Privacy Policy

Questnut is a todo app: your lists, drawn as sticky notes, beside a calendar that plans time for your tasks. This policy says what Questnut keeps about you, what it never keeps, who else handles it, and how to delete it. "We" means [TO CONFIRM: operator's name], who runs Questnut; "you" means you.

1. What we keep

Your account.

• Your email address, so you can sign in.
• Your name, and your profile picture link if you sign in with Google.
• Your password, if you made one. It is stored only as a salted hash, never as the password itself.
• When your account was made and how (password or Google).

What you write. Your goals, lists, tasks, notes, labels, events, and files you attach to tasks (up to 10 MB each). Also your settings, such as reminders, your week's template, and when you plan to work.

Your connected calendars. For each one: which provider it is, a label for the account, the calendar's name and id, and the credential that lets Questnut reach it. We also keep the ids of events Questnut put there, so it can update them. We don't keep the contents of your calendar (see section 4).

Reminders. If you turn on reminders, we store your browser's push address, so we can send them.

Error reports. When something fails in the app, your browser tells us. A report includes what failed, the page, the name of the button pressed just before, and when it happened. Ids are replaced, and anything quoted and any email address are taken out of the message first.

Server logs. Like any web server, ours records each request, including your IP address and browser. Our own log lines name accounts and items by id, never by what you wrote or your email address.

On your device. The app keeps you signed in with tokens saved in your browser's local storage. It saves nothing you wrote on your device; that stays on our servers. We don't use advertising or tracking cookies, and this website sets no cookies at all.

2. How it's protected

Everything you write is encrypted before it's stored, so a stolen copy of our database can't be read. That covers the titles and descriptions of your tasks and lists, event names, notes and locations, label names, file names and the files themselves, your name and picture link, and your calendars' names and ids. Each value is encrypted separately with AES-256-GCM.

The keys are kept apart from the database, in Google Cloud's Secret Manager and Cloud KMS, and the app won't start against a real database without them. The credentials for your connected calendars are encrypted with a separate key ring that only the running app can unlock.

Your email address is not encrypted, because sign-in has to look it up.

What this does and doesn't mean: the app itself has to read what you wrote to show it to you and to put it on your calendar, so this is not end-to-end encryption. It protects your data if the database alone is ever stolen, for example from a backup or a leaked password.

3. How we use it

• To run Questnut for you: show your lists, plan your tasks into time, send your reminders and keep your connected calendars in step.
• To send you email about your account (see section 6).
• To find and fix what breaks, from error reports and logs.
• To learn how the app is used, from anonymous counts (section 7).

We don't sell your data, rent it, use it for advertising, or use it to train AI models. Nobody at Questnut reads what you wrote, unless you ask us to look at a specific problem, it's needed to investigate security or abuse, or the law requires it.

4. Connected calendars

You can connect Google Calendar, Microsoft Outlook or Apple Calendar. A calendar you connect stays yours; Questnut reads it to show your events beside your lists, and writes to it only the time you plan in Questnut and the changes you make there.

Never stored. Events on a connected calendar are read from the provider each time you look, and Questnut keeps no copy of their titles, times, attendees or anything else. The only things kept are the ids of events Questnut itself put on your calendar, so it can update them.

What Questnut writes there. When you plan time or run a session on a list that saves to a connected calendar, Questnut adds it as an event there. For each list you choose what that event is called: the task's own words (the default), the list's name, or only the goal's name. If you edit or delete one of your calendar's events inside Questnut, Questnut makes that change on the calendar.

What each provider is asked for:

• Google Calendar: your email address and https://www.googleapis.com/auth/calendar.events, to see, add, change and delete events on your primary calendar. Questnut doesn't ask to manage your calendars themselves or their sharing.
• Microsoft Outlook: your email address, Calendars.ReadWrite (to read and write events on your default calendar) and offline_access (so it keeps working while you're away).
• Apple Calendar: Apple has no sign-in for this, so you give Questnut your Apple ID and an app-specific password you create at appleid.apple.com, and pick which calendars to connect. The password is encrypted; you can revoke it at appleid.apple.com at any time.

Signing in with Google is separate from connecting Google Calendar. It shares only your name, email address and profile picture, and gives Questnut no access to your calendar.

You can disconnect a calendar in Settings → Connected calendars at any time, and you can also remove Questnut's access from your Google, Microsoft or Apple account settings.

5. Google user data and Limited Use

Questnut's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data Questnut receives from Google Calendar:

• is used only to show your events in Questnut and to add, change or delete the events you ask it to;
• is not stored, apart from the ids of events Questnut created;
• is not transferred to anyone else, except as needed to run the app (section 6), to comply with the law, or as part of a merger or sale of Questnut with notice to you;
• is never used for advertising, never sold, and never used to train AI or machine-learning models;
• is never read by a person, unless you ask us to look at a specific problem and agree to it, it's needed for security or abuse investigation, or the law requires it.

6. Who else handles your data

We use a few services to run Questnut. Each gets only what its job needs.

Reminders say as little as you choose. By default a reminder names nothing: it says only "Something starts at 3:00 PM". You can choose, per list, to show its goal, the list's name or the task.

Email. Questnut sends email only about your account: the link to confirm your address, the link to reset your password, and a note when your account is deleted. No newsletters or marketing.

Your data is stored and processed in the United States.

7. Anonymous usage counts

To learn how Questnut is used, the app counts things like "a task was made", "a session was started" and "the phone was used", by the hour. A count says how many times, never what the task or list was, and is filed under a scrambled key that can't be matched to your account without our servers. We only share numbers drawn from 20 or more accounts.

This is on by default. To turn it off, go to Settings → Account and switch off Share anonymous metadata. Turning it off also deletes the counts already kept for your account.

8. Keeping and deleting

We keep your data while you have an account. In Settings → Account you can delete it two ways:

Delete account. Your account closes at once: you're signed out everywhere, and no reminders or planning run for it. Everything is kept for 60 days, so if you sign in again in that time you can restore it exactly as it was. After 60 days it is deleted for good.

Delete account and data. Everything is deleted now. This can't be undone.

Either way, we email you to say it's done. A few things are kept after an account is gone, none of them anything you wrote:

• A record that the account existed: when it was made and deleted, how you signed up, and which of the four goals you picked. It no longer has your email address.
• Error reports, which carry an account id that no longer leads anywhere.
• Anonymous usage counts. After "Delete account", once the 60 days are up, these are re-filed under a scrambled form of your email address, so if you sign up again with it your history comes back with you. "Delete account and data" deletes them too.

Backups. Our database provider keeps a short history for recovery, so deleted data can remain there, encrypted, until that history rolls over.

9. Your choices and rights

• See and change what you wrote, at any time, in the app.
• Turn off anonymous usage counts in Settings → Account.
• Choose what reminders and connected calendars say, for each list.
• Disconnect a calendar in Settings → Connected calendars.
• Delete your account, with or without its data, in Settings → Account.
• Ask us for a copy of your data, a correction, or anything else this policy doesn't cover: email hello@todonut.app, and we'll send you a copy of your data. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, and we'll honor them.

10. Children

Questnut isn't meant for children under 13, and we don't knowingly keep data about them. If you think a child has made an account, email hello@todonut.app and we'll delete it.

11. Changes

If we change this policy, we'll update the date at the top.

12. Contact

Questions about privacy, or a request about your data: hello@todonut.app.