Datenschutzerklärung

Who processes your data

The data controller is Michal Lev, business ID 74639536, Czech Republic, contact e-mail misha@misha.in. I run the Todo List Hub service at todolisthub.app and its apps for Windows, Android and Visual Studio Code.

What I store

The service cannot be used without an account, so the following is stored:

• Account data — your name, e-mail address, password (only as an irreversible hash, never in readable form), chosen time zone and the date the account was created.
• Content you create — projects, tasks including descriptions and due dates, comments, and files you attach to tasks.
• An access key (API key) used by the Windows, Android and Visual Studio Code apps to sign in to your account.
• Your IP address at sign-up — kept briefly, only so that mass account creation can be limited.

No payment details are stored, the service is free. There are no advertising or analytics tools and nobody is tracked across websites.

Why I store it

The data is used solely to run the service: to sign you in, show your tasks, share projects with people you invite yourself, and send an e-mail notification when someone assigns you a task or writes a comment to you. The legal basis is performance of a contract — providing the service you asked for.

Who else sees the data

I do not sell your data or pass it to anyone for their own purposes. Processing involves:

• The hosting and e-mail provider (Blueboard.cz), whose servers in the Czech Republic run the service and deliver notification e-mails.
• Groq, Inc. (USA) — only when you reply directly to a notification e-mail. The text of your reply is sent there to have the signature stripped automatically, so it does not end up in the comment. If you never reply to those e-mails, nothing is sent there.
• id.produkce.ai — only if you choose single sign-on; your name and e-mail address are passed on.

How long I keep it

For as long as your account exists. When the account is deleted, your projects, tasks, comments and attachments go with it. Accounts whose e-mail address is not confirmed within 48 hours are removed automatically. Sign-up IP records are kept for a matter of days.

Tasks in shared projects remain available to the other members after your account is deleted — they belong to the project rather than to you personally.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability and to object. Most of it you can handle yourself in account settings; for anything else write to misha@misha.in and I will deal with it within one month at the latest.

If you believe your data is being handled improperly, you can contact the Czech Office for Personal Data Protection.

Cookies and local storage

The website uses a single cookie, which keeps you signed in. There are no advertising or measurement cookies. Your browser additionally remembers the chosen appearance (light/dark) and whether the due-date overview is collapsed — both stay on your device.

Security

Connections are always encrypted (HTTPS). Passwords are stored only as an irreversible hash, so nobody knows them, myself included. Attachments live outside the publicly reachable part of the server and only members of the given project can open them.

Changes

If these terms change, I will update this page and move the date at the top. For substantial changes I will let you know by e-mail.