Privacy Policy

Last updated: 2026-11-07

This Privacy Policy applies to the application "TODO" developed by YTree ("we", "us", "our").

This Privacy Policy explains how luuvvi Inc. collects, uses, shares, and protects personal information when you use our apps, websites, and related services (together, the "Services"). The Services are available to users worldwide, and this policy applies regardless of where you live. Where your local law gives you additional rights, we honor them as described in Section 9. Our Terms of Service are available at Terms of Service.

1. Controller and Contact

• Application: TODO
• Developer: YTree
• Company: luuvvi Inc.
• Contact: contact@luuvvi.com

2. Information We Collect

• Contact information
  Name, email address, and the content of messages you send us by email, such as support requests.
• Feedback
  Content you choose to submit as feedback about the app (feedback type and text), stored in Cloud Firestore together with the app version, Android version, and device model.
• App configuration data
  The app reads settings from Firebase Remote Config, such as the required app version and ad settings. This request can include the app version and a Firebase installation identifier.
• Voice input (microphone)
  When you tap the microphone button while editing a task, the app asks for microphone permission and passes your speech to the Android speech recognition service, which converts it to text. The app does not record, save, or upload audio itself, and we do not receive your voice. The speech recognition service is usually provided by Google and processes the audio under its own privacy policy; depending on your device, settings, and language pack, the audio may be processed on your device or sent to Google's servers. The recognized text is placed in the task title and stored on your device as described below.
• Advertising data
  The app shows ads served by Google AdMob. AdMob may process your Android advertising ID, ad interactions, and approximate location derived from your IP address.
• Purchase information
  When you buy a paid feature (theme colors or voice input) or restore your purchases, the app sends the following to RevenueCat, a service provider we use to verify purchases: an app user ID that RevenueCat generates for your installation, your Google Play purchase token, the products you bought, the time the app last connected, your device type, and your operating system. RevenueCat acts as our processor. Google Play handles your payment and account; we do not receive your payment card details, Google account, or name for purchases.
• Data stored only on your device
  Your tasks (titles, due dates, due times, reminders, and done status), including task titles entered by voice, and your settings (reminder sound, vibration, notification light, 24-hour time, color theme, voice input on or off, voice input language, and the number of free voice input uses used), and the list of paid features you have bought. This data is stored on your device and is not sent to us. Uninstalling the app deletes it, although Android device backup may keep a copy of app data if backup is enabled on your device.

The TODO app does not require an account and does not use Firebase Analytics or Crashlytics.

3. How We Use Information and Legal Bases

• To provide, operate, and improve the Services (performance of a contract or our legitimate interests)
• To respond to inquiries and feedback, and provide customer support (performance of a contract or our legitimate interests)
• To diagnose errors, maintain security, and improve stability (legitimate interests)
• To show advertisements in the app (legitimate interests or your consent, where consent is required)
• To check the required app version and to control ad settings remotely (legitimate interests)
• To turn your speech into task titles when you use voice input, at your request (performance of a contract)
• To verify your purchases, unlock the paid features you bought, and restore your purchases on your device (performance of a contract)
• To comply with legal obligations (legal obligation)

Your tasks and settings are used only on your device to show your list, send reminders, and apply your choices. We do not receive them.

4. How We Collect Information

• Directly, when you submit information to us, such as through feedback in the app or by email.
• Automatically, when the app requests configuration from Firebase Remote Config and when AdMob loads an ad.

5. Cookies, Identifiers, and Tracking Technologies

The TODO app does not use browser cookies. It uses device and app identifiers instead: the Firebase installation identifier (app configuration), the anonymous app user ID that RevenueCat generates for purchases (Section 2), and the Android advertising ID (ads, as described in Section 7). You can reset or delete the advertising ID in your Android settings.

The app asks for the following Android permissions:

• Notifications (POST_NOTIFICATIONS): to show your reminders. You can turn this off in Android settings, and reminders will not appear.
• Exact alarms (SCHEDULE_EXACT_ALARM): so that reminders fire at the time you chose. On Android 14 and later, you allow this in Android settings.
• Run at startup (RECEIVE_BOOT_COMPLETED): so that your reminders are set again after the device restarts or the app is updated. This happens on your device.
• Microphone (RECORD_AUDIO): only when you tap the microphone button in the task editor, to hear your speech for voice input. The permission is requested at that time. If you deny it, or turn it off in Android settings, voice input will not work, and you can still type task titles.
• Internet: for feedback, configuration, ads, and voice input (the speech recognition service needs a connection).

