Privacy Policy

Last updated: October 5, 2026

Today Loop is built to be calm, helpful, and respectful of your privacy. This policy explains, in plain language, what happens to your data.

Short version: Your tasks stay on your device. We do not run user accounts and we do not sell your data. You choose how AI runs in Settings: On-device only (nothing leaves your device), Full privacy (on-device plus Apple's Private Cloud Compute, which does not retain your data — on Free only as a limited fallback; Pro unlocks fuller Apple cloud AI), or Hybrid AI (also uses our proxy to third-party models). With Hybrid AI, the text of a single request — plus, for list suggestions, a short list of typical words per list computed on your device — is sent through our proxy to generate a result. We do not store that text. The only server-side records tied to you are short-lived technical ones — usage counters and, for up to 24 hours, a copy of the answer so that a retried request gets the same result — and they are all listed below under "What stays on our servers".

What we collect

• Your content (tasks, notes, summaries, reminders, recurring templates, trackers, challenges, expenses, attachments). Stored locally on your device using Apple's on-device database. We do not store your content on our servers. Attachments you add to a task — a photo, a file, a contact picked from your Contacts, a place picked on a map, a link — stay on the device as part of that task and are never uploaded.
• No account. Today Loop has no sign-up and no login, so we do not collect your name, email, or a user profile. For Hybrid AI, the server uses a pseudonymous identifier (a keyed hash of your App Store transaction id) — not your email or name — to verify Pro status and enforce limits.
• Subscription verification (Hybrid AI). When Hybrid AI is enabled, the app sends a signed App Store transaction to our proxy so we can confirm an active subscription. We verify it and cache the result for at most one day; we do not store payment details (Apple does).
• Usage counters (Hybrid AI). After proxy AI calls we store only numeric counters (tokens / operations) keyed by the pseudonymous id, to enforce fair-use limits. Daily counters expire within two days, monthly counters within six weeks.
• Retry cache (Hybrid AI). So that the app gets the same answer if it has to retry a request (for example after a dropped connection), the proxy keeps a copy of that answer for up to 24 hours, keyed by the pseudonymous id and a random request id. The answer is the AI result for that one request — for example a structured task — and it is deleted automatically.
• App integrity (Hybrid AI). We may use Apple App Attest to help ensure requests come from genuine app builds. The App Attest key identifier and its link to your pseudonymous id are kept for up to 400 days. This is not an advertising identifier and does not include your location or device name.
• Diagnostics. Only if you turn on Anonymous analytics, we send anonymous usage signals (for example that you finished onboarding or opened the app again) to TelemetryDeck, a privacy-focused analytics service in the EU, together with the app version, iOS version and device model. Signals do not include task titles, notes, amounts, or any identifier you typed. TelemetryDeck assigns a random install id; this is not an advertising id and is not used to track you across apps. Analytics is off until you turn it on: the app asks once, after your first finished day, and the switch is in Settings → Privacy, where you can turn it off again at any time. Proxy logs (Hybrid AI only) contain metadata only (latency, status, token counts) — never task text. We do not run advertising SDKs.

AI processing modes

You choose how AI runs in Settings → Privacy. Whatever the mode, secret lists / secret tasks are never sent off your device, plans for money, weight and sleep challenges are built only on the device — never in any cloud, Apple's included — and on-device AI is always used when it can handle the request in the content's language.

On-device only

All AI ("Structure with AI", summaries, tags, challenge plans) runs on your device using Apple Intelligence. Your text never leaves the device. When your device or the content's language is not supported on-device, unsupported AI features are simply hidden or replaced by non-AI (algorithmic) results.

Full privacy (on-device + Apple Private Cloud Compute)

Adds Apple Private Cloud Compute (PCC) on supported devices. On Free, PCC is used only as a limited fallback when on-device AI cannot serve a request (for example unsupported content language). Pro unlocks fuller Apple cloud AI for Pro features such as challenge planning. PCC runs Apple-operated models inside Apple's privacy-preserving cloud: requests are processed to return a result and are not stored or used to train models, and no third party is involved. This keeps everything within Apple's contour. This is the default mode for new installs.

Hybrid AI (adds our proxy)

Hybrid AI is Pro-only and opt-in: you enable it in Settings and accept a one-time consent before the first request. It adds our own proxy to third-party models on top of the above (for top-quality models and broader language coverage). You can switch back to another mode anytime.

What is sent (Hybrid AI): Only the minimal text for that single request — for example a note to structure, a reminder phrase, or a challenge goal together with the constraints you typed — never your full history. The evening summary sends the number of finished and remaining tasks, the titles of the top remaining ones and your streak, never amounts. The weekly recap and insights send aggregate figures for the week — planned and completed counts, weekday pattern, streak, how many days you marked as good, okay or rough, and how many trackers were met — with no task text.

List summaries (Hybrid AI, list suggestions only): When the app suggests which list a task belongs in, it also sends a short summary of your lists, computed on your device: for each list, up to twelve single words that are typical of it (for example "kitchen, repair, plumber"), most typical first. This is derived data rather than your content — it contains no sentences, no counts and no task text, and a word cannot be traced back to the task it came from. It is used only to pick a better list, is not kept on our servers, and is never sent in the other AI modes. Secret lists and secret tasks are excluded.

