Legal & Data Protection

Privacy Policy

ShowTodo is rooted in public transparency and social accountability, but your personal security, account integrity, and data ownership are fiercely protected.

Effective: September 1, 2026 · Updated: September 19, 2026 · Version 1.0.0

Key Privacy Highlights

We Never Sell Your Data

We do not sell, rent, or trade your personal data to advertisers, data brokers, or third parties under any circumstances.

Public by Design, Protected by Default

Task titles you publish to the feed are intentionally public for accountability. Your account credentials and private notes remain strictly protected.

Full Ownership & Right to Erasure

You retain 100% ownership of your data. You can edit, export, or permanently delete your tasks and identity at any time.

1. Introduction & Our Core Philosophy

Plain English Takeaway: ShowTodo is built around transparency and public accountability, but safeguarding your personal account data and privacy choices is fundamental to everything we do.

Welcome to ShowTodo ("we", "us", or "our"). ShowTodo is a public-first task and accountability network designed for creators, learners, and builders to share their progress openly.

By design, ShowTodo makes task items visible across the open web to help you overcome procrastination through social commitment. However, your trust is paramount. This Privacy Policy details our transparent approach to data collection, usage, processing, and the extensive legal rights you hold under international data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Information We Collect

Plain English Takeaway: We collect only what is strictly necessary to provide the service: your email identity, the tasks you choose to post, and minimal technical telemetry.

We collect information in three transparent ways: information you provide directly, public activity you generate, and minimal automated telemetry required for platform reliability.

  • Account Credentials: Your email address, chosen nickname, and avatar preference (or algorithmically generated avatar).
  • Task & Content Data: The titles of todos you post, planned start and due dates, completion statuses, category tags, and optional notes.
  • Interaction Data: Emoji reactions you send or receive to encourage fellow builders.
  • Technical & Device Telemetry: IP addresses (anonymized for security logs), browser user-agent, operating system, and timestamp logs used strictly for DDoS mitigation, rate limiting, and spam defense.
  • Cookies & Local Storage: Minimal functional browser storage (localStorage) utilized to preserve your theme preference (dark/light mode) and active session tokens.
Important Note: Private Notes Option: While todo titles are always visible on the public feed, you may set the optional "Note" field to private, keeping sensitive details visible only to you.

3. How We Use Your Information

Plain English Takeaway: Your information is used solely to operate the platform, generate your streak heatmap, prevent abuse, and keep your tasks synced.

We process your data strictly under valid lawful bases, including contract performance, legitimate interests in maintaining platform integrity, and your explicit consent.

  • Delivering the core ShowTodo service: Displaying your public feed, generating profile pages, and maintaining your activity streaks.
  • Generating aggregated, non-personally identifiable community statistics (such as global task completion rates on the /stats dashboard).
  • Detecting and preventing automated bot spam, abuse, scraping, and unauthorized system penetration.
  • Communicating critical account security updates, system changes, or responses to customer support requests.

4. Data Sharing & Third-Party Processors

Plain English Takeaway: We never sell your data. We only share necessary technical information with audited infrastructure providers who adhere to strict data protection standards.

ShowTodo does NOT sell, rent, monetize, or disclose your personal identifiable information to marketing brokers, behavioral ad networks, or data aggregators.

We partner exclusively with trusted, SOC2/ISO-certified cloud infrastructure providers who act strictly as Data Processors bound by legal Data Processing Agreements (DPAs):

  • Database & Cloud Hosting: Neon (Serverless Postgres) and modern serverless edge hosting providers running encrypted databases.
  • Avatar Services: DiceBear open avatar API (only your non-reversible nickname seed is passed; no email or personal identifiers are ever transmitted).
  • Legal Compliance: We may disclose data only if required by a valid court order, subpoena, or binding legal process by law enforcement.

5. Your Rights & Data Ownership (GDPR & CCPA)

Plain English Takeaway: You retain complete ownership of everything you post. You have the full right to access, edit, download, or permanently wipe your data.

Regardless of where you reside globally, ShowTodo extends comprehensive data ownership rights to all users, fully reflecting GDPR, CCPA, and global privacy frameworks:

  • Right to Access & Portability: You may request a complete machine-readable copy (JSON) of all tasks, activities, and reactions associated with your account.
  • Right to Rectification: You can update your nickname, avatar, or edit existing task details at any time.
  • Right to Erasure (The Right to be Forgotten): You can request permanent deletion of your account and all associated todos from our active databases.
  • Right to Object or Restrict Processing: You have the right to withdraw consent for non-essential processing at any time.
Important Note: To exercise any of your data rights, simply email privacy@showtodo.com. We process verification and complete erasure requests within 14 business days.

6. Security Standards & Retention

Plain English Takeaway: All data is encrypted in transit and at rest. We retain your public history until you delete it or request account removal.

We implement industry-standard administrative, physical, and technical security safeguards to prevent unauthorized access, disclosure, or loss:

Encryption: All web traffic is strictly served over HTTPS/TLS 1.3 with HSTS. Data stored in our databases is encrypted at rest using AES-256.

Retention Schedule: We retain your public todos and profile as long as your account remains active, ensuring your historical heatmap and streaks remain accurate. If you delete a todo, it is removed immediately from public indexes and purged from database backups in accordance with standard backup rotation cycles.

7. Children's Privacy (COPPA & GDPR-K)

Plain English Takeaway: ShowTodo is designed for individuals aged 13 and older (or 16 in the European Economic Area). We do not knowingly collect data from children.

ShowTodo does not knowingly collect or solicit personal information from anyone under the age of 13 (or under 16 for residents within the EEA). If we learn that we have collected personal data from a child below these age thresholds without verified parental consent, we will promptly delete that information from our systems.

8. Policy Updates & Contact Channels

Plain English Takeaway: We will notify users of any material changes to this policy. Questions or concerns can be sent directly to our privacy desk.

We may update this Privacy Policy periodically to reflect technological enhancements, regulatory developments, or product improvements. When changes are made, the "Last Updated" date at the top of this document will be revised.

If you have questions, inquiries, or feedback concerning this Privacy Policy, please contact our Data Protection desk:

  • Email: privacy@showtodo.com
  • Subject Line: [Privacy Inquiry] - ShowTodo Legal Desk
  • Response Commitment: We respond to all formal inquiries within 48 business hours.

Contact Our Privacy Officer

If you wish to request a data export, delete your personal records, or ask legal questions, please email privacy@showtodo.com. We are committed to responding to all formal requests within 48 business hours.