Get early accessEarly access
Legal

Privacy Policy

Last updated: 17 October 2026

WowTodo (“we”, “us”) is a task app that turns text and voice into structured task lists. This policy explains what data the WowTodo app and this website handle, who processes it, and the choices you have.

1. Data we collect

  • Account: you sign in with Google. We receive your Google account email address, name, profile picture URL and a unique account ID. We never see your Google password.
  • Profile (optional): full name, date of birth, profession, city, bio and avatar that you choose to enter.
  • Your content: tasks, to-dos, task groups and branches, notes, due dates, and reminder settings and schedules.
  • Voice: if you use voice input, the app records a short audio clip from your microphone (only after you grant permission and tap record) and sends it for transcription. The audio is processed to produce text and is not saved to your account.
  • Sharing data: when you share a task, we store the share (the recipient’s account or email address, status, and any note when a share is declined) and in-app notifications about it. Recipients you share with can see the shared task and your name.
  • Chat messages: when you chat inside a shared task, we store your messages: the text, the step you tag (if any), who sent it and when, and whether it was deleted. We also store in-app notifications about new messages. Messages in a task’s “Everyone” chat can be seen by the task’s owner and everyone the task is shared with. Private messages can be seen only by you and the task’s owner. Deleting a message removes its text for everyone. If a task stops being shared with you, you can no longer see its chat. Chat messages are not sent to AI providers. When you delete your account, the messages you sent are deleted.
  • What Wow knows (optional, off until you turn it on): a short list of things Wow remembers so it can plan better: facts about you (for example your gym time) and about people you name (for example “Rahul, my manager”), with the name of the task each came from. See “What Wow knows” in section 2.
  • Push notifications: if you allow notifications, we store a push token for each phone you use WowTodo on, and your notification choices (Settings → Notifications). We use them to tell you, even when the app is closed, about a new chat message (including the message text), a task shared with you or an answer to one you shared, progress on a shared task, or a contact request. A token is removed when you sign out, when the phone stops accepting notifications, or when you delete your account.
  • Blocks and reports: if you block or report another user, we store that block or report (who reported whom, including both email addresses, the reason you chose, and any note you add, up to 500 characters, and, if you report a chat message, a link to that message) so we can review abuse and keep the service safe. The person you block or report is not told. Reports are visible only to the WowTodo team and are deleted automatically after 90 days, even if either account is deleted sooner.
  • AI usage metrics: for each AI request we record technical metrics only: time, request type, AI model and prompt version, outcome, latency and token counts. These records do not contain your text or audio. We also keep per-account request counters to enforce rate limits.
  • On your device: a session token (in secure storage) and a cache of your tasks so the app works quickly. Reminders are scheduled as local notifications on your device.

We do not use advertising, analytics or crash-reporting SDKs, and we do not collect your location, contacts or device advertising ID. Reminders are local notifications generated on your device; push notifications are described above.

2. How we use it

  • To provide the app: sign you in, store and sync your tasks, send reminders, and let you share tasks with other people.
  • To generate tasks from your text and voice: the text you type, the transcript of your voice, your language setting, existing group names and, if you filled them in, your profession and city are sent to AI providers to produce a structured task list.
  • To prevent abuse and control costs (rate limits), and to measure reliability of the AI features.
  • To respond to your support requests.

What Wow knows

“What Wow knows” is off until you turn it on (from the card on Home, or in Settings → Privacy & account → What Wow knows). When it is on, Wow can keep short facts about you and about people you name, such as your gym time or who Rahul is. These facts are taken only from tasks you confirm, and you see and can untick them on the review screen before anything is saved. Nothing is taken from your voice recordings, and nothing is taken from tasks other people share with you. Wow keeps up to 50 facts. When you plan a new task, the facts are sent to our AI providers (see section 3) together with your request, only to make that plan better. You can view, edit or forget any fact at any time in Settings → Privacy & account → What Wow knows. Turning the switch off pauses it: Wow keeps what it knows but stops using it and adding to it until you turn it back on. Your facts are deleted when you delete your account.

