Privacy Policy
Last updated: 30 September 2026
In short: we collect what we need to run your ccToDo account and nothing more. We don't sell your data, we don't show ads, and we don't use tracking or analytics cookies.
1. Who we are
ccToDo (www.cctodo.com and api.cctodo.com) is made by CloudCircus, the data controller for the personal data described here. If you have questions about this policy or want to use your rights, email support@cctodo.com.
2. What data we collect and why
Account data
When you create an account with an email address, we store your email address and your password as a one-way hash. We never see or store your actual password.
If you sign in with Google, Apple, Microsoft or Facebook, we receive and store the basic profile information that provider shares with us: usually your email address, your name, an account ID from that provider and, depending on the provider, a link to your profile picture. We don't receive your password for that service, and we don't store access tokens for your account there.
If you create API tokens (for the cctodo command line tool or your own scripts),
we store a one-way hash of each token, the name you give it, and when it was created and last used.
If you connect an AI assistant through MCP (at api.cctodo.com/mcp, by signing in
or with an API token), we store the name the assistant registered with, the address it sends you back to,
one-way hashes of the tokens we issue to it, and when it was connected and last used. It can read and change
everything you can in ccToDo, and what it reads is sent to that assistant's provider under their terms. It gets
other members' names (or, for members without a name, the part of their email address before the @), not their
email addresses. You choose that provider, so it isn't one of ours (section 4). Disconnect it (or revoke its
token) in Settings any time.
If you connect IFTTT, we store a one-way hash of the access tokens we issue to IFTTT, and when the connection was made and last used.
We use account data to identify you, let you log in and run the service. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
Your tasks and content
The tasks, lists and other content you create in ccToDo are stored so we can show them to you on your devices. Legal basis: performance of a contract.
Groups, invites and comments
Members of a group can see each other's name and email address, all tasks, milestones and comments in that group, and the group's history of who created, changed, assigned, completed, commented on or deleted which task. When you invite someone, we store their email address and your optional message, and send them an invite email (again only if you resend it). Invites from members are shown to the group's owners, who approve them before they're sent. Invites expire after 14 days. Legal basis: performance of a contract, and our legitimate interest in delivering the invite you asked us to send.
Emails you send to ccToDo
If you email task@cctodo.com, we store the whole message (sender, recipients, subject, body and any attachments) so we can turn it into a task. If you email support@cctodo.com, we keep the message so we can answer you. Legal basis: performance of a contract, or our legitimate interest in answering your request (Article 6(1)(f) GDPR).
Technical data
Like most websites, our servers record basic request information: IP address, time, the page requested and your browser's user agent. We use it only for security and troubleshooting, and delete it after 30 days. Legal basis: legitimate interests (keeping the service secure and working).
3. How we use your data
- To provide and run ccToDo, including logging you in and syncing your tasks.
- To send you emails your account needs, like confirming your email address and resetting your password.
- To send notification emails (a task assigned to you, comments and replies, an accepted invite). You can turn each kind off in your settings or with the link in every email. We don't send marketing emails.
- To turn emails you send to task@cctodo.com into tasks.
- To answer your support requests.
- To keep the service secure and fix problems.
We do not sell your data, use it for advertising, or share it with third parties except as described below.
4. Who else handles your data
| Provider | What for |
|---|---|
| Hetzner Online GmbH (Germany) | Hosting. Our servers and your data are in the EU. |
| Gravatar (Automattic) | Profile pictures. Our server asks Gravatar for a picture using a hash of your email address; the picture is then shown from cctodo.com, so visitors' browsers never contact Gravatar. You can turn this off in Settings. |
| Google (Workspace) | Our support mailbox: emails to support@cctodo.com are forwarded there so we can answer them. |
| IFTTT Inc. (USA) | Only if you connect ccToDo to IFTTT. Your applets then receive what they ask for: task titles, details and status, milestones, comments, group names, member names (or, for members without a name, the part of their email address before the @), and history events from the groups you're in, and can create tasks, milestones and groups and change task status for you. Disconnect any time in Settings. IFTTT's own privacy policy applies on their side. |
| Google, Apple, Microsoft, Meta (Facebook) | Sign-in, only if you choose to log in with one of them. Their own privacy policies apply to what happens on their side. |
5. How long we keep data
We keep your account data and content for as long as your account exists. When you ask us to delete your account, we delete your personal data within 30 days, except where the law requires us to keep something (for example, accounting records).
6. Deleting your account and data
You can ask us to delete your ccToDo account and all data connected to it at any time:
- Email support@cctodo.com with the subject "Delete my ccToDo account", from the email address on your account (or tell us which address it is).
- We'll confirm the request and delete your account, your tasks and any social login connections within 30 days.
If you signed in with Facebook, Google, Apple or Microsoft, you can also remove ccToDo's access in that service's security or app settings. On Facebook, that's Settings & privacy → Settings → Apps and websites. Doing so stops future sign-ins through that provider. To delete the data we hold, send us the email above.
7. Cookies
We only use cookies that the site needs to work for you: a session cookie that keeps you logged in, a security token that protects forms against cross-site request forgery, short-lived cookies for on-screen notices like "You have signed out", and a preference cookie that remembers which group you had open last, so the app opens there next time (it holds only the group's number and lasts a year). We don't use tracking, analytics or advertising cookies, so there's no cookie banner.
The ccToDo app for iOS and Android doesn't use cookies. When you sign in (on this website), the app keeps a sign-in token on your device, in the iOS Keychain or Android Keystore. It lasts until you sign out, for at most a year, and changing your password signs it out. The app has no analytics, advertising or tracking code.
8. Your rights
Under the GDPR you have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted (see section 6).
- Restriction: ask us to pause processing of your data.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests.
Email support@cctodo.com to use any of these rights. We'll reply within 30 days. You can also complain to a data protection authority. In Denmark that's Datatilsynet.
9. Security
All traffic to ccToDo is encrypted with HTTPS. Passwords are stored only as one-way hashes. Our servers are in EU data centres with restricted access.
10. Children
ccToDo is not intended for children under 13, and we don't knowingly collect their data.
11. Changes to this policy
We may update this policy. If we make important changes, we'll tell you by email or with a notice on the site. The date at the top always shows when it was last changed.
12. Contact
CloudCircus · support@cctodo.com