Todo Assist Privacy Policy

Last updated: 2026-09-09

This Privacy Policy explains how App Waffle LLC ("App Waffle," "we," "us," or "our") handles information in connection with the Todo Assist iOS application (the "App"). It is written to be readable in plain English while still meeting the disclosure requirements of applicable privacy laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (collectively, "CCPA"), and the U.S. Children's Online Privacy Protection Act ("COPPA").

Our marketing website at appwaffle.com is covered by a separate Privacy Policy. If you have any questions, email us at privacy@appwaffle.com.

The short version

Todo Assist stores the lists and tasks you create so the App can show your inbox, lists, categories, tags, due dates, widgets, and optional Profile progress. Native lists sync through your iCloud account using Apple's CloudKit. Native due alerts are local notifications on your device. Native arrive/leave alarms can use Location Services (Always) to fire; GPS is not used to fill the place name. If you link an Apple Reminders list, the App reads and writes that list through Apple's Reminders (title, notes, completion, due date, URL, location text, priority, recurrence, and alarms). Categories, tags, and assignee labels on linked tasks stay in Todo Assist and are not written to Reminders. Sign in with Apple is optional and only personalizes Profile; it does not gate the App. We do not run App Waffle accounts, ad networks, analytics products, or third-party SDKs. We do not sell or share information for advertising.

Who we are

App Waffle LLC is a limited liability company organized under the laws of the State of Florida, USA, with a principal place of business in Bonita Springs, Florida. For purposes of GDPR and UK GDPR, App Waffle LLC is the "data controller" for any personal data processed by the App. For purposes of the CCPA, App Waffle LLC is the "business" that determines the purposes and means of processing personal information collected through the App.

You can reach us at privacy@appwaffle.com for any privacy-related question, request, or complaint.

Information we do not collect

We do not operate App Waffle servers that the App talks to, and we do not embed third-party SDKs other than Apple's own frameworks. We do not collect:

an App Waffle account, postal address, or phone number (unless you choose to contact us separately);
your contacts, microphone, or camera roll beyond an optional Profile photo you choose;
advertising identifiers (IDFA), device fingerprints, or other cross-app tracking signals;
analytics events, behavioral profiles, or usage telemetry sent to App Waffle;
payment information — the App does not currently offer in-app purchases or subscriptions.

Information processed on your device and through Apple

The App processes the following so it can function. None of it is sent to App Waffle's own servers:

Native lists and tasks. Names, notes, due dates, URLs, location text, priority, recurrence, alarms, completion, categories, tags, list icons and colors, and similar app data are stored on your device (Core Data) and, when you are signed in to iCloud on that device, synced through Apple's CloudKit in the container for this App. If you choose to share a native list, CloudKit makes that list and its tasks available to the Apple IDs you invite. Simulator builds keep this data on-device only.
Apple Reminders (optional). Linking a list requires Reminders Full Access. The App uses that access to show Reminders calendar names in the link picker. It reads and writes reminder bodies only for lists you choose to link, via EventKit: title, notes, completion, due date, URL, location text, priority, recurrence, and alarms (including a time alarm or an arrive/leave alarm you set). Unlinked Reminders lists are not imported into Todo Assist. Categories, tags, and assignee labels stay in a Todo Assist overlay (including in CloudKit for that overlay) and are not written to Reminders. Unlinking removes only the Todo Assist link; the Reminders list is kept.
Notifications (optional). The App may ask iOS for notification permission. Linked-task due alerts are stored as Reminders alarms and are delivered by Apple Reminders, not as a second Todo Assist notification. Native-task due alerts are scheduled on the device as local notifications when you turn on “Notify at due time.” The App does not send push marketing.
Place alarms. An optional arrive/leave field can store a place name and coordinates you attach to a task. Those values sync with native tasks via iCloud and, on linked tasks, via Reminders. The App does not read your device GPS to fill the place; it may geocode a name you type. For native tasks, firing the alarm uses Location Services (Always) to watch a region around those coordinates. If Always is off, the place stays saved but will not fire.
Widgets. Open-task summaries (titles, list names, due dates, and similar) are cached in the App Group container on-device so Home Screen widgets can render without opening the App.
Sign in with Apple (optional). If you choose Sign in with Apple from Profile or Settings, Apple provides a stable user identifier and, when you grant them, a name and email (which may be a private relay address). The App stores that profile in the same private Core Data / CloudKit store as your lists so it can sync across your signed-in devices. You may also pick a Profile photo from Photos; that image is stored with your profile (and cached on-device for display). Sign in with Apple does not replace iCloud sync, and you can use Inbox and Lists without signing in. Signing out clears the in-App profile and local photo cache; it does not sign you out of iCloud.
Completion stats. Counts such as tasks completed today, streak, and related Profile charts are derived from your task completion history on-device (and via iCloud when available). They are not sent to App Waffle.
Settings. Preferences such as onboarding completion, timezone, Inbox group/sort/filter, last list used, and permission state are stored on-device. When you are signed in to iCloud, Settings may show the name or email Apple associates with that account so you can confirm sign-in. That iCloud identity is separate from optional Sign in with Apple and is not sent to App Waffle.

