Legal & Data Protection

Privacy Policy

ShowTodo is rooted in public transparency and social accountability, but your personal security, account integrity, and data ownership are fiercely protected.

Effective: September 1, 2026 · Updated: October 1, 2026 · Version 1.1.0

We Never Sell Your Data

We do not sell, rent, or trade your personal data to advertisers, data brokers, or third parties under any circumstances.

Public by Design, Protected by Default

Task titles you publish to the feed are intentionally public for accountability. Your account credentials and private notes remain strictly protected.

Full Ownership & Right to Erasure

You retain 100% ownership of your data. You can edit, export, or permanently delete your tasks and identity at any time.

1. Introduction & Our Core Philosophy

Plain English Takeaway: ShowTodo is built around transparency and public accountability, but safeguarding your personal account data and privacy choices is fundamental to everything we do.

Welcome to ShowTodo ("we", "us", or "our"). ShowTodo is a public-first task and accountability network designed for creators, learners, and builders to share their progress openly.

By design, ShowTodo makes task items visible across the open web to help you overcome procrastination through social commitment. However, your trust is paramount. This Privacy Policy details our transparent approach to data collection, usage, processing, and the extensive legal rights you hold under international data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Information We Collect

Plain English Takeaway: We collect only what is strictly necessary to provide the service: your email identity, the tasks you choose to post, and minimal technical telemetry.

We collect information in three transparent ways: information you provide directly, public activity you generate, and minimal automated telemetry required for platform reliability.

Account Credentials & Google OAuth Data: When you sign in with Google OAuth, we receive your email address, display name, and avatar URL. If you authenticate directly, we collect your email address and generated handle.
Task & Content Data: The titles of todos you post, planned start and due dates, completion statuses, category tags, and optional notes.
Interaction Data: Emoji reactions you send or receive to encourage fellow builders.
Technical & Device Telemetry: IP addresses (anonymized for security logs), browser user-agent, operating system, and timestamp logs used strictly for DDoS mitigation, rate limiting, and spam defense.
Cookies & Local Storage: Minimal functional browser storage (localStorage) utilized to preserve your theme preference (dark/light mode) and active session tokens.

Important Note: Private Notes Option: While todo titles are always visible on the public feed, you may set the optional "Note" field to private, keeping sensitive details visible only to you.

3. Google API Services & OAuth User Data

Plain English Takeaway: When you authenticate with Google OAuth, we access only basic profile information (email, name, avatar) to log you in. We never sell your data, use it for ads, or train AI models.

ShowTodo integrates with Google OAuth 2.0 to offer a secure, passwordless authentication experience. When you choose to authenticate via Google, ShowTodo requests access strictly to standard, non-sensitive identity scopes: "openid", "https://www.googleapis.com/auth/userinfo.email", and "https://www.googleapis.com/auth/userinfo.profile". ShowTodo does NOT request access to or process data from any other Google APIs (such as Gmail, Google Drive, Google Contacts, or Google Calendar).

How We Access & Use Google User Data: ShowTodo accesses and uses your Google user data (specifically your verified email address, display name, and profile photo URL) solely to provide and support core user-facing features: (1) authenticating your identity and securely logging you into ShowTodo; (2) creating and maintaining your profile, displaying your nickname and avatar in the application interface; (3) associating your published todos, progress milestones, and activity streaks with your account; and (4) managing active session state.

No Sharing, Sale, or Commercial Disclosure: ShowTodo does NOT sell, rent, license, or disclose your Google user data to data brokers, advertising networks, information resellers, or third parties under any circumstances. We do not use Google user data for targeted advertising, personalized marketing, creditworthiness determinations, or lending purposes. Your data is stored strictly in our audited cloud database (Neon PostgreSQL) for hosting your account.

Data Protection & Security: All data received through Google APIs is protected with industry-standard technical and operational safeguards, including HTTPS with TLS 1.3 in transit and AES-256 encryption at rest.

Data Retention & Deletion: We retain your Google user data only for as long as your ShowTodo account remains active. You may request permanent deletion of your account and all associated Google user data at any time by contacting privacy@showtodo.com. Upon request, your account and records are permanently purged within 14 business days.

Revoking Access: You can revoke ShowTodo's access to your Google account at any time via your Google Account Permissions. Once revoked, ShowTodo will no longer receive updates or data from your Google profile.

