Privacy Policy
Last updated: 28 September 2026
In short: we collect what we need to run your ccToDo account and nothing more. We don't sell your data, we don't show ads, and we don't use tracking or analytics cookies.
1. Who we are
ccToDo (www.cctodo.com and api.cctodo.com) is made by CloudCircus, the data controller for the personal data described here. If you have questions about this policy or want to use your rights, email support@cctodo.com.
2. What data we collect and why
Account data
When you create an account with an email address, we store your email address and your password as a one-way hash. We never see or store your actual password.
If you sign in with Google, Apple, Microsoft or Facebook, we receive and store the basic profile information that provider shares with us: usually your email address, your name, an account ID from that provider and, depending on the provider, a link to your profile picture. We don't receive your password for that service, and we don't store access tokens for your account there.
We use account data to identify you, let you log in and run the service. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
Your tasks and content
The tasks, lists and other content you create in ccToDo are stored so we can show them to you on your devices. Legal basis: performance of a contract.
Emails you send to ccToDo
If you email task@cctodo.com, we store the whole message (sender, recipients, subject, body and any attachments) so we can turn it into a task. If you email support@cctodo.com, we keep the message so we can answer you. Legal basis: performance of a contract, or our legitimate interest in answering your request (Article 6(1)(f) GDPR).
Technical data
Like most websites, our servers record basic request information: IP address, time, the page requested and your browser's user agent. We use it only for security and troubleshooting, and delete it after 30 days. Legal basis: legitimate interests (keeping the service secure and working).
3. How we use your data
- To provide and run ccToDo, including logging you in and syncing your tasks.
- To send you emails your account needs, like confirming your email address and resetting your password. We don't send marketing emails.
- To turn emails you send to task@cctodo.com into tasks.
- To answer your support requests.
- To keep the service secure and fix problems.
We do not sell your data, use it for advertising, or share it with third parties except as described below.
4. Who else handles your data
| Provider | What for |
|---|---|
| Hetzner Online GmbH (Germany) | Hosting. Our servers and your data are in the EU. |
| Google, Apple, Microsoft, Meta (Facebook) | Sign-in, only if you choose to log in with one of them. Their own privacy policies apply to what happens on their side. |
5. How long we keep data
We keep your account data and content for as long as your account exists. When you ask us to delete your account, we delete your personal data within 30 days, except where the law requires us to keep something (for example, accounting records).
6. Deleting your account and data
You can ask us to delete your ccToDo account and all data connected to it at any time:
- Email support@cctodo.com with the subject "Delete my ccToDo account", from the email address on your account (or tell us which address it is).
- We'll confirm the request and delete your account, your tasks and any social login connections within 30 days.
If you signed in with Facebook, Google, Apple or Microsoft, you can also remove ccToDo's access in that service's security or app settings. On Facebook, that's Settings & privacy → Settings → Apps and websites. Doing so stops future sign-ins through that provider. To delete the data we hold, send us the email above.
7. Cookies
We only use cookies that are strictly necessary for the site to work: a session cookie that keeps you logged in, a security token that protects forms against cross-site request forgery, and short-lived cookies for on-screen notices like "You have signed out". We don't use tracking, analytics or advertising cookies, so there's no cookie banner.
8. Your rights
Under the GDPR you have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted (see section 6).
- Restriction: ask us to pause processing of your data.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests.
Email support@cctodo.com to use any of these rights. We'll reply within 30 days. You can also complain to a data protection authority. In Denmark that's Datatilsynet.
9. Security
All traffic to ccToDo is encrypted with HTTPS. Passwords are stored only as one-way hashes. Our servers are in EU data centres with restricted access.
10. Children
ccToDo is not intended for children under 13, and we don't knowingly collect their data.
11. Changes to this policy
We may update this policy. If we make important changes, we'll tell you by email or with a notice on the site. The date at the top always shows when it was last changed.
12. Contact
CloudCircus · support@cctodo.com