Privacy Policy

Last updated: February 19, 2026

1. Introduction

caltodo ("we", "our", or "us") is a personal task management application. This Privacy Policy explains how we collect, use, and protect your information when you use our service at caltodo.me.

2. Information We Collect

We collect the following information when you use caltodo:

  • Account information: Your name and email address from your Google account when you sign in.
  • Google Calendar data: If you choose to connect Google Calendar, we access your calendar events to sync them with your tasks. We only read and write to calendars you explicitly select.
  • Course platform data: If you connect Canvas (bCourses) or Gradescope, we access your course assignments to import them as tasks.
  • Task data: Tasks, due dates, completion status, and other information you create within the app.

All data is stored on a per-account basis using unique, system-generated identifiers. We cannot and do not associate task content with your personal identity for any purpose beyond providing the service. Your tasks, completion history, and course data are never reviewed, analyzed, or accessed by caltodo staff for any reason other than technical support you explicitly request.

3. How We Use Your Information

  • To provide and maintain the caltodo service.
  • To sync your tasks with Google Calendar and course platforms.
  • To authenticate your identity and manage your account.

4. Data Storage and Security

Your data is stored securely using Supabase, which provides encryption at rest and in transit. We do not sell, share, or distribute your personal data to third parties. Task data is isolated per account and cannot be cross-referenced between users. We employ row-level security policies so that each user can only access their own data — no other user, and no caltodo administrator, can view your tasks or personal information through the application.

5. Google API Services

caltodo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only access Google Calendar data that you explicitly authorize, and we do not use this data for advertising or any purpose unrelated to providing the caltodo service.

6. Data Retention and Deletion

We retain your data for as long as your account is active. You can request deletion of your account and all associated data at any time by contacting us. Upon deletion, all your personal data will be permanently removed from our systems.

7. Third-Party Services

We use the following third-party services:

  • Google OAuth: For authentication and calendar access.
  • Supabase: For data storage and authentication.
  • Vercel: For hosting and analytics.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by updating the "Last updated" date at the top of this page.

9. Contact

If you have questions about this Privacy Policy or wish to request data deletion, please contact us at cadenchiang@berkeley.edu.