Prohibition on AI/ML Model Training: ShowTodo explicitly affirms that Google user data and information received from Google APIs are not used to develop, improve, or train generalized or non-personalized artificial intelligence (AI) and/or machine learning (ML) models.

Limited Use Disclosure: ShowTodo's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Google OAuth Scopes Requested: openid (identity verification), email (primary email address), profile (display name and profile avatar photo).
Specific Google Data Accessed: Google account identifier, primary email address, verified display name, and avatar picture URL.
Strict Purpose Limitation: User authentication, profile display, and task association only. No advertising or commercial profiling.
Revocation: Revoke access anytime through Google Account Security Settings at https://myaccount.google.com/permissions.

Important Note: Limited Use Commitment: ShowTodo's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Information

Plain English Takeaway: Your information is used solely to operate the platform, generate your streak heatmap, prevent abuse, and keep your tasks synced.

We process your data strictly under valid lawful bases, including contract performance, legitimate interests in maintaining platform integrity, and your explicit consent.

Delivering the core ShowTodo service: Displaying your public feed, generating profile pages, and maintaining your activity streaks.
Authenticating user identity and managing secure sessions via Google OAuth or verified credentials.
Generating aggregated, non-personally identifiable community statistics (such as global task completion rates on the /stats dashboard).
Detecting and preventing automated bot spam, abuse, scraping, and unauthorized system penetration.
Communicating critical account security updates, system changes, or responses to customer support requests.

6. Your Rights & Data Ownership (GDPR & CCPA)

Plain English Takeaway: You retain complete ownership of everything you post. You have the full right to access, edit, download, or permanently wipe your data.

Regardless of where you reside globally, ShowTodo extends comprehensive data ownership rights to all users, fully reflecting GDPR, CCPA, and global privacy frameworks:

Right to Access & Portability: You may request a complete machine-readable copy (JSON) of all tasks, activities, and reactions associated with your account.
Right to Rectification: You can update your nickname, avatar, or edit existing task details at any time.
Right to Erasure (The Right to be Forgotten): You can request permanent deletion of your account and all associated todos from our active databases.
Right to Object or Restrict Processing: You have the right to withdraw consent for non-essential processing at any time.
Right to Revoke OAuth Permissions: If you use Google OAuth, you can disconnect ShowTodo from your account at any time at https://myaccount.google.com/permissions.

Important Note: To exercise any of your data rights, simply email privacy@showtodo.com. We process verification and complete erasure requests within 14 business days.

7. Security Standards & Retention

Plain English Takeaway: All data is encrypted in transit and at rest. We retain your public history until you delete it or request account removal.

We implement industry-standard administrative, physical, and technical security safeguards to prevent unauthorized access, disclosure, or loss:

Encryption: All web traffic is strictly served over HTTPS/TLS 1.3 with HSTS. Data stored in our databases is encrypted at rest using AES-256.

Retention Schedule: We retain your public todos and profile as long as your account remains active, ensuring your historical heatmap and streaks remain accurate. If you delete a todo, it is removed immediately from public indexes and purged from database backups in accordance with standard backup rotation cycles.

8. Children's Privacy (COPPA & GDPR-K)

Plain English Takeaway: ShowTodo is designed for individuals aged 13 and older (or 16 in the European Economic Area). We do not knowingly collect data from children.

ShowTodo does not knowingly collect or solicit personal information from anyone under the age of 13 (or under 16 for residents within the EEA). If we learn that we have collected personal data from a child below these age thresholds without verified parental consent, we will promptly delete that information from our systems.

9. Policy Updates & Contact Channels

Plain English Takeaway: We will notify users of any material changes to this policy. Questions or concerns can be sent directly to our privacy desk.

We may update this Privacy Policy periodically to reflect technological enhancements, regulatory developments, or product improvements. When changes are made, the "Last Updated" date at the top of this document will be revised.

If you have questions, inquiries, or feedback concerning this Privacy Policy, please contact our Data Protection desk:

Email: privacy@showtodo.com
Subject Line: [Privacy Inquiry] - ShowTodo Legal Desk
Response Commitment: We respond to all formal inquiries within 48 business hours.

Contact Our Privacy Officer

If you wish to request a data export, delete your personal records, or ask legal questions, please email privacy@showtodo.com. We are committed to responding to all formal requests within 48 business hours.