Privacy policy

todo.md is a local tool. Your tasks, your repositories, and your agent sessions stay on your machine. This page lists every piece of data the product touches, because the list is short enough to read in full.

The free tier

Nothing leaves your machine. The free tier makes no network calls: no account, no telemetry, no crash reporting, no update pings. The dispatch counter lives in a local file under ~/.todomd/ and is read by nobody but the binary itself.

Buying a license

Checkout runs on Polar, our payment provider. Polar collects your payment details; we never see your card number. What we receive from Polar is your email address, which we use to send your license key and keep your purchase record.

The paid tier

A license binds to one machine at a time, and the binary talks to our server in exactly two situations:

• Activation. todomd license activatesends your license key and a machine ID: a one-way SHA-256 hash derived from your hostname, operating system, and hardware identifier. The raw values never leave your machine; the server sees only the hash.
• License check. todomd start sends the same two values to confirm the license is valid on this machine. There is no background heartbeat. If you are offline, the check is skipped for up to 7 days since the last successful one.

That is the complete list. The binary never transmits your tasks, your code, your file names, or anything else from your projects.

What we store server-side: your email, your license key, the machine ID hash it is currently bound to, and activation timestamps.

Emails

Transactional email (your license key, your receipt) goes to the address you bought with. Marketing email is strictly opt-in: running todomd subscribe sends a confirmation message first, and you are only subscribed after you click the link in it. Every marketing email carries an unsubscribe link; one click stops all marketing sends permanently. Unsubscribing never blocks transactional email such as license delivery.

The website

todomd.dev runs no analytics, no tracking scripts, and sets no cookies. It is static files on a CDN.

Sharing and your rights

We never sell your data. The only third parties that process it are Polar (payments) and Amazon Web Services (hosting and email delivery).

To see or delete the data we hold about you, emailharlley@todomd.dev. A human reads it and answers.