Todoist is a task-management app made by Doist, a private, bootstrapped, remote-first company that states it has no exit strategy and describes 93 employees across 39 countries. Its privacy policy (controller: Doist Inc., a Delaware corporation) discloses broad data collection — registration info, geolocation for the location-reminder feature, usage data, contacts imported for sharing, and AI 'Prompts and Outputs' sent through third-party AI service providers — retained 'as long as necessary' with self-serve export and deletion. Todoist runs Google Analytics and other 'analytical and advertising' cookies, and its App Store privacy label declares email, name and device/analytics identifiers linked to the user's identity for 'Developer's Advertising or Marketing.' Data is encrypted in transit (TLS) and at rest on AWS, but the design is not end-to-end encrypted, so Doist itself can access content in plaintext. The company self-declares GDPR compliance and operates a vulnerability-report channel; no breach, FTC action, or lawsuit was found in this research, and no named third-party security audit or transparency report was located either.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
[2020-06-24] · COLLECTION
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is it clear why the service collects the personal data that it does? — Yes.
The service's policy indicates your personal data may be sold or otherwise transferred as part of a bankruptcy proceeding or other type of financial transaction.
Doist's privacy policy states it collects geolocation information (GPS data) when a user activates the location reminder feature, imports and stores contacts a user shares tasks with, and separately discloses that any information a user submits in an AI 'Prompt' is collected and may be reproduced in the AI-generated 'Output', with the underlying models drawing on third-party and internally generated data combined with the user's own input.
Todoist's help-center article states users can delete their account and all associated data at any time on their own, without a support request, and separately that Todoist creates automatic daily backups a user can download at any time.
Doist's About Us page states the company has no exit strategy and does not intend to sell or be acquired, framing itself as a bootstrapped, mission-driven company, and separately states it is a remote-first team of 93 people representing 41 nationalities across 39 countries and 75 cities.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.
Doist's privacy policy identifies the controlling legal entity as 'Doist Inc., a company registered in Delaware' with a stated registered address in Wilmington, Delaware, and states Doist Inc. is the data controller for personal use of its services.
Todoist's security page states that projects, tasks, comments, account information and payment information are stored and encrypted at rest on AWS infrastructure with TLS in transit, but does not describe end-to-end or zero-knowledge encryption anywhere on the page, meaning Doist controls the keys and can access user content.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
Doist's privacy policy names its vendor/service-provider categories: cloud hosting via Microsoft Azure, Amazon Web Services and Google Cloud (all U.S.-based), Zendesk for customer support, unnamed 'AI Service Providers,' Google for analytics, SendGrid/Mailgun/Mailchimp for email, and Stripe for payments, and states these vendors receive data 'for the provision of the Services.'
Todoist's help-center article on privacy and security states that Doist complies with the GDPR and other applicable data protection laws, and points users to a Trust Center for compliance certifications, data storage locations and its sub-processor list, but does not itself name any specific certification or audit.
The iOS App Store privacy label for Todoist (developer/seller Todoist Inc.) declares that Contact Info (email address, name) and Analytics Identifiers (User ID, Device ID) are collected, linked to the user's identity, and used for the developer's own advertising or marketing purposes, in addition to app functionality and customer-support uses.
Doist's privacy policy states it uses 'analytical and advertising' cookies to operate, maintain and improve its services, and its cookie table names Google Analytics, Datadog, Stripe, Zendesk, YouTube and Cloudinary as third-party recipients of browsing/interaction data, with Google Analytics retained for 90 days.