r2todo Privacy Policy
DRAFT for review by a lawyer before publication. Placeholders in square brackets must be filled in. Effective date: [DATE].
r2todo is operated by Ever Onwards LLC, a Massachusetts limited liability company ("we", "us"). This policy says what we collect, why, who sees it, how long we keep it, and what you can do about it. It is written to be read.
What we collect
Account information. Your email address, a password hash if you sign up with a password, and your name and email from Google if you sign in with Google. We never see your password.
Your content. The todos, pages, notes, tags, spaces and attachments you put in your workspace. This is yours. We store it so the product works.
Connections. If you connect a calendar or mail account, we store an access token and a refresh token for that account, encrypted, along with which permissions you granted and when the connection was last used. We do not store your calendar or your mailbox. We read from them only when you ask R2 to do something that needs it, and we write to them only after you confirm the action in the app.
AI usage. For each request to the AI assistant we record which feature was used, how many tokens went in and out, and the cost. We do not keep the text of the request beyond what is in your workspace already.
Billing. Stripe handles payment. We store your Stripe customer id, your plan and its status. We never see or store your card number.
Technical logs. Request ids, the route called, the response status, the duration, and a hashed form of your IP address, kept for 30 days for security and debugging. Logs never contain your content.
Activity log. Sign ins, failed sign ins, password and email changes, connections made and removed, exports, deletions, and every action R2 takes on your behalf, shown to you in settings as recent activity.
What we do not collect
No advertising identifiers. No third party analytics or tracking scripts. No cookies other than the one that keeps you signed in. No location. No contacts lists. Nothing from your calendar or mailbox is copied into our systems beyond the single event or message R2 is acting on at your request.
How we use it
To run the product, to bill you, to answer support requests, to keep the service secure, and to send you the emails the product needs: verification, password reset, receipts, and notices about your account. We do not send marketing email unless you opt in, and every such email has an unsubscribe link.
The AI assistant and what leaves our systems
R2 is powered by Claude, a model made by Anthropic. When you use an AI feature, the following is sent to Anthropic's API and nothing else:
- The command box: the sentence you typed, any public Google document you linked or file you attached, the names of your spaces, and the text of the open todos in the space you are looking at.
- R2 on a todo: the sentence you typed, that one todo, the names of your spaces, which kinds of connections you have, and your time zone.
- Ask: the todo you asked about, your question, and up to eight short passages from your own workspace that mention it.
- Combining two pages: the text of the two pages.
Under Anthropic's commercial terms, API inputs and outputs are not used to train their models. Anthropic's retention of API data is governed by their policy and our organisation's settings, which are: [RETENTION SETTING AS SHOWN IN THE ANTHROPIC CONSOLE].
If you choose to use your own Anthropic API key, the same data is sent under your own agreement with Anthropic, and we store your key encrypted and never display it again.
Google and Microsoft data
If you connect Google Calendar, Gmail, or a Microsoft account, we request only the permissions the feature you turned on needs, and we use the data only to do what you asked. Specifically:
- Calendar: to create, update or cancel events you ask R2 to create, update or cancel.
- Mail: to send messages you ask R2 to send, after you confirm them.
r2todo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no human at Ever Onwards reads it except with your permission to resolve a support issue, for security, or as required by law.
Disconnecting a connection in settings revokes our access at the provider and deletes the tokens we held.
Who else sees data
The services we run on, each of which processes data only to provide its service to us:
- Vercel, hosting.
- Supabase, database, authentication and file storage.
- Anthropic, the AI model, as described above.
- Stripe, payments.
- Google and Microsoft, only if you connect an account.
- Resend, transactional email.
The current list is always at https://r2todo.com/subprocessors. We do not sell personal data and we do not share it with anyone else, except when the law requires it or to protect the rights and safety of people using the service.
Where data lives
Our servers are in the United States. If you use r2todo from elsewhere, your data is transferred to and stored in the United States.
How long we keep it
For as long as your account exists. Todos you put in the trash are purged 30 days later. Page revisions are kept for 90 days on the free plan and longer on paid plans. Technical logs are kept for 30 days. When you delete your account, everything is deleted within 30 days, including attachments and backups that age out on their own schedule of no more than 30 days, and your connection tokens are revoked at the provider immediately.
Your rights and how to use them
Wherever you live, you can, from inside the app: see everything we hold about you, export it as a zip of plain files, correct it, disconnect any connection, and delete your account. If you are in the European Economic Area, the United Kingdom, or a US state with a privacy law, you also have the rights those laws give you, including to object to or restrict processing and to complain to your supervisory authority. To exercise any right we cannot offer in the app, email privacy@r2todo.com. We answer within 30 days.
Security
Everything travels over TLS. Passwords are hashed with a modern algorithm. Provider tokens and any AI key you give us are encrypted with a key that is not stored with the data. Every account's data is isolated at the database level. Access to production is limited to the people who run the service, uses multi factor authentication, and is logged. If we ever have a breach affecting your data, we will tell you without undue delay and say what happened.
Children
r2todo is not for children under 16 and we do not knowingly collect their data. If you think a child has an account, email privacy@r2todo.com and we will remove it.
Changes
If we change this policy in a way that matters, we email every account before it takes effect. Small clarifications are noted at the top with the date.
Contact
Ever Onwards LLC
82 Wendell Ave, Ste 100, Pittsfield, MA 01201, United States
privacy@r2todo.com