Last Updated: June 2026
TOT — That One Thing (“we”, “our”, or “us”) respects your privacy. This Privacy Policy explains what information we collect when you use our mobile application (“the App”), how we use it, who we share it with, and what rights you have.
Key points at a glance:
- You can use the App without an account. Your data stays on your device.
- Creating an account enables cloud backup and sync across devices. This is optional.
- We use AI features to help organize your tasks and brain dump entries. When you use these, your content is sent to our servers and processed by AI providers.
- We do not sell your personal information to anyone.
- You can delete your account and all associated cloud data at any time.
1. What Information We Collect
The information we collect depends on how you use the App:
If you use the App without an account (anonymous):
- Device identifier: We generate a random anonymous identifier stored securely on your device (Apple Keychain). This lets us send you push notifications without knowing who you are.
- Push notification token: To send you reminders and notifications, we store a token (a random string that identifies your device for push delivery) in Firebase Firestore.
- Usage and crash data: We use Firebase Analytics and Firebase Crashlytics to understand how the App is used and to identify and fix crashes. This data is anonymized and does not identify you personally.
If you create an account (optional):
- Email address and password: Stored by Firebase Authentication. We never see your password — it is managed entirely by Google’s secure authentication system.
- Cloud-synced data: If you sign in and choose to sync, the following data is stored in Firebase Firestore (Google’s cloud database): your tasks, today’s task list, task history, brain dump entries, and streak data. This enables backup and sync across your devices.
- Brain dump attachments: If you attach photos or voice recordings to brain dump entries, these are stored in Firebase Storage (Google’s cloud file storage) when sync is enabled.
- Feedback: If you submit feedback, it is stored in Firestore along with your anonymous identifier and a timestamp.
If you use AI-powered features (optional):
- Task splitting: When you use the AI task-splitting feature, your task name and your existing task list (for context) are sent to our backend server hosted on Google Cloud Run. The server forwards this to an AI provider (DeepSeek, or OpenAI as a fallback) to generate subtask suggestions.
- Brain dump assistant: When you use the AI brain dump assistant, your brain dump entries’ text content, tags, and message are sent to our backend server and forwarded to the same AI providers for processing.
- Neither DeepSeek nor OpenAI uses your data to train their models when accessed through our API. Our backend does not permanently store your AI queries — they are processed in memory and discarded after the response is returned. The AI providers may retain API requests for abuse monitoring for up to 30 days per their policies.
If you make purchases:
- Purchase data: In-app purchases and subscriptions are processed by Apple (via the App Store) and managed by Qonversion, our subscription management provider. Qonversion receives your purchase receipts and entitlement status. We do not receive or store your payment card details.
On-device features:
- Voice input: The App offers voice input for creating tasks and brain dump entries. Speech recognition is performed on your device using Apple’s SFSpeechRecognizer. Audio recordings for brain dump entries are stored locally unless you enable cloud sync, in which case they are uploaded to Firebase Storage. Audio is transcribed on-device. We do not send your raw audio recordings to third-party AI providers.
- Local data: All task data is stored on your device by default. Only when you create an account and enable sync is your data stored in the cloud.
We do NOT collect:
- Your name, phone number, or physical address.
- Your precise location (GPS data).
- Your contacts or other sensitive device data.
- Your payment card details.
- Photos other than those you explicitly attach to brain dump entries.
2. How We Use Your Information
We use your information for these purposes and no other:
- To deliver push notifications and daily reminders (notification token).
- To provide cloud backup and sync across your devices (task data, history, brain dump entries, streaks).
- To power AI features — task splitting and brain dump organization — at your request.
- To manage your subscription and premium access (purchase receipts).
- To understand app usage and improve the experience (anonymous analytics).
- To identify and fix crashes (crash reports).
- To respond to your feedback and support requests.
Legal basis for processing (EEA/UK users under GDPR):
- Performance of a contract: Providing the features you request (sync, notifications, AI features).
- Legitimate interest: Analytics, crash reporting, and app improvement — balanced against your privacy rights.
- Consent: For optional features like AI processing and cloud sync, you are asked before data is sent.
3. Who We Share Your Information With
We share data only with the service providers that help us operate the App. We do not sell your personal information to anyone.
