Privacy policy

PEPS To Do is made by PEPS Media. This page explains in plain words what we store about you, why, and what you can do about it. Questions: [email protected].

What we store

• Your account: your name, email address, timezone and the public part of your passkeys (the private key never leaves your device).
• What you put in: todos, lists, notes, screenshots, snippets, paste fields, your reading list and calendar notes. Snippet values and notes, and paste fields, are encrypted at rest.
• Connected apps and tokens: which AI apps (like ChatGPT or Claude) and API tokens you allowed, what they may access, and when they were last used.
• Activity log: what changed, when, and through which app or token, so you can always see what happened.
• Technical data: sessions, your IP address and browser in server logs, to keep your account secure and the service running.
• Notifications: if you turn on the morning notification, the push address your browser gives us for that device.

Why

Only to run PEPS To Do for you: to show your lists, sync them across your devices, send the emails you need (verifying your address, sign-in links) and the notifications you turned on, and to keep the service secure. We don't sell your data, don't show ads and don't use your content to train AI models.

AI features

Reading list summaries and the AI assistant (brain dump, plan my days, "I have time", clean up, sort and split) send the text needed for that one request to our AI provider, currently Claude by Anthropic, and only when you use the feature (a saved link is summarised when you save it). To read saved links we fetch the page through Cloudflare, or ScrapingBee when a site blocks that. Everything the AI suggests is shown to you first.

When you connect an AI app such as ChatGPT or Claude yourself, that app can read and change what you allowed it to, and its own privacy policy applies to what it does with that.

Who helps us run it

• Our hosting provider, where the app and its database run.
• Cloudflare, in front of the website and for reading saved pages.
• Anthropic (Claude) for AI summaries and the assistant; ScrapingBee as a fallback for reading pages.
• Our email provider, for verification and sign-in emails.
• The push service of your browser (Google, Apple or Mozilla), for notifications you turned on.

How long we keep it

As long as you have an account. Deleted todos stay in the trash for 30 days so you can restore them, then they are removed for good. When you delete your account (Settings → Profile), your data is deleted.

Your rights

You can see, change and delete your data in the app at any time. You can also ask us for a copy, a correction or deletion, or object to how we use it: email [email protected]. If you think we handle your data wrongly, you can also complain to your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

Changes

If this policy changes in a way that matters, we'll say so in the app or by email.