Privacy Policy

Last updated: 15 September 2026

To the owner — fill these in before launch. They are facts only you know, so they are left blank rather than guessed: legal entity name, business address, and the contact email you want customers to use. Search this page for the highlighted boxes.

Atomic ToDoList ("the Service") helps you set a mission, break it into goals and milestones, and track the daily todos that get you there. This policy explains exactly what we store, why, and how you get it back or delete it.

The Service is operated by [LEGAL ENTITY NAME], [BUSINESS ADDRESS]. Contact: [SUPPORT EMAIL].

1. What we collect

We collect only what the Service needs to work. There is no advertising and no tracking pixels.

Data	Why
Email address and, if you sign in with Google, your Google account's basic profile	To identify your account and sync your plan across devices
Your plan — mission, goals, milestones, todos, fixed blocks, season dates	This is the content of the Service
Your execution log — which todo you checked off, on which date, and when	Progress is calculated from what you actually did
Push notification subscription (a browser-issued endpoint and keys) and your scheduled alerts	Only if you turn on alerts. Needed to deliver them when the app is closed
Subscription status, trial end date, and Paddle customer/subscription identifiers	To know whether your subscription is active

We never receive your card details. Payments are handled by Paddle, which acts as the merchant of record and is a separate data controller for payment information. See Paddle's privacy policy.

We do not currently run analytics or third-party trackers. If that changes, this page will be updated before the change takes effect.

2. Data stored on your device

The Service is offline-first. Your plan and execution log are kept in your browser's local storage so the app opens and works without a network connection, and are synchronised to our servers when you are signed in. Clearing your browser data removes the local copy; the synced copy remains until you delete your account.

3. Where your data is stored

Application data is stored in a PostgreSQL database hosted by Supabase in the ap-northeast-2 (Seoul, South Korea) region. Static files are served by Vercel's content delivery network. If you access the Service from outside South Korea, your data is transferred to and stored in South Korea.

4. Who else processes your data

Processor	Purpose
Supabase	Database, authentication, sending sign-in emails, delivering alerts
Vercel	Hosting the application files
Google	Sign-in with Google, if you choose it
Paddle	Payments, invoicing and tax, as merchant of record

We do not sell your data and we do not share it for advertising.

5. Keeping your data separate from other users'

Every row of your data is tagged with your user ID and protected by database-level row security, so one account cannot read or modify another account's data even if the application code is bypassed.

6. How long we keep it

Your plan and execution log are kept until you delete them or delete your account. Scheduled alerts older than two days are purged automatically. When you delete your account, your data is removed from our database immediately; routine encrypted backups may retain copies for a short period before rotating out.

7. Your rights

Depending on where you live you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object to processing or lodge a complaint with a supervisory authority. Two of these are built into the app and need no request:

Export — ⋯ → Account → Download all my data gives you a complete JSON file of your plan and execution log. This works even if your subscription has lapsed.
Delete — ⋯ → Account → Delete account permanently removes your account and all associated rows. This cannot be undone.

For anything else, contact [SUPPORT EMAIL].

8. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

9. Security

Data is transmitted over HTTPS and stored on managed infrastructure with access controls and row-level isolation. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority where the law requires it.

10. Changes to this policy

We will update the date at the top when this policy changes. If a change materially affects how we handle your data, we will tell you in the app before it takes effect.