- Firebase (Google, United States) — Authentication, cloud database, file storage, push notifications, analytics, crash reporting, and remote configuration. Receives: email (if registered), tasks, history, brain dump entries, photos, audio, notification token, usage analytics, and crash logs.
- Qonversion + NoCodes (United States) — Subscription management, entitlement checks, and paywall display. Receives: App Store purchase receipts and subscription status.
- DeepSeek — primary AI provider — AI-powered task splitting and brain dump organization. Receives: task names, task lists (for context), and brain dump entry text content.
- OpenAI (United States) — fallback AI provider — Used only when DeepSeek is unavailable. Receives the same data as DeepSeek when active.
- Google Cloud Platform (Cloud Run) — Backend API hosting. AI requests pass through but are not permanently stored.
- Apple (United States / Global) — Push notification delivery and in-app purchase processing. Receives notification tokens and purchase processing data.
We recommend reviewing each provider’s privacy policy:
4. International Data Transfers
We and our service providers operate in the United States (and, for DeepSeek, servers may be located outside the US). If you are located in the European Economic Area, United Kingdom, Australia, or elsewhere outside the United States, your data will be transferred to and processed in these countries. We rely on:
- Service providers certified under the EU-US Data Privacy Framework where applicable (Google, OpenAI).
- Standard Contractual Clauses as an alternative transfer mechanism where the Data Privacy Framework is not available.
5. Data Retention
We keep your data only as long as needed:
- Anonymous identifier: Stored until you uninstall the App or manually reset it.
- Push notification token: Stored until you uninstall the App (at which point it is automatically invalidated) or disable notifications.
- Account data (Firebase Auth): Stored until you delete your account.
- Cloud-synced data (Firestore + Storage): Stored until you delete your account or individual items. Account deletion removes all cloud data (Firestore documents, Storage files, and Firebase Auth account).
- AI processing data: Your task content is sent to our backend for processing but is not permanently stored there. AI providers (DeepSeek and OpenAI) may retain API requests for abuse monitoring for up to 30 days per their policies.
- Analytics data: Retained by Firebase Analytics per Google’s retention policies (typically up to 14 months for aggregated data).
- Crash logs: Retained by Firebase Crashlytics for 90 days.
- Purchase records: Retained by Qonversion per their retention policy and as required by applicable law.
6. Your Rights
Depending on where you live, you have legal rights regarding your data:
All users:
- You can stop using the App at any time. Uninstalling removes locally stored data.
- You can disable push notifications in your device Settings at any time.
- You can delete your account from the App’s Account Settings, which permanently removes all cloud-stored data (Auth account, Firestore documents, and Storage files). You can choose whether to also delete your local data during this process.
European Economic Area / United Kingdom (GDPR): You have the right to access, rectify, erase, restrict processing, object to processing, and receive a portable copy of your data. To exercise any of these rights, email us at tot@caretix.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
California (CCPA/CPRA): You have the right to know what personal information we collect about you, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of your personal information. We do not sell your personal information. To exercise your rights, email us at tot@caretix.app. We will not discriminate against you for exercising your rights.
Australia (Privacy Act 1988): You have the right to access and correct your personal information. To exercise these rights, contact us at tot@caretix.app. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.
7. Children’s Privacy
Our App is not directed to children under the age of 13 (in the United States) or under the applicable age of digital consent in your country (16 in the EEA under GDPR, 13 in Australia). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
8. Security
We take the security of your data seriously:
- All data transmitted between the App and our servers is encrypted in transit using TLS (Transport Layer Security).
- Data stored in Firebase services is encrypted at rest by Google’s infrastructure.
- Your password is handled by Firebase Authentication and is hashed; we never see or store your plain-text password.
- Access to backend systems is restricted to authorized personnel.
No system is completely secure, but we use industry-standard practices to protect your data.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App and update the “Last Updated” date at the top of this policy. Your continued use of the App after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.
10. Contact Us
If you have questions, concerns, or would like to exercise your data rights, please contact us:
- Email: tot@caretix.app
- Response time: We aim to respond within 48 hours. For data rights requests under GDPR, we will respond within 30 days as required by law.
Data Controller: Jacob Ramilo, reachable at tot@caretix.app.
