Privacy
What Co-Do List holds about you, who else can see it, where it is kept, and how to get rid of it.
Last updated 27 September 2026.
The short version
- There are no adverts, no analytics and no tracking. Nothing about you is sold, shared for marketing, or used to build a profile. There is no cookie banner because there is nothing to consent to.
- Your lists are not encrypted end-to-end. They are stored as ordinary text in the database, which means the database provider and, in principle, the person running this service can read them. That is a real trade-off and it is explained below.
- You can take everything with you and delete the lot, at any time, without asking anybody.
What is held, and why
Because you have an account
| What | Why |
|---|---|
| Email address | It is what signs you in and what recovers your password. It is never shown to other users and never used for marketing. |
| Password | Stored only as a cryptographic hash. Nobody, including me, can read it back. |
| Username | How other people share a list with you. It is visible to anyone you share a list with. |
| Time zone | Read from your device so that a deadline of “9am” means 9am where you are. Needed because reminders are sent by a server, not by your phone. |
| Sign-in records | When you signed up and signed in, and the IP address and browser each sign-in came from. Kept by the authentication service to spot abuse, and deleted after 90 days without use. |
Because you keep lists
| What | Why |
|---|---|
| Your lists | Every task, note, tag, deadline and timer, and the name of each list. This is the service. |
| Your look | Colours, background and any logo you upload. An uploaded image is stored in the list so it follows you to your other devices. |
| Saved templates | Lists you have saved to start again from, held on your account so one saved on a phone is there on a computer. |
| Who shares what | Which accounts can see which list, and the private name each person has given it. |
Only if you turn them on
| What | Why |
|---|---|
| Reminders | A notification address for that one device and the keys used to encrypt a message to it, plus a record of which reminders have already been sent so that you are not told twice. |
| Calendar feed | A random token that makes the feed address for one list. |
| Clash warnings | If you connect Google or Microsoft, the app reads only free/busy times, never event titles. The access token stays in your browser tab, is never sent to this service, and is gone when you close the tab. |
Why this is allowed
Under UK GDPR the lawful basis for all of the above is performance of a contract: you asked for an account and these are the things needed to give you one. Keeping sign-in records to spot abuse rests on legitimate interests: keeping the service working for the people using it.
There is no marketing, no profiling and no automated decision-making of any kind.
What I can see
This is the part worth reading twice. Your lists are stored as ordinary text, not scrambled in a way that only your device can undo. That is what lets a server read a deadline and send you a notification, lets sharing be one step, and lets a forgotten password be an inconvenience rather than the end of your list.
The cost of it is real: the database provider holds your tasks in a readable form, and so, in principle, do I. I do not read them, and nothing is set up to. But that is a promise rather than a mathematical guarantee, and you should know which of the two you have been given. Do not keep anything in a list that would genuinely hurt you if somebody else read it.
Who else is involved
Running this needs a handful of other companies. Each is bound by a data processing agreement, acts only on instructions, and is listed here with what it actually sees.
| Who | What they see | Where |
|---|---|---|
| Supabase | The database and sign-in: everything in the tables above. | Ireland |
| Netlify | Serves the pages and runs the reminder and calendar code. Sees request logs, including IP addresses. | United States |
| Resend | Sends password-reset and reminder emails, so sees the address and the message. | United States |
| Your browser's push service | Apple, Google or Mozilla, depending on your browser. Carries reminders to your device. The contents are encrypted to your device, but the service knows a message was sent and when. | Varies |
Nobody else. No analytics provider, no advertising network, no data broker, and nothing loaded from anybody else's server, so opening the app tells no third party that you did.
Where your data is kept
The database is hosted in Ireland. Transfers from the UK to Ireland need no special arrangement, because the UK recognises the European Economic Area as offering equivalent protection.
Netlify and Resend are United States companies. Both are certified under the UK Extension to the EU–US Data Privacy Framework. Supabase is a United States company operating an Irish database; its agreement uses the European Commission's Standard Contractual Clauses together with the UK Addendum.
Sharing a list, and feed links
When you share a list, the person you share it with can see everything in it and can change it. That is what sharing means here, and there is no read-only sharing. You can remove somebody at any time from Manage lists.
A calendar feed address is a secret link: anyone who has it can read that list's deadlines and notes without signing in. Treat it like a password, and use Revoke in Manage lists if it goes somewhere it should not have.
What is kept on your device
The app stores a copy of your lists in your browser so it opens instantly and works with no signal, along with small preferences: which list you had open, your theme, your volume, your timer settings. None of this is sent anywhere, none of it identifies you, and it is all cleared if you clear the site's data.
There are no advertising or analytics cookies, which is why you are not asked to agree to any.
How long it is kept
Your lists stay until you delete them. Your account stays until you delete it.
A sign-in's record, including the IP address and browser it came from, is deleted after 90 days without being used, or straight away when you sign out or delete your account. Opening the app counts as using it, so a device you use keeps you signed in and one left in a drawer does not.
Deleting your account, in the cog menu under Delete account, immediately removes your profile, the lists you own, your memberships of other people's lists, your reminder settings and your calendar feed tokens. It cannot be undone, and lists you own go for everybody they were shared with, so export a backup first if you want one.
Two things outlive that by a short period, because they are not in the database: the automatic backups the database provider takes, which are kept for up to seven days before being overwritten, and the server request logs and email-delivery records held by Netlify and Resend under their own retention periods. Neither is used for anything.
Your rights
Under UK GDPR you can ask to see a copy of your data, to correct it, to have it deleted, to have it handed to you in a portable form, and to object to or restrict what is done with it. Two of those you can do yourself, straight away and without asking:
- A copy of everything: cog menu, Export backup. It is a plain JSON file holding your lists in full.
- Deletion: cog menu, Delete account.
For anything else, write to privacy@co-do.app and you will get an answer within one month. If you are not happy with the answer you can complain to the Information Commissioner's Office at ico.org.uk, though I would rather you told me first and gave me the chance to fix it.
Children
Co-Do List is not intended for children under 13, and accounts should not be created by them. A parent is welcome to share a list with a child on the parent's own account. If you believe a child under 13 has an account, write to privacy@co-do.app and it will be removed.
Who is responsible, and how to reach them
Co-Do List is run by Paul Everatt, an individual in the United Kingdom, who is the data controller for everything described on this page. Write to privacy@co-do.app about any of it, including any of the requests above.
If this changes
The date at the top says when this was last altered. Anything that materially changes what is collected or who sees it will be said plainly in the app before it takes effect, not slipped into a new version of this page.