You can delete native lists in the App. Unlinking a Reminders list removes only the Todo Assist link; the Reminders list is kept. Signing out of Sign in with Apple clears the in-App profile and local photo cache. Delete all data / deleting the App removes on-device data, the widget cache, and Profile identity stored by the App. iCloud data for native lists is managed through your Apple ID and iCloud settings.

Apple services

The App uses Apple frameworks and services. Apple, not App Waffle, controls those services:

iCloud / CloudKit — native list sync on signed-in devices, under Apple's Privacy Policy. The App may use silent remote notifications so iCloud changes can arrive when it is not open. These are not marketing messages.
EventKit / Reminders — Full Access to list calendars and to read/write lists you link, under Apple's terms and privacy policy for Reminders.
User Notifications — optional permission so iOS can show alerts; linked due alerts are Reminders alarms; native due alerts are local Todo Assist notifications.
Core Location — optional Always permission so native arrive/leave alarms can fire. Not used for advertising or to fill the place name from GPS.
WidgetKit — Home Screen widgets using the on-device App Group cache.
AuthenticationServices (Sign in with Apple) — optional identity for Profile name and photo sync, under Apple's Privacy Policy.
PhotosUI (optional) — only if you choose a Profile photo; the App does not browse your library in the background.

Native list sharing is optional. If you invite another Apple ID, Apple CloudKit shares only the selected list and its tasks with the people you choose, using Apple's participant permissions. App Waffle does not receive the shared content or participant identities. Linked Reminders lists continue to use Apple's own sharing if you share them in the Reminders app.

App Store data from Apple

When you download the App from the App Store, Apple collects information about that transaction (such as your Apple ID and download history) under Apple's Privacy Policy. Apple may share aggregate, non-identifying information with App Waffle as part of standard App Store Connect reporting (e.g., total number of downloads in a country). We do not receive your Apple ID, email address, or any other directly identifying information from this reporting.

Crash and diagnostic data

iOS includes a system-level setting that lets you opt in to share anonymous crash and diagnostic data with developers. If you have that setting enabled and the App crashes, Apple may forward anonymized crash logs to us through App Store Connect. These logs are not tied to your Apple ID and contain only technical information (stack traces, device model, iOS version) needed to diagnose the crash. You can disable this at any time under Settings → Privacy & Security → Analytics & Improvements on your device.

How we use information

Information processed by the App is used only to:

operate the App — show your inbox, lists, widgets, Profile progress, and reminders you chose to link,
schedule native due alerts on the device and native arrive/leave region monitoring when you opt in,
sync native data through iCloud when you are signed in,
write the linked-task fields you edit into Apple Reminders,
show iCloud sign-in status (including a name or email Apple provides for that account),
personalize Profile when you choose Sign in with Apple (name, optional email, optional photo),
understand at a high level how the App is performing on the App Store (aggregate Apple reporting only),
diagnose and fix crashes or bugs when you opt in to share diagnostics with developers, and
comply with our legal obligations.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA. We do not use the App's data for automated decision-making that produces legal or similarly significant effects.

