How ZuDo encryption works.
Everything you write in ZuDo, and everything it learns about your life, is locked on your device with a key only you hold. Our server stores it sealed. We can't read it, and neither can anyone who gets hold of our database or backups.
What's locked
- Your tasks, with their titles, notes, dates, priorities, repeats and whether they're done.
- Your areas, people and things, and how they connect.
- Your profile and settings.
- Everything ZuDo learns from the tasks you fix.
What we can see
- Your email and your plan, so you can sign in and pay.
- That your devices synced, and when.
- Usage counts, like which features get used and how often. Never what you wrote, and never who or what a task is about.
Your password is the key
When you sign in, your password unlocks your list on that device. The password itself never leaves it: we get a proof made from it, not the password. Changing your password re-locks the same key, so nothing has to be re-encrypted.
ZuDo also gives you a recovery key, 28 characters long, and saves it in your phone's or browser's password manager wherever it can.
Forgot your password? If you're still signed in on another device, or you have your recovery key, nothing is lost. If you have neither, we can't open your old list for you. That's the whole point. You start fresh, and your plan stays.
When ZuDo's AI reads a note
Once you accept, to sort a new note its text passes through our server to an AI model from Google (Gemini), OpenAI or Anthropic, once. It lives in memory for that moment only. It's never saved in our database, our logs or our error reports, and none of them is allowed to train on it. Without your consent nothing is sent.
What this doesn't cover
Encryption protects your list on our side. Anyone using your unlocked phone or computer can see your list, like any other app on it. Use a password of at least 10 characters that you don't use anywhere else.
For the curious
Each record is sealed with AES-256-GCM under a random account key made on your device. That key is locked by a key derived from your password with a deliberately slow function, and separately by your recovery key. Record ids are replaced with opaque ones, so even the structure of your list stays private.