How it is processed (Hybrid AI): Requests go through our Cloudflare Worker proxy. By default the model is served via OpenRouter, which routes to an underlying model provider (currently OpenAI GPT-5.6 Luna). If OpenRouter is unavailable or out of credit, we may use DeepSeek directly. Providers process the request to return a result; we do not keep the request text on our servers. Cloudflare and the model providers may process the request outside your country, including in the United States.

Image generation (Hybrid AI, Pro). If you choose to generate a motivational cover or milestone artwork for a challenge, the challenge description you wrote (for example "train for a triathlon") is sent through the same proxy to a third-party image-generation provider to create the picture. Only that text is sent — never your photos, contacts, or identity — and we do not keep it on our servers. Images are generated only when you ask (never automatically) and the result is stored locally on your device.

What stays on our servers (Hybrid AI): We do not store your tasks or notes on our servers, so there is nothing there to delete. The records tied to your pseudonymous id, and how long they live, are: rate-limit counters (minutes); daily usage counters and metrics markers (two days); monthly usage counters (six weeks); the cached Pro status (up to one day); the retry cache (24 hours); and the App Attest key link (400 days). All of them expire on their own. If you never enable Hybrid AI, none of these records exist. Deleting the app removes local data from the device.

Subscriptions

Purchases are handled by Apple via the App Store (StoreKit). We do not see your payment details. Apple shares with us only whether a valid subscription is active, so we can unlock Pro features. Manage or cancel anytime in your Apple account settings. Pro is a recurring subscription (monthly or annual); there is no lifetime purchase.

Voice capture

When you tap the microphone to capture a task by voice, the app uses your microphone and Apple's speech recognition. Depending on your device and language, Apple processes the audio on the device or on Apple's servers, under Apple's privacy terms. The audio is never sent to us, and the app keeps no recordings: only the recognised text becomes your task, stored like any other. You can decline the microphone and speech recognition prompts and keep typing.

Notifications

Reminders are scheduled locally on your device. Granting notification permission is optional and does not affect core features. We do not use remote (push) notifications.

Camera and photos

When you tap Scan receipt, Today Loop uses the device camera to capture a receipt. Text recognition runs on your device. The photo stays on the device as a task attachment and is never uploaded. You can decline the camera prompt and still pick a photo from Photo Library; the system picker hands the app only the photo you choose.

App Lock and secret lists

• App Lock protects the app with a six-digit passcode and, if you turn it on, Face ID or Touch ID. The passcode is stored only as a salted hash in your device's Keychain. Biometrics are checked by iOS; the app never receives your face or fingerprint data.
• Secret lists (Pro) encrypt task text on the device with a key tied to this device and to a separate PIN. There is no recovery: a forgotten PIN means the data cannot be decrypted — not by us either. Secret lists never use AI in any mode, never leave the device, and are left out of exports and shared links.

Sharing, export, and backups

• Share task creates a link that carries the task's title, type and priority. You pick the recipient in the iOS share sheet; the link goes directly from your device to theirs, and we are not involved.
• Export data writes your lists and tasks to a JSON file — without secret lists and without attachment files — that you save or send yourself. Import data reads such a file back, or an export from Todoist or TickTick that you choose. The file is read on the device and is not sent to us.
• Import from Reminders asks for access to Apple Reminders only when you tap it. The app reads your open reminders on the device and copies the lists you choose into Today Loop; it changes nothing in Reminders and sends nothing to us. You can withdraw access in iOS Settings → Privacy & Security → Reminders.
• Widgets, Lock Screen activities, Siri and Shortcuts, and the Share extension run on your device and read the app's local data. If you add a widget, task titles appear on your Home or Lock Screen.
• Backups. The app's data is part of your iPhone backup (iCloud or computer), under Apple's terms. Secret lists stay encrypted in the backup and cannot be opened on another device.

Data sharing

We do not sell, rent, or trade your data. We do not share it with advertisers. Third parties involved are Apple (App Store, on-device AI, Private Cloud Compute, App Attest, speech recognition, and Maps when you attach a place); TelemetryDeck (anonymous usage signals, only if you turn analytics on); and, only if you opt into Hybrid AI, our proxy host (Cloudflare) and AI providers (DeepSeek and, when used, OpenRouter / underlying models) for that single request — and, only when you generate challenge artwork, a third-party image-generation provider that receives the challenge description for that request. Apple Private Cloud Compute (used in Full privacy and Hybrid AI) is operated by Apple and does not involve any other third party.

Your control

• Delete any task, summary, or template at any time inside the app.
• Delete the app to remove all locally stored data from your device.
• Decline notifications, AI, the microphone, the camera, or access to Reminders — the app still works. Without the camera you can still pick a receipt from the photo library.
• Choose On-device only in Settings to keep everything on your device, or a non-Hybrid mode to stop sending request text to our proxy.
• Anonymous analytics stays off unless you turn it on; switch it off in Settings → Privacy at any time to stop sending usage signals to TelemetryDeck.

Children

Today Loop is not directed at children under 13 and does not knowingly collect their data.

Changes

If this policy changes, we will update the date above and post the new version here and on todayloop.app/privacy. This policy is published in English and in translation; if a translation differs from the English text, the English text applies.

Who we are

Today Loop is made and operated by IMPORTANT DREAMS, MCHJ, a limited liability company registered in the Republic of Uzbekistan (Markaz MFY, Fazogir street 24, Boyovut district, Syrdarya Region, 120201). For the limited data described above, we are the data controller. More about the company: importantdreams.com.

Contact

Questions about privacy? Email us at [email protected].