Privacy policy
2do keeps your lists and what you and your agents write in them, to run the service and nothing else. It never receives your conversations with an AI, never sells data, and never uses it to train AI.
What we collect
| What | Why |
|---|---|
| Your email address, and the handle you choose | To log you in with an emailed code, and to show who you are to the people you share with. |
| What you and your agents create: spaces, lists, to-dos, fields, comments, questions, decisions, context, and files you attach | This is the service: it is stored so you and the people you share with can see it. |
| Your connections: the name of each AI app or computer you allowed (for example "Claude Code on my laptop"), and when it was last used | So you can see and disconnect them, and so work is credited to the right agent. |
| Login sessions for your browsers | To keep you logged in until you log out. |
| Server logs: IP address, the address requested, and the time | Security and troubleshooting. |
What we never receive
- Your conversations with Claude or any other AI. An agent connected to 2do only sends what it writes through a 2do tool: a to-do, a comment, a question, a state, a decision or context. The rest of your conversation stays with your AI provider.
- Your AI account, its memory, or its files.
- Payment details: 2do is free.
How we use it
- To run 2do: store your lists, show them to the people you share with, and let your agents read and write them.
- To email you login codes, invitations, and the notifications you choose in your settings.
- 2do runs no AI on your data. The AI work is done by the AI app you connect, under your own account with that provider.
- No advertising, no tracking or analytics scripts, no selling or renting of data, and no use of your data to train AI models.
Who can see it
- The people you share with. A space, list or single to-do is visible only to its members, and to the agents those members connect.
- Our service providers, only to run 2do: the company that hosts our server, the email service that delivers our emails, and the storage service that keeps our encrypted off-site backups. They don't use your data for anything else.
- The law. We disclose data only when legally required to.
How long we keep it
| What | How long |
|---|---|
| To-dos you delete | They stay in the list's deleted items (Show deleted items) until you delete them permanently. |
| Your account, when you delete it | Erased at once: your spaces, lists, to-dos, files, sessions and connections. Comments you wrote in other people's lists stay there, credited to "deleted user". |
| Backups | Daily, encrypted. Each backup is kept up to 6 months, then destroyed, so deleted data is gone from backups within 6 months. |
| Login codes | 10 minutes, single use. |
| Connections to AI apps | Until you disconnect them. A Claude connection's sign-in renews every hour and ends after 30 days unused. |
| Server logs | Rotated automatically, usually within a few weeks. |
Security
- Every connection to 2do uses HTTPS.
- Agent tokens, login sessions and login codes are stored only as hashes.
- Attached files are served through signed, expiring links to members only.
- Off-site backups are encrypted before they leave our server.
Your choices
- Export your data from You in the app.
- Delete your account from You, at any time.
- Disconnect any agent from Share, then Claude & Codex.
- Choose which actions email you, per space, list and to-do.
For anything else, including a copy or correction of your data, write to us (below).
Children
2do is not meant for children under 13, and we don't knowingly collect their data.
Changes
If this policy changes, we update the date at the top, and tell you in the app or by email when a change matters.
Contact
Questions about privacy: info@2do.work.