Children's privacy

Todo Assist is a productivity app. It is not directed at children under 13. We do not knowingly collect personal information from children under 13 (or the higher minimum age set by the law that applies to a particular child) within the meaning of COPPA, GDPR Article 8, or comparable laws. The App contains no advertising, no third-party trackers, no chat, and no in-app purchases. If you are a parent or guardian and have any concerns, contact us at privacy@appwaffle.com.

Sharing

We do not sell personal information. The only third parties that process information in connection with the App are:

Apple Inc. as the operator of the App Store, iCloud/CloudKit, Reminders, Sign in with Apple, notifications, and (if you opt in) crash diagnostics, under Apple's Privacy Policy; and
Legal and safety disclosures. We may disclose information in our possession if we believe in good faith that disclosure is required by law, legal process (such as a subpoena or court order), or governmental request, or is reasonably necessary to investigate or prevent fraud, abuse, or threats to the rights, property, or safety of App Waffle, our users, or the public.
Business transfers. If App Waffle is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, information processed in connection with the App may be transferred as part of that transaction, subject to standard confidentiality protections.

International data transfers

App Waffle is based in the United States. Apple operates a global network of data centers, so information processed by Apple in connection with the App, iCloud, and Reminders may be stored or processed in countries other than the one in which you reside. Apple maintains appropriate safeguards for such transfers under its own privacy framework.

Security

We rely on Apple's platform-level security for the App: code signing, sandboxing, CloudKit access controls, and the encrypted device backups Apple operates. Information stored on your device is protected by your device passcode and any disk encryption your device has enabled. Transport to Apple services uses standard HTTPS / CloudKit encryption. No method of electronic storage is, however, completely secure, and we cannot guarantee absolute security.

Your rights

Depending on where you live, you may have rights regarding personal information processed about you. The most meaningful way to exercise these rights for App data is to manage it in the App, in Reminders, or in your iCloud account. We honor the following rights to the extent the limited information we process makes them meaningful:

For visitors in the European Economic Area, the United Kingdom, and Switzerland (GDPR / UK GDPR). You have the right to request access to your personal data; the right to request correction of inaccurate data; the right to request erasure ("right to be forgotten"); the right to request restriction of processing; the right to object to processing carried out on the basis of our legitimate interests; the right to data portability where applicable; and the right to withdraw consent where processing is based on consent (Reminders access and notifications are granted through iOS system prompts you can revoke in Settings). You also have the right to lodge a complaint with your local supervisory authority. A list of EEA authorities is maintained at edpb.europa.eu, and the UK authority is the Information Commissioner's Office at ico.org.uk.

For California residents (CCPA / CPRA). You have the right to know what personal information we have collected about you and how it has been used and disclosed; the right to request correction of inaccurate personal information; the right to request deletion of your personal information; the right to opt out of the sale or sharing of your personal information (we do not sell or share personal information as those terms are defined under the CCPA); and the right not to be subjected to discriminatory treatment for exercising any of these rights.

For all users. You can delete native lists and tasks in the App, unlink Reminders lists, sign out of Sign in with Apple, revoke Reminders or notification access in iOS Settings, or delete the App. iCloud data is managed through your Apple ID. You can contact us at any time with questions or concerns about how we handle information.

To exercise any of these rights with respect to information processed by App Waffle, email privacy@appwaffle.com. We will respond within the timeframes required by the law that applies to you (generally 30 days under GDPR/UK GDPR and 45 days under the CCPA, with a possible extension where the law permits). We will not discriminate against you for exercising any of these rights.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, take additional steps required by applicable law to notify you (for example, by surfacing a notice in the App or on the App Store listing). We encourage you to review this page periodically.

How to contact us

If you have any questions, requests, or complaints about this Privacy Policy or about how App Waffle handles information for the App, please email us at privacy@appwaffle.com. You can also write to us at App Waffle LLC, Bonita Springs, Florida, USA.