1. Controller

Strudel Immobilien GmbH, Hasenbergstraße 15, 70178 Stuttgart, Germany, represented by managing director Tobias Tröndle — email: hallo@todoclub.org

2. What data we process

Account data: email address, name and profile picture from your login (Google, Microsoft, Apple or email/password). Stored with our processor Supabase (EU region Frankfurt).
Content: your tasks, stacks, substeps and chat messages — they are the core of the app and visible only to you (technically enforced via Row Level Security).
AI processing: chat messages and your open tasks are sent to the Anthropic (Claude) API to generate responses. Your data is not used for training.
GIFs: when you check off a task we load a celebration GIF from GIPHY. GIPHY receives your IP address in the process.
Hosting/logs: delivery via Vercel; technically necessary server logs (IP address, timestamp) are created.

3. Legal bases

Performance of contract (Art. 6(1)(b) GDPR) for your account and core features; legitimate interest (point (f)) for security and operations.

4. Retention

Your data is stored for as long as your account exists. You can request deletion of your account and all content by email at any time.

5. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a data protection authority.

6. Cookies

We only use technically necessary cookies for your login (session). No tracking, no advertising cookies.

7. Google Calendar integration (optional)

Only if you connect your Google Calendar, we additionally process the following data — solely for the purposes stated and only while the connection is active:

Reading your calendar (read-only): the title, start and end time of your events for roughly the next 48 hours, so ToDoClub can plan your day around existing appointments. This data is processed only at runtime and is not stored permanently (scope calendar.readonly).
Dedicated “ToDoClub” calendar: on request the app creates its own “ToDoClub” calendar and writes task reminders into it as events. Your other calendars are never read, modified or deleted (scope calendar.app.created).
Storage & revocation: access tokens are stored encrypted with Supabase and used server-side only. The connection is optional and can be disconnected anytime in settings — the stored tokens are then deleted.
Limited Use: we do not share this Google user data with third parties, do not sell it and do not use it for advertising. ToDoClub’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.