Our websites use cookies and similar technologies to operate, remember preferences, and measure usage. Where required by law, we ask for your consent before using non-essential cookies, and you can withdraw consent at any time. We respond to Global Privacy Control signals where required by applicable law. You can also control cookies through your browser settings; disabling them may affect some features.

6. Third-Party Services

We use the following third-party service providers to operate the Services:

• Firebase Remote Config (required app version and ad settings)
• Cloud Firestore (storage of feedback you submit)
• Google AdMob (advertisements shown in the app)
• RevenueCat (verifying purchases and restoring them; processes data in the United States, as described in Section 8)
• Google Play Billing (processing purchases made through Google Play)
• Android speech recognition service, usually provided by Google (converting your speech to text when you use voice input)

Google providers process data under Google's Terms of Service and Privacy Policy: https://policies.google.com/privacy.

7. Sharing and Sale of Personal Information

We do not sell personal information. Ads in the app are served by Google AdMob, which may use the advertising ID and ad interaction data to show personalized ads. Google may therefore treat this as sharing for targeted advertising under some laws. You can opt out of personalized ads in your Android settings (in the Ads section of your Android device settings), and you can reset or delete the advertising ID there. Apart from AdMob, we do not share personal information for cross-context behavioral advertising. We disclose personal information only:

• to service providers that process it on our behalf under written obligations of confidentiality and data protection;
• when required by law, regulation, or a valid legal process, or to protect the rights, safety, and security of users or others; or
• in connection with a merger, acquisition, or sale of assets, with notice to you where required by law.

8. International Data Transfers and Retention

Because we and our providers operate globally, your information may be processed or stored on servers outside your country of residence, including in the United States. Where required, we rely on safeguards such as Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

Feedback submitted through the app is retained for 6 months and is then deleted.

Data stored on your device stays there until you delete it or uninstall the app.

We do not store voice recordings. Audio handled by the speech recognition service is governed by that service's own retention rules, which you can review in its privacy policy.

Purchase information sent to RevenueCat is kept as described in RevenueCat's privacy policy and data processing terms (https://www.revenuecat.com/privacy). RevenueCat keeps end-user data for the term of its agreement with us and deletes it on request within the time those terms allow. Your Google Play account and payment records are kept by Google.

RevenueCat stores purchase data on servers in the United States, and its sub-processors are also located in the United States. When you use the paid features, your purchase information is transferred to the United States under the safeguards in RevenueCat's data processing terms, including the EU Standard Contractual Clauses where they apply.

We keep personal information only for as long as necessary for the purposes described in this policy, to comply with legal obligations, or to resolve disputes.

9. Your Privacy Rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your personal information;
• receive a copy of your information in a portable format;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent where processing is based on consent; and
• opt out of the sale or sharing of personal information, or of targeted advertising, where applicable. For ads in the app, you can do this in your Android settings as described in Section 7.

To exercise these rights, contact us at the email address in Section 1. We will verify your identity before responding and will respond within the time required by applicable law. If you are not satisfied with our response, you may lodge a complaint with your local data protection or consumer authority. We will not discriminate against you for exercising your rights.

California residents: You have the rights described above under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We do not sell or share personal information as those terms are defined under California law.

10. Security

We take reasonable administrative, technical, and organizational measures to protect information from loss, misuse, and unauthorized access. Your tasks stay on your device.

Data in transit is protected by encrypted communication (HTTPS/TLS). No method of transmission or storage is completely secure.

11. Children's Privacy

The Services are not directed at children. We do not knowingly collect personal information from children under 13 years of age, or under the higher minimum age required in your country (such as 16 in some EEA countries). If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. For material changes, we will provide additional notice within the Services or by other appropriate means, and where required, obtain your consent.

13. Contact

For privacy questions or requests, contact us at:

Email: contact@luuvvi.com