Privacy Policy

1. Purpose

This Privacy Policy is incorporated by reference into the Ertech Software Terms of Service. The terms “Ertech Software,” “we,” and “us” include Ertech Yazılım ve Bilgi Teknolojileri Limited Şirketi. It explains our online and offline information practices, the types of information we collect, how we intend to use, store, protect, disclose, and share that information, and how you can opt out, correct, or change such information.

2. Scope

This Privacy Policy applies to Personal Information processed by Ertech Software in the course of our business, including on our websites, mobile applications, forums, blogs, and other online or offline offerings (collectively, the “Services”).

It complies with global requirements, including those in North America, Europe, Turkey, APAC, and other jurisdictions. By visiting, installing, using, or accessing the Services, you give explicit and informed consent to the processing of your Personal Information in accordance with this Policy. Do not use the Services if you do not agree. Ertech Software is not responsible for the actions of third parties or the content of their sites, and reserves the right to modify this Policy.

3. Information We Collect and How We Use It

The types of Personal Information we collect and our practices depend on your relationship with Ertech Software and applicable law. We collect information through:

• Direct interactions with the Services.
• Participation in feedback, questionnaires, or surveys.
• Engagement in forums or contests.
• Automated collection through cookies and other tracking technologies.

3.1 From third-party applications

If you use the Services through connected third-party providers such as Apple, Google, Amazon, or social networks, we may receive information including your name, user ID, profile picture, location, and email. For mobile users we may collect your device ID, operating system, model, and IP address. We do not have access to your credit card or bank account data.

3.2 Directly from you

When registering for an account, responding to surveys, or contacting us, we may ask for your name, email, phone number, and profile photo.

3.3 Automated data collection

We and our service providers may use cookies, web beacons, and analytics tools to collect your IP address, device identifiers, browser type, and usage data to understand and improve the Services.

3.4 AI features (ToDoList AI Quick Add)

When you use AI Quick Add in ToDoList, the text you type (together with your device's date, time zone and language) is sent to our server and processed by Google Cloud Vertex AI (Gemini) to turn it into tasks. We do not store this text; Google holds it only briefly to process the request (up to 24 hours) and does not use it to train AI models. To enforce the monthly free limit we keep a usage counter tied to an anonymous app user ID, without the text. If you use voice input, your speech is converted to text by your device's speech recognition service before anything is sent to us. When AI Quick Add is unavailable or switched off, your text is processed only on your device.

3.5 Accounts and Google user data (Google Sign-In, Sign in with Apple and Google Drive)

Some of our apps, such as ToDoList, let you sign in with Google and back up your data to your own Google Drive. When you sign in with Google we receive your name, email address and Google account ID through Firebase Authentication, and use them only to create your account, show who is signed in, keep your backups tied to you, and keep your purchases on all your devices.

If you turn on Google Drive backup, the app asks for access only to the files it creates (drive.file) and to its own hidden app folder in your Drive (drive.appdata). We use this access only to save your backup there and to restore it when you ask. The backup holds your app data, such as tasks, lists and attachments; it goes directly from your device to your Drive, and we do not copy it to our servers or open other files in your Drive.

We do not sell Google user data, do not use it for advertising, and do not let anyone read it except where you ask us to (for example in a support request), where it is needed for security, or where the law requires it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you sign in with Apple, we receive your Apple account ID, the email address you choose to share (which can be an Apple private relay address) and, the first time only, the name you choose to share. We use them for the same purposes as above. We never show a private relay address to other people.

You can sign out or delete your account at any time in the app (Settings > Account), or without the app at ertechsoftware.com/apps/todolist/delete-account. You can remove the app's access to your Google account at myaccount.google.com/permissions, and delete its Drive backup in Google Drive under Settings > Manage apps. Deleting your account does not delete backups in your own Drive.

3.6 Synced and shared lists (ToDoList)

Without an account, your lists stay on your device. When you sign in (Google or Apple), your lists are stored on our servers so they are the same on all your devices and come with you to a new phone: each list's name, color and icon, its tasks (title, notes, dates and times, reminder and repeat settings, subtasks, priority and whether it's done) and their attachments (photos, videos, voice recordings and files). Lists and tasks are kept in Google Cloud Firestore (Europe), attachments in Google Cloud Storage (Belgium, europe-west1). This is not a backup: deleting a task on one device deletes it on all of them. A deleted task is kept as a small marker for up to 90 days so your other devices learn about it, then removed.

You can also share a list with other people. A shared list is stored the same way and every member's devices stay in sync; it also records who added each task and each member's display name, account ID and the profile photo of the Google account they signed in with. Invite codes expire after 7 days. Everyone in a shared list can see and edit its tasks and attachments and see the other members' names and photos.

In a shared list, members can say who does a task and write comments on a task. We store each assignment (the task and the member it is assigned to) and each comment (its text, its author's name and account ID, and when it was written or edited) with the list, and every member can see them. Only the author can edit or delete a comment. When someone assigns you a task or comments on a task, the other members get a push notification with the person's name, the task's title and, for a single comment, its beginning; you can mute a list's notifications in the app.

