Privacy Policy — TODO Cache

Last updated: 26 July 2026

TODO Cache is made by devapptr. This policy explains what the app does with your information. It is written to match what the app actually does; if the app changes, this page changes with it.

Your tasks stay on your device

Every task you create — its title, date, checklist items and notes — is stored on your iPhone. It is not uploaded to us, it is not backed up to our servers, and we cannot read it. Tasks are shared with the app’s Home Screen widget through a private storage area on your device, and nowhere else.

Deleting the app deletes your tasks with it.

Adding a task with your voice

When you hold the microphone button and speak:

1. Your speech is turned into text. This is done by Apple’s speech recognition on your device. Depending on the language and the device, Apple may process the audio on its own servers; that part is governed by Apple’s privacy policy. The audio recording itself is never sent to us and is not saved anywhere by the app.
2. The text is sent to our server (operated on Cloudflare Workers) together with your device’s current date, time zone and language, so that “tomorrow at three” can be resolved into an actual date.
3. Our server forwards that text to OpenAI, which extracts the task’s title, date, time and checklist items and returns them. OpenAI processes it under the OpenAI API data usage policies.
4. The result comes back to your device and is shown to you for confirmation before anything is saved.

We do not store the text of what you say. It passes through our server to produce the result and is not written to any database or log.

What our server does keep

To stop strangers from using our endpoint at our expense, each request is signed by your device using Apple’s App Attest. For that we store, per device:

• A device key identifier — a random value produced by Apple’s App Attest. It is not your Apple ID, your phone number, your advertising identifier, or anything that identifies you as a person, and it changes if you delete and reinstall the app.
• The signature counter for that key, used to reject replayed requests.
• When the device was first seen and last seen.
• How many requests it made on a given day, so a daily limit can be enforced.

That is the complete list. There is no account, no name, no email address, no location, and no contents of your tasks.

Notifications

Reminders are scheduled and delivered by your device. Nothing about them is sent to us.

What we do not do

• We do not track you, and we do not use tracking technologies.
• We do not show ads and we do not work with advertising networks.
• We do not sell or share your information with anyone.
• We do not collect analytics about how you use the app.

Permissions the app asks for

• Microphone — to record while you hold the button.
• Speech recognition — to turn that recording into text.
• Notifications — to remind you when a task is due.

Each is asked for the first time it is needed, and the app works without them; only the feature that depends on the permission stops working.

Children

The app is not directed at children and does not knowingly collect information from them.

Changes

If this policy changes, the date at the top changes and the updated version is published at this address.

Contact

Questions about this policy: ismail@devapptr.com