Privacy Policy

TodoPilot (“we”, “our”, or “the app”) is operated by DJUMP, MB, a company registered in Lithuania. This Privacy Policy explains how we collect, use, store, and protect your information when you use TodoPilot. By using the app, you consent to the practices described in this policy.

1. Information We Collect

2. Information We Do Not Collect

• We do not collect payment or credit card information. All payments are processed by Apple (App Store) or Google (Google Play) through RevenueCat.
• We do not sell your personal data or the contents of your tasks and lists.

3. How We Use Your Information

• To provide core app functionality (capturing, organizing, and prioritizing your tasks)
• To authenticate your account and sync your data across devices
• To generate AI priority suggestions and deadline insights
• To send reminders and push notifications you have opted into
• To analyze app usage and improve the user experience

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent — You provide consent when creating an account and opting into notifications.
• Contract performance — Processing is necessary to provide the task-management service you requested.
• Legitimate interest — We use anonymous analytics to improve app performance and user experience.

5. AI Data Processing

To suggest task priorities and surface deadlines, our prioritization engine processes task metadata such as titles, due dates, priority flags, and your completion and postponement patterns. This processing is performed solely to generate suggestions for you. We do not use your task content to train shared AI models, and the contents of your tasks are not shared with third parties for their own purposes.

6. Data Storage and Security

Your data is stored securely using Supabase with row-level security (RLS), meaning only you can access your own data. All data is encrypted at rest and transmitted over HTTPS. We do not sell, rent, or share your personal data with third parties.

7. Data Retention

• Account data and your tasks are retained for as long as your account is active.
• If your account is inactive for 24 months, we may delete your data after providing notice.
• When you delete your account, all associated data is permanently removed within 30 days.

8. Third-Party Services

• Supabase — Authentication and database hosting (EU region)
• RevenueCat — Subscription and payment management
• PostHog — Anonymous usage analytics
• Apple / Google — OAuth sign-in providers

9. International Data Transfers

Your account data and tasks are primarily stored in the EU via Supabase. Some analytics data may be transferred to the United States (PostHog). These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate data protection.

10. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of access — Request a copy of your personal data
• Right to rectification — Correct inaccurate personal data
• Right to erasure — Request deletion of your personal data
• Right to data portability — Receive your data in a structured, machine-readable format
• Right to restrict processing — Request limitation of data processing
• Right to withdraw consent — Withdraw consent at any time without affecting prior processing

You can delete your account directly within the app under Settings, or contact us at start@djump.io. You also have the right to lodge a complaint with a supervisory authority.

11. Children's Privacy

TodoPilot is not intended for children under 14 (the digital age of consent in Lithuania). We do not knowingly collect personal data from children under 14.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by updating the date above. Continued use of the app after changes constitutes acceptance.

13. Contact