We use this data only to keep your lists in sync and do not use it for advertising. Free accounts can sync files up to 5 MB each and 1 GB in total, Premium accounts up to 100 MB each and 10 GB in total; larger files stay on the device that added them.

When you sign out, your lists stay on your device and stop syncing; their copy on our servers stays in your account. When you leave a shared list, you are removed from it; the last member leaving deletes it and its attachments from our servers. When the owner stops sharing, the list, its tasks and attachments are deleted from our servers; everyone keeps their own copy on their device. When you delete your account, your own lists and their attachments are deleted from our servers and you are removed from every shared list in the same way. Tasks and comments you added stay in lists that still have other members, shown with your name; email support@ertechsoftware.com if you want your name removed from them. Deleting a task deletes its assignment and comments. Drive and iCloud backups are separate and stay in your own Drive or iCloud.

3.7 Location reminders (ToDoList)

If you use location reminders, ToDoList asks for access to your device's location. Your current location is used only on your device, to find places when you search and to remind you when you arrive at or leave a place you saved; it is never sent to us, and we keep no location history. On Android, reminders that ring while the app is closed need location access “all the time”; the app explains this and asks only when you add your first location reminder. Place search uses your device's built-in geocoding service (Google on Android, Apple Maps on iOS).

The places you save (their name, address, coordinates and the size of the area) and which tasks remind you there are stored in the app and, if you sign in, in your own account on our servers (Google Cloud Firestore, Europe) so they appear on your other devices. They are never shared with other people, also not with the members of a shared list. You can delete a place in Settings > Places, which removes it and its reminders on all your devices; deleting your account deletes all of them. You can turn off location access at any time in your device settings.

3.8 Email to task and the browser extension (ToDoList)

Email to task is off until you turn it on in the app (Settings > Email & browser); it needs an account and synced lists (see 3.6). You then get a private forwarding address. Email sent to it (sender, subject, body and attachments) is received by our email provider Resend (USA; mail stored in the EU), which keeps it for a limited time and hands it to our servers. We accept it only when the sender's email provider confirms it is genuine (SPF, DKIM and DMARC) and, unless you turn this off, only from the addresses you list there (by default your account's email address). Mail from mailing lists, auto-replies and mail marked as spam is dropped. Accepted mail becomes a task in the list you chose: its sender, subject and body go into the task's note and up to 5 attachments, within a daily size limit, become the task's attachments, stored as described in 3.6. You get a push notification that a task was added, without its title.

To find dates and times, the subject (or, without one, the first lines of the body) is processed by Google Cloud Vertex AI (Gemini, Europe) as described in 3.4; the text you add with the browser extension is processed the same way. We keep no other copy of the email: a fingerprint of its message ID is kept for 7 days so the same email isn't added twice, and daily counters of how many tasks and how many bytes of files you added are kept for 3 days to apply the limits. You can get a new address at any time, which stops the old one, or turn email to task off.

The ToDoList browser extension (Chrome, Edge, Firefox and Safari) works only after you sign in with your ToDoList account. It sends the page's address and title and the text you selected only when you add a task with it, and keeps your sign-in and the list you chose in the browser. It does not read other pages, keep your browsing history or collect anything else. Signing out in the extension removes the sign-in from the browser. Deleting your account deletes your forwarding address and sender list, and your tasks as described in 3.6.

3.9 How we use it

• Providing and optimizing the Services.
• Responding to inquiries and requests.
• Sending updates via push notifications, email, or in-app messaging.
• Improving and personalizing your experience.
• Marketing activities and promotions.

4. How We Share Your Information

We may share Personal Information with service providers and business partners who perform services on our behalf (IT, payment processing, customer support); they are required to protect it. We may also disclose information to comply with legal obligations, protect rights, or as part of a merger, acquisition, or sale of assets.

5. International Data Transfers

Your Personal Information may be transferred to and stored in countries outside your jurisdiction, including the United States and Turkey. We take reasonable steps to ensure it is treated securely and in accordance with this Policy.

6. Your Rights and Choices

You have the right to access, rectify, or request deletion of your Personal Information, and to opt out of certain processing activities including marketing. To exercise your rights, contact support@ertechsoftware.com.

7. Data Retention

We retain your Personal Information for as long as necessary to provide the Services, comply with legal obligations, and resolve disputes.

8. Security

We take reasonable steps to protect your Personal Information from unauthorized access and use. However, no system is completely secure and we cannot guarantee absolute security.

9. Children’s Privacy

Our Services are not intended for children under 13, and we do not knowingly collect their Personal Information. If you believe we have, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are posted on this page, and continued use of the Services constitutes acceptance of the revised Policy.

11. Contact Us

For any questions about this Policy or how your Personal Information is handled, contact support@ertechsoftware.com.