We do not use your content to advertise to you or to train our own models.

3. Who processes your data

We use the following service providers (processors) to run WowTodo. They process data only to provide their service to us:

  • Supabase (database, authentication and server functions): stores your account, profile, tasks, shares, chat messages, reminders and AI usage metrics, and runs the server functions that call the AI providers.
  • Google (Sign in with Google): authenticates you. Google also provides the Gemini AI service, which is used as a fallback to generate tasks from your text if the primary provider is unavailable.
  • OpenAI: transcribes voice clips (Whisper) and generates structured tasks from your text (GPT models). OpenAI states that it retains API request logs for up to 30 days for abuse monitoring and does not use API data to train its models by default.
  • Expo (EAS Update): delivers app updates to your device. It receives standard request information such as IP address and app version, not your content.
  • Expo (push service) and Google Firebase Cloud Messaging: deliver push notifications to your phone. They receive your phone’s push token and the notification’s title and text (for a chat message, the message text), not the rest of your data.

We do not sell your personal data or share it for advertising. We may disclose information if required by law or to protect our rights and users. The app has no payment processing at this time.

4. Website demo

The “Try WowTodo” demo on this website processes what you type or say, only to make your plan. Typed text or a voice recording is sent to OpenAI (with Google Gemini as a fallback) and the result is shown on the page. We do not store your text, recording or result. To limit abuse we keep only anonymous rate-limit counters, keyed by a hash that changes every day and is never your raw IP address. The demo uses Cloudflare Turnstile for bot checks, which receives standard request information from your browser.

5. Retention

  • Your account, profile, tasks and related data are kept until you delete them or delete your account.
  • What Wow knows: kept until you forget a fact, use “Forget everything”, or delete your account.
  • Voice audio is sent for transcription and is not stored by us. OpenAI may retain request logs for up to 30 days, as described above.
  • AI usage metrics and rate-limit counters are linked to your account and are deleted with it.
  • Backups held by our hosting provider are overwritten on their normal rotation schedule after deletion.

6. Your choices and deletion

You can edit or remove your profile and tasks in the app at any time. You can permanently delete your account and all associated data in the app under Settings → Privacy & account → Delete account, or by email if you no longer have the app. See Delete your account for exactly what is removed and what is retained. You may also contact us to ask for access to or correction of your data. You can revoke the microphone and notification permissions in your device settings at any time.

7. Children

WowTodo is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

8. Security

Data is encrypted in transit using HTTPS/TLS. Database access is restricted so that each user can only read their own data and tasks that were shared with them, and AI provider keys are kept on the server and never in the app. No system is perfectly secure, so we cannot guarantee absolute security.

9. Changes

We may update this policy. When we do, we will change the “Last updated” date above.

10. Contact us

Questions or requests: privacy@wowtodo.app.

11. Website waitlist and contact

If you join the early-access list or write to us from this website, we handle the following. This is separate from the app and from your WowTodo account.

  • What we store: your email address; whether you confirmed it; whether you agreed to occasional news about WowTodo (optional) and the wording you saw; the optional answers you give about how you plan your day; the page or campaign you came from (page path and any campaign tags in the link, never your IP address); and the time of each step. If you use the contact form, we store your email address and message.
  • Why: to confirm it is really you, to choose people for early access and write to you about it, to learn what to build, and to answer your message. We do not sell this data or use it for advertising.
  • How long: sign-ups you never confirm are deleted after 30 days. Everything else is deleted 12 months after the early-access beta ends, or sooner if you ask.
  • Removing yourself: every email we send has a remove link that deletes you from the list straight away. You can also email us and we will delete your sign-up and any contact messages.
  • Analytics: this website uses no analytics or advertising trackers. The forms use Cloudflare Turnstile for bot checks, which receives standard request information from your browser, and we keep anonymous rate-limit counters keyed by a daily-changing hash, never your raw IP address.
  • Who handles it: our database host (Supabase) stores it, and our email provider (Resend) delivers the emails we send you.