This page is about todao.app — the site and its waitlist. The iOS app is in private beta; its own privacy notice ships with it, and you see it before you sign in.
Who is responsible
Mgr. Pavel Djurič, individual entrepreneur (OSVČ), Czech Republic. Sukova 559/3, 160 00 Praha 6 – Bubeneč, Czech Republic. IČO 87494795, DIČ CZ8006289940. Write to privacy@todao.app for anything on this page.
What we collect, and why
The waitlist. When you join, we store your email address and a record of your consent: the moment you ticked the box, the exact words you agreed to (right now: “Email me when todao launches and, rarely, before that. I can unsubscribe with one tap.”, version 2026-09-25), a salted hash of your IP address (not the address itself), your browser’s name string and its language. We keep that record so we can show, if ever asked, that you did agree — and to what.
We use the address for one thing: to email you when todao launches, and rarely before that — a few notes at most, never more than one a month. No profiling, no ads, no selling or renting the list.
The site. todao.app sets no cookies and runs no analytics. Our hosting provider keeps ordinary server logs (IP address, time, page) for security, for a short time.
On what legal basis
Your consent (GDPR art. 6(1)(a)). It is a box you tick yourself, and your place on you are on the list only after you click the link in the confirmation email. You can withdraw consent at any time — see “Leaving” below — and withdrawing is as easy as joining was.
Who else touches the data
Three processors, each under a data-processing agreement, each only for its job:
- Railway (Railway Corp., USA) hosts our backend and its database, where the list lives. Transfers to the USA rest on the EU standard contractual clauses.
- Resend (Resend Inc., USA) delivers our emails; it sees your address and what we send you. Same clauses.
- Vercel (Vercel Inc., USA) serves this site and keeps its server logs. Same clauses.
Nobody else. No advertising networks, no data brokers.
For how long
- An address that is never confirmed is deleted after 30 days.
- A confirmed address stays until you unsubscribe or ask us to delete it, or until twelve months after todao launches — whichever comes first. When it goes, the consent record goes with it.
- If you unsubscribe, we keep the address only to make sure we don’t write again; click “Delete my data too” and it is gone.
Leaving
Every email has an unsubscribe link, and it works without an account. The same page lets you delete your address and the consent record entirely. Or write to privacy@todao.app.
Your rights
You can ask what we hold about you, have it corrected, have it deleted, have its use restricted, take it with you in a plain file, and withdraw your consent at any time. Write to privacy@todao.app; we answer within a month. If you think we handled your data wrongly, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or to the authority in your own country.
Age
The waitlist is for people aged 16 and over.
Changes
If this page changes in a way that matters, the date at the top changes with it, and if the change touches what you agreed to, we ask again rather than assume.