← Back to Toto

Privacy Policy

Last updated: March 2026

What We Collect

When you create a Toto account, we collect:

• Email address — used for login and account recovery.
• Name (optional) — used for display purposes only.
• OAuth provider info — if you sign in with Google or Apple, we receive a unique identifier and your email from the provider. We do not receive or store your provider password.

How We Use Your Data

Your data is used solely to operate the Toto service:

• Authenticating you and keeping your session active.
• Storing and syncing your to-do lists across devices.
• Rendering labels for printing.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Cookies

Toto uses a small number of cookies:

• Session cookie — keeps you logged in.
• Theme cookie — remembers your visual theme preference.
• CSRF cookie — protects against cross-site request forgery.

We do not use tracking cookies or third-party analytics.

Data Storage

Your data is stored on servers hosted by Railway. Passwords are hashed using industry-standard algorithms and are never stored in plain text. All connections use HTTPS encryption in transit.

Third-Party Services

If you choose to sign in via Google or Apple, your authentication is handled by those providers under their respective privacy policies. Toto only receives the minimum information needed to create your account.

Your Rights

You have the right to:

• Access your data at any time through the app.
• Delete your account and all associated data by contacting us.
• Export your to-do list data.

Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated through the app. Continued use of Toto after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Reach out via the contact information in the app.