Privacy Policy

Taduu is a shared list and task management app operated by Limitless Automation Co. ("Taduu," "we," "us"). This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.

We try to keep this readable. If anything is unclear or you want to exercise a right described below, email support@taduu.com.

Three categories of data flow through Taduu. We collect the minimum needed for the product to work.

Account data

• Email address (required to sign in)
• Name (optional, used for display in shared lists)
• Password (stored only as a one-way bcrypt hash — we never see or store the plaintext)
• Workspace memberships, roles, and per-list permissions
• Billing information (collected and processed by Stripe; see Third parties below)

Content you create

• Tasks, lists, notes, inbox items, comments
• Contacts and locations you add
• Flowcharts and templates
• Grocery and shopping data, including any community-shared prices you opt into submitting
• Feedback submitted via the in-app widget

Technical data

• IP address (used for rate limiting, security, and as part of session auth)
• Device type and browser (parsed from your User-Agent so we can show device-appropriate UI and surface it to admins for support)
• Per-request audit logs for the public API and MCP server (token id, endpoint, status code, IP, user-agent, timestamp; retained 90 days)
• Anonymous product events (signup, first list item added, trial expiries — used to understand activation, never tied to identifiable third parties)

• To run the product — sign you in, sync your lists across devices, share workspaces with the people you invite.
• To improve the product — anonymized usage metrics tell us which features people actually use, so we can invest in the right ones.
• To communicate with you — transactional emails (invitations, magic links, billing receipts) and occasional product updates if you opt in.
• To keep the service safe — rate limiting, fraud detection, abuse prevention.
• To meet legal obligations — when required by law, court order, or to protect someone's safety.

We do not sell your data. We do not show ads in Taduu. We do not share your data with advertising networks or data brokers.

We use a small number of trusted vendors to run Taduu. They process data only on our behalf and only as needed for the services they provide.

• MongoDB Atlas — primary database. All your content (tasks, lists, notes, etc.) lives here.
• Vercel — web hosting, edge CDN, serverless functions. Sees request metadata and logs.
• Railway — hosts our real-time sync server.
• Stripe — payment processing for Pro subscriptions. We never see your full card number.
• Anthropic (Claude API) — powers our AI features (e.g. natural-language to flowchart, AI review). Only the specific text you submit for an AI action is sent; Anthropic does not train on it per their API terms.
• Google — optional Calendar/Meet integration (only if you connect a Google account). OAuth tokens stored encrypted; calendar data fetched only when you request it.
• Google Apps Script — transactional email delivery (invitations, magic links).
• Google Places — store + location lookups for the community pricing feature (only when you actively search).

• Account data — for as long as your account is active. Deleted within 30 days of account deletion.
• Content (tasks, lists, notes) — kept until you delete it or delete your account.
• API audit logs — 90 days, then auto-deleted.
• Real-time sync events — 5 minutes (just long enough for offline devices to catch up).
• OAuth authorization codes — 10 minutes (single use; deleted as soon as exchanged for a token).
• Backups — rolling 30-day window via MongoDB Atlas; deleted data may persist in backups until rolled off.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to certain processing
• Withdraw consent for optional processing at any time

To exercise any of these, email support@taduu.com and we'll respond within 30 days. You can also delete most content directly in-app, and your full account from Settings → Account.

We take reasonable measures to protect your data:

• HTTPS/TLS for all traffic
• Passwords hashed with bcrypt (never stored in plaintext)
• API tokens stored only as SHA-256 hashes; shown to the user once at creation and never retrievable thereafter
• Multi-tenant isolation enforced at every database query (every collection scoped by organization where applicable)
• Per-list role-based access control (Viewer / Commenter / Editor)
• Audit logging of all API requests

No system is perfectly secure. If you discover a vulnerability, please email support@taduu.com with details so we can fix it quickly.

We use cookies and browser storage strictly for product functionality — sign-in sessions, your preferences (which view you last had open, whether you've dismissed the welcome card, etc.), and offline mutation queueing. We do not use third-party tracking cookies or advertising pixels.

Taduu is not directed at children under 13 (or 16 in the EU/UK). We don't knowingly collect data from children below those ages. If you believe we have, email us and we'll delete the account.

Our infrastructure runs primarily in North America (Vercel, MongoDB Atlas regions in the US and Canada). If you're in the EU/UK, using Taduu means your data is transferred to jurisdictions whose privacy laws may differ from yours. We rely on standard contractual clauses with our subprocessors where applicable.

We'll update the "Effective" date at the top of this page when we make material changes. For significant changes, we'll email account holders directly. Continuing to use Taduu after a change means you accept the updated policy.

Limitless Automation Co.
Operating Taduu (taduu.com)
Privacy questions: support@taduu.com