Privacy policy

1. Who runs this instance

The administrator of your personal data is the operator of the UniTodo instance you are using. Every UniTodo instance is self-hosted: whoever deploys it is its data controller.

For any request concerning your data, contact the operator of the instance you registered on.

2. What data we collect

While you use the app we collect the following data:

• Username — given at sign-up, visible to the other members of your groups.
• Password — stored only as a hash (bcrypt). Plain-text passwords are never stored.
• Content you create — group names, descriptions, notes, tasks, subtasks, priorities, due dates.
• Technical data — the cookies the app needs to work (the session JWT).

3. How the data is stored

• All data lives in the PostgreSQL database configured by the operator of the instance.
• The location of the database and of the application servers is decided by the operator.
• Passwords are hashed with bcrypt — not even an administrator can read yours.

4. Cookies

The app uses only the cookies it needs:

• token — the session cookie holding the JWT, required to stay signed in. It expires after 7 days.
• darkMode — the theme preference, kept in the browser localStorage (not a cookie).
• lang — the interface language you picked, kept for a year.

No marketing, analytics or tracking cookies are used.

5. Who the data is shared with

Nobody. Your data is not sold, shared or handed to third parties. It is used only to run the app.

Your username is visible to the other members of the groups you belong to, which is what makes collaboration work.

6. Your rights

You may request the following at any time:

• Access — you can check what data is stored about you.
• Rectification — you can correct your data.
• Erasure — you can ask for your account and all related data to be deleted.
• Portability — you can receive a copy of your data.

7. Security

The following safeguards are in place:

• Encrypted transport — all connections go over HTTPS (TLS).
• Password hashing — bcrypt with a per-password salt.
• JWT authentication — tokens signed with a secret key held by the operator.
• Data isolation — a user only sees the groups they belong to.

8. Changes to this policy

This policy may change. Any material change will be announced in the app or on the instance page.