Privacy Policy

Back

To Today — Privacy Policy

Effective Date: March 5, 2026 Operator: METALOOP LTD (Hong Kong) Contact: [email protected]

1. Introduction

METALOOP LTD ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use To Today (the "Service").

By using the Service, you agree to the data practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

  • Account information: Email address and password (stored encrypted) provided at registration.
  • Profile information: Display name, avatar emoji (optional).
  • User content: Tasks (title, notes, due dates, priority, category, recurrence rules, etc.), Quick Notes (daily journal and frequently-used records).
  • Language preference: Your selected interface language.

2.2 Information Collected Automatically

  • Browser push subscription data: Used to send task reminder notifications (collected only after you grant permission).
  • Device and browser information: Browser type, operating system, and other basic environment data used for troubleshooting.
  • Log data: Service access logs used for security monitoring and performance optimization; not used to identify individuals.

2.3 Information We Do Not Collect

  • We do not collect your full name, phone number, national ID, or other sensitive identity information.
  • We do not track your geographic location.
  • We do not embed third-party advertising trackers in the Service.

3. How We Use Your Information

We use your information only for the following purposes:

| Purpose | Information Used | |---------|-----------------| | Providing and maintaining the Service | Account information, user content | | Sending task reminders | Push subscription data, reminder settings | | Account security and authentication | Email address, password (encrypted) | | Service improvement and troubleshooting | Log data, device information | | Sending important service notices (e.g., policy updates) | Email address |

We do not use your personal information for advertising or sell it to third parties.

4. Data Storage and Security

  1. Storage location: Your data is stored using Supabase database services (servers located in the United States). The Service is deployed via Vercel, with edge nodes distributed globally.
  2. Data security: Data is transmitted over HTTPS. Passwords are processed using secure one-way hashing by our authentication provider and cannot be reversed or retrieved in plaintext.
  3. Access control: User data is isolated by account. Only you and project group members you have authorized can access the relevant data.
  4. Data deletion: To request deletion of your account and associated data, please email [email protected]. We will process your request within 30 business days of receipt, except where retention is required by law.
  5. Security measures: While we implement reasonable technical and organizational safeguards, no internet transmission is 100% secure, and we cannot guarantee absolute data security.

5. Sharing and Disclosure

We do not sell, rent, or otherwise provide your personal information to third parties, except in the following circumstances:

  1. Infrastructure providers: We use service providers such as Supabase (database) and Vercel (hosting) to operate the Service. These providers access your data only to the extent necessary to deliver their services and are subject to their own privacy policies.
  2. Legal requirements: When disclosure is required by law, regulation, or a valid government order.
  3. Protection of rights: When necessary to protect the legitimate rights and interests of METALOOP LTD, our users, or the public.
  4. Your consent: In other circumstances where you have given explicit consent.

6. Cookies and Local Storage

The Service uses the following local storage technologies:

  • Session cookies: To maintain your logged-in state.
  • LocalStorage: To save form drafts, interface preferences, and other local state. This data resides only on your device.

We do not use third-party tracking cookies.

7. Children's Privacy

The Service is not directed to users who do not meet the minimum age required by the laws of their jurisdiction. We do not knowingly collect personal information from such users. If you believe we may have inadvertently collected such information, please contact us at [email protected] and we will promptly delete it.

8. Your Rights

You have the following rights regarding your personal data:

  • Access: You can view your stored account information in the profile panel.
  • Correction: You can update your display name, avatar, and language preference at any time within the app.
  • Deletion: You may request deletion of your account and personal data by emailing [email protected]. We will process your request within 30 business days.
  • Data export: To request an export of your data, please email [email protected]. We will respond within a reasonable timeframe.
  • Withdraw consent: You may revoke push notification permission at any time through your browser settings.

To exercise any of these rights, please contact [email protected].

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice with reasonable advance notice. Continued use of the Service following any update constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

10. Contact Us

For questions about this Privacy Policy or any privacy-related requests, please contact:

Email: [email protected] Operator: METALOOP LTD

Last updated: March 5, 2026