Privacy.
Last updated October 2026 · plain language, no legalese
Short version: everything you write in ZuDo is locked on your device with a key only you hold, so our server can't read it. If you allow AI, the text of a new note passes once through an AI model from Google (Gemini), OpenAI or Anthropic so ZuDo can sort it, under terms that forbid training on it. No ads, no selling data, and you can delete everything from the app at any time.
Your list is locked
Your tasks, notes, areas, people, profile, settings and everything ZuDo learns about you are encrypted on your device before they sync. Our server keeps them sealed and cannot open them, and neither can anyone who gets hold of our database or our backups. How the encryption works
What we can see
- Your email and your plan, so you can sign in and pay.
- A proof made from your password, never the password itself.
- That your devices synced, and when.
- Usage signals without any text, such as "a task was completed" or "an area was created", with a time and random ids. Never what you wrote, and never who or what a task is about.
- Purchase status: which plan you have and until when.
AI, and your choice
ZuDo asks you once, when you start, whether it may use AI to understand and sort what you write. You need to accept to use ZuDo. If you decline, you land on a calm screen and nothing you write is sent to any AI company. You can withdraw your consent any time in Settings, then Privacy, then AI help, and the app pauses until you accept again. Your data stays saved, and you can delete your account.
If you allow it, the text of a note or an answer, and only that, goes through our server to an AI model, once, so it can be understood and sorted. Today that model is Google (Gemini), served by Vertex AI on Google Cloud. We also name OpenAI and Anthropic here because we may use their models as a backup or later on, and you should never be asked the same question twice.
No AI company receives your email, your password or who you are. We use each one only through its paid developer API, under terms that say they do not train their models on what we send (Google Cloud's Vertex AI, OpenAI's API and Anthropic's API each say so today). The text is not saved in our database, our logs or our error reports. We keep only the size and cost of each call, to run the service.
Every outside company named on this page has to protect your data at least as well as this policy says we do, and we do not use one that does not.
These companies may process a request in any region where they run the model, so for a moment the text can leave the country you live in.
Before you have an account, the first interview also goes through our server. For that one we keep the IP address of the request for 30 days, only to stop abuse, and then delete it.
Your own AI assistant. If you connect an assistant such as Claude or ChatGPT in Settings, under Connections, it can read the kinds of things you choose to allow, and nothing else. What it does with them falls under that assistant's own terms. You can pause or disconnect it at any time.
Purchases
- Apple (App Store) and Google (Google Play): handle purchases made in the iPhone and Android apps, including trials, renewals, cancelling and refunds.
- RevenueCat: tells us what you bought. It knows you by a random account id, never by your tasks.
- Stripe: handles payments made on the web. ZuDo never sees or stores your card details. See Stripe's privacy policy.
Who else handles your data
- Hetzner: hosts our database and server in the European Union.
- Resend: delivers our emails to you: password reset codes, security notices, and the waitlist and launch emails.
Beyond the companies on this page, nobody receives your data. We use no advertising networks and no tracking, and we don't follow you across other companies' apps or websites.
Crash reports and website analytics
The desktop and web apps send anonymous crash reports and feature counts so we can fix bugs: the error message, the app and system version, a random install id, and the kind of action that came just before. Never your tasks, notes or other personal content. You can turn them off any time in Settings, under Privacy.
On this website we run our own privacy-preserving analytics: anonymous counts of page views, button clicks, scroll depth, FAQ opens and which pricing plan draws interest. It sets no cookies and keeps only a random session identifier in your browser's session storage, erased when you close the tab. No IP address is stored, and Do Not Track is honoured.
The waitlist
When you join the waitlist we keep your email address, the language of the page, the kind of device you signed up from (iPhone, Android, Mac, Windows), where you came from (the site or ad link that sent you), which headline you saw and which items you tapped in the Quick check. We use it to send you a confirmation link and one email on launch day, and to see which links and headlines bring people in. Nothing else, and it's never shared or sold. To leave, email contact@py-company.com and we'll delete it.
Keeping and deleting your data
To delete your account, open the app, go to Settings, then Delete account, and confirm with your password. Everything in your account, including your sealed list and its keys, leaves our database right away. Daily database backups are kept for 7 days, so they are gone within a week.
No app at hand? Email contact@py-company.com from the address on your account and we will delete it once we have confirmed it is you.
A web subscription (Stripe) is cancelled with your account, with no final charge. Deleting does not cancel a subscription bought through Apple or Google: cancel it first in the App Store or Google Play, or it keeps renewing.
Payment companies keep their own records of what you paid, as the law requires of them.
The desktop and web apps let you download a full export of your data from Settings, unlocked on your device.
If you forget your password and have neither a signed-in device nor your recovery key, we can't open your old list: you start fresh, and your plan stays.
Your rights
Under Brazil's LGPD and Europe's GDPR you can ask what we hold about you, have it corrected, exported or deleted, and object to how it is used. Write to contact@py-company.com. We answer within 15 days.
No ads, no profiling, no selling data
ZuDo shows no ads, never profiles you, and never sells or rents your data to anyone.
Contact
ZuDo is made by PY. Questions about this policy or your data: contact@py-company.com