computer is protected by a strong passcode, PIN, or biometric lock (Face ID, Touch ID, fingerprint), preventing unauthorized physical access to your browser's local databases.
• Shared Computers: If using a shared or public computer, always use a separate OS user profile or clear your browser data upon completion.
• Passphrase Stewardship: Because cloud sync encryption keys are derived mathematically from your passphrase, you are solely responsible for safeguarding your passphrase. If lost, your synced data cannot be decrypted by anyone.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect new features, operational enhancements, or legal requirements. Any modifications will be published directly to this page with an updated "Last Updated" date. We encourage you to review this policy periodically.

Our foundational architectural commitment will remain unchanging: We will never sell your data, deploy user tracking scripts, or compromise our local-first, zero-knowledge privacy architecture.

12. Contact & Data Protection Inquiries

If you have questions, feedback, or concerns regarding this Privacy Policy or our privacy practices, please contact us: