1. Who we are
InkDone (the “App”) is a to-do and task list app developed and published by Tendanto Ltd, a private limited company registered in England & Wales (company no. 17481182), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). Tendanto Ltd is the data controller for this policy.
This policy covers the InkDone app for Android and the web app at inkdone.app. It is version 1.6.
2. In short
InkDone has no user accounts; we never ask for your name, email or phone number.
InkDone is free to use on your phone. InkDone Plus (monthly, yearly or once) is sold through Google Play and adds sync between your devices, shared lists and no ads. Your lists, tasks and notes are stored on your device. With Plus they are also synced through our servers, end-to-end encrypted: they are encrypted on your device before they leave it, with a key that only your devices have, so we cannot read them. A list you share, or join, is encrypted the same way, with a key of its own that only the people in it have.
Google Drive backup is optional. If you turn it on, a backup file goes directly from your device to a hidden folder in your own Google Drive, not through our servers. Files you attach to tasks are stored on your device and, to sync them, in that same folder of your own Google Drive, not on our servers.
Without Plus, or when a subscription ends, the App keeps working on your phone, without sync; the lists already on your phone stay there.
The free version shows one small ad for another of our own apps; the request for it carries no personal data (see “Ads in the free version”). The App also sends anonymous usage counts to our own server with a random installation ID that you can reset (see “Anonymous usage counts”). No third-party ad networks, analytics or tracking tools. We do not sell your data or share it for advertising.
3. Information stored on your device
Your lists, tasks, notes, dates and times, deadlines, repeat rules, stars, settings, and the files and voice notes you attach to tasks are kept in the App’s storage on your device. The App also keeps one automatic backup file of this data in its own private storage on the device. If you add the App’s home-screen widget, the titles and dates of the tasks it shows are also kept, unencrypted, in the App’s private storage for the widget to draw them. Uninstalling the App deletes all of these.
If Android’s automatic backup is on, the operating system may include this data in the backup in your own Google account; we have no access to it (Settings › Google › Backup).
4. Google Drive backup (optional)
Any user can turn on Google Drive backup in the App’s Settings. You sign in with Google on your device and grant the “drive.appdata” permission. The App then writes one backup file into the App’s hidden app-data folder in your own Google Drive, a few seconds after you make changes.
With this permission the App can see only that folder, not your other Drive files. The backup goes directly from your device to Google, under Google’s own privacy policy; it does not pass through our servers.
You can disconnect at any time in the App’s Settings. To delete the backup file, use Google Drive’s settings (Manage apps).
With InkDone Plus, the backup file is encrypted on your device with your encryption key before it is written to Google Drive.
5. Export
You can export your tasks as an Excel, CSV, JSON or Markdown file through Android’s share sheet; it goes only where you choose. The App does not import files.
6. Reminders
Reminders are local notifications scheduled on your device. Nothing is sent to a server for them.
7. Ads in the free version
Without Plus, the App shows one small card under its buttons advertising another of our own apps (such as Hourcrumb or Oftaro). There are no ads with Plus, and no ads from other companies or ad networks.
To choose the ad, the App asks our ad server (api.tendanto.com) with only the App’s name, its language and the platform (Android), and, when the card changes, the ad it replaces. No cookies, no advertising ID, no device or account identifier and nothing about your tasks are sent.
The ad comes with a random token that is valid for 24 hours. The App sends it back when the ad is shown and when you tap it, with the random installation ID described in “Anonymous usage counts”, so that we can count views and taps; we keep daily totals per ad and never the ID itself. Tapping the ad opens its Google Play page, with a tag saying the visit came from InkDone.
Like any request, these reach our server logs (see “Server logs”).
7b. Anonymous usage counts
To see how InkDone is used and improve it, the App sends counts of events to our server (api.tendanto.com, run by us), for example “the app was opened”, “a task was added”, “the timer was started”, “an intro page was reached”, “the Plus screen was opened” or “a purchase was made”, with the App’s version, your platform (Android or the web app) and, once a day, your interface language.
A request carries no advertising ID, no account or device hardware identifier and no cookie, and never your lists, tasks, notes, hashtags or anything you type. The App remembers on your device the last day, week and month it was opened, and sends “active today / this week / this month” only on the first opening of each (and, once a day, whether that device has Plus). Like any web server, ours sees the IP address of the request to answer it; we do not store it with the counts or use it to identify you.
On first launch the App creates a random installation ID that stays on your device (it is left out of device backups and of sync). It is not linked to your account, advertising ID or device hardware, and it is sent with the usage counts. Our server never stores the ID itself, only an irreversible hash of it (different for each of our apps): with the usage events for 48 hours, and as a daily summary (first day seen, days active, the day Plus started) for 35 days, to understand whether people come back. The rest is kept only as daily totals per event, platform and version.
Usage counts are part of how the App works and cannot be turned off. You can cut the link to past data at any time with Settings › Help › Reset analytics ID, which deletes the ID and creates a new one; you can also write to us. We rely on our legitimate interest in understanding and improving the App.
8. Sync (InkDone Plus)
Sync has no sign-in. When you subscribe or restore your purchase, the App sends us your subscription’s Google Play purchase token, which we check with Google to confirm the subscription is active. Your synced data is linked to that subscription, not to your name or email. Any device where you restore the same purchase (with the same Google account) can sync the same lists.
We keep a one-way hash of the purchase token to recognise your subscription, and the token itself encrypted, only to re-check the subscription with Google from time to time. We also keep the subscription’s state and expiry date.
End-to-end encryption. The first time you use Plus, the App makes a random 256-bit encryption key on your device. Before anything is synced, the App encrypts your lists, tasks and the details of attached files (titles, notes, date and time, deadline, repeat, extra reminders, starred, completed, order, file names, types and sizes) with that key (XChaCha20-Poly1305). Our servers store and pass on only this encrypted data. Without the key it cannot be read, by us or by anyone who got hold of our servers.
What our servers can still see is what they need to sync: a random identifier for each item, which list or task it belongs to, when it was last changed, and whether it was deleted. We also keep an identifier of your key (a one-way hash that cannot be turned back into the key), so that a device with a different key is not mixed in.
Where your key is kept. On each of your devices, in the device's secure storage (Android Keystore; in the web app, the browser's storage). If you connect Google Drive, the App also keeps a copy of the key in the App's hidden app-data folder in your own Google Drive, so that a new phone signed in to the same Google account gets your tasks back. That copy goes directly from your device to Google and does not pass through our servers. Without Google Drive, a lost or reset phone means the synced tasks cannot be decrypted again.
Adding a device. A new device gets the key from your Google Drive, as above, or by scanning a QR code from a device that already has it: the new device shows a one-time public key in the QR code, your device encrypts the key for that one device (X25519), and our server passes on only the encrypted result, which it cannot read. You can also show your recovery key (your key, written out) in Settings and type it on another device. Keep it private: anyone who has it can read your synced tasks.
When you delete an item, its encrypted data is erased from our servers. Only its identifier and timestamps remain, so that your other devices learn about the deletion.
While the App is open it keeps a connection to our server, so that a change made on one of your devices reaches the others at once. Over it the server only sends a short “something changed” notice, without the content of your tasks; the devices then sync as above. Delete account in the App’s Settings erases your synced data, together with the stored subscription information, from our servers. If your subscription ends, sync stops; the App keeps working on your phone and the lists there stay.
Files and voice notes attached to tasks do not come to our servers. To sync them, the App uploads each file directly from your device to the App’s hidden app-data folder in your own Google Drive (the same “drive.appdata” permission as the backup, once you connect Google Drive), under Google’s own privacy policy. Your other devices download them from there when they are connected to Google Drive with the same Google account. Our servers keep only each file’s name, type and size, which task it belongs to, and the identifier of its file in your Drive. The files themselves are stored there unencrypted (their names, types and sizes on our servers are encrypted, as above); anyone with access to your Google Drive, including Google, can open them. Deleting an attachment in the App also deletes its file from your Drive; until you connect Google Drive, a file stays only on the device where you attached it.
8a. Shared lists
With InkDone Plus you can share one of your lists. Anyone with its invite code or link can join it, with or without Plus, and without an account: the App gets a random key for that list alone, which we keep only as a one-way hash.
Each shared list has its own encryption key, made on the device of the person who shares it. The key travels inside the invite link, after the “#”. Browsers and the App keep that part to themselves, so opening the link sends neither the code nor the key to our server. This is why a list can only be joined by its link, not by typing the code alone.
For a shared list we store its title and tasks (title, notes, dates and times, deadline, repeat, completed, archived, order) and the name each person chose to show the others (it can be left empty) encrypted with the list's key, which our servers never have. In plain form we store each person's role (owner or member), when each person's device last synced, and each task's identifier and timestamps. Everyone in the list can read its contents. Stars, extra reminders and attached files are not shared and stay on each device. On your own Plus account, the list keeps the share's identifier and its key, encrypted with your own key, so that your other devices open the same list.
When someone leaves a list, or its owner takes them out, their name is deleted from it and their access ends; they keep the copy already on their phone. When the owner stops sharing, or deletes their account, the shared list and its tasks are deleted from our servers. While the owner's Plus has ended, the list doesn't sync for anyone.
9. InkDone Plus (Google Play and RevenueCat)
Payment is handled by Google Play; we never see your card details. Google Play charges the subscription and renews it until you cancel in Google Play.
To manage your subscription in the App we use RevenueCat, Inc. (USA), with a random anonymous app user ID. RevenueCat receives purchase and subscription information from Google Play and processes it on our behalf. Details: revenuecat.com/privacy
10. Server logs
When the App talks to our servers (sync, purchases, the free version’s ad and the anonymous usage counts), our servers log IP addresses and request metadata for security and rate limiting. We keep these logs for a short period, at most 30 days.
11. Permissions
The App uses internet access (sync, Google Drive backup and attachments, purchases, the ad in the free version and the anonymous usage counts), notifications (reminders), Google Play billing (purchases) and, only when you record a voice note, the microphone.
The microphone is asked for the first time you hold the mic button, and is used only while you record: the recording is saved as a voice note on the task, on your device, and is not turned into text or sent anywhere else. You can withdraw the permission in Android’s settings. The App never asks for your location, your contacts or the camera.
12. Who receives data
Google: if you turn on Google Drive backup or sync attached files through Google Drive, under Google’s own policy; Google Play: your purchase, for payment and refunds; we also ask Google Play whether your subscription is active.
RevenueCat (our processor): an anonymous user ID and your subscription information.
We do not sell your data and do not share it for advertising. The free version’s ads are our own and served by our own server; no advertising company receives anything.
Our servers receive your synced lists and tasks only in encrypted form (see “Sync”).
Our server: the anonymous usage counts described in “Anonymous usage counts”.
13. International transfers
Google and RevenueCat may process data in other countries, including the United States. Transfers from the UK and the EU rely on safeguards such as the standard contractual clauses those companies use.
14. Children
The App is not directed at children under 13, and we do not knowingly collect data from children.
15. If you email us
If you contact us for support, we use your email address and message only to answer your request, on the basis of our legitimate interest in replying to you. We keep the correspondence for up to two years after your request is resolved, then delete it.
16. Your rights
Under UK data protection law (UK GDPR) you have the rights of access, rectification, erasure, restriction, objection and portability. Users in the EU have the same rights under the GDPR and may complain to the supervisory authority in their country.
For any request, including deleting your InkDone Plus synced data or purchase records held by RevenueCat, email support@tendanto.com. We will respond within one month. You can also delete your account and all its synced data yourself in the App’s Settings (Delete account).
You can complain to the UK Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to help first: support@tendanto.com.
17. Changes
If we add a feature that changes how data is processed, we will update this policy before that version is released and show the new date at the top of this page.
18. Contact us
Questions about this policy or your data? Email support@tendanto.com or write to us at Tendanto Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.