Privacy Policy

1.In short

• We do not use your data for advertising and we do not sell it to anyone.
• We do not use analytics, advertising or tracking cookies; there are only cookies that are essential for your session.
• No one in your workspace can see your records in the Personal area (payments, IBANs, assets, cards).
• Todi only runs when you press a button; while it is off, no data goes to the artificial intelligence provider.
• Our servers are located in Germany (Frankfurt, EU).

2.What data do we keep?

• Account: your full name, email address, a one-way hash of your password (we never know the password itself), an optional profile photo, your time zone and notification preferences.
• Workspace: tasks, descriptions, chat messages, voice messages, files, labels, projects, time entries and the activity history showing who did what and when.
• Personal area: payment and income records, IBANs, assets, budgets, goals, subscriptions; for cards, only the name, issuing bank and last 4 digits. If you import a bank statement, the file is read on your device; only the date, description and amount of each transaction are saved.
• Notifications: in-app notifications; if you have turned on push notifications, your browser’s notification subscription and the device name.
• Support: your requests, the correspondence, the screenshots you attach and the technical information attached to the request (browser, screen size, page path, app version, recent error logs). Cookies, passwords and form contents are never added to this information.
• Security: your IP address and email address are kept briefly for rate limiting on sign-in, sign-up and password operations; administrative actions are written to the audit log.

3.Who can see your data?

• Workspace members: according to the workspace’s role and permission settings (e.g. members who see only their own tasks, admins who see all tasks).
• Personal area: only you. Workspace admins and other members cannot see it.
• Profile photo and workspace logo: served through an unguessable link so that they appear quickly in the app; anyone who knows the link can see them.
• Invitation links: anyone who has an invitation link can see the email address the invitation was sent to and the name of the workspace.
• The Todix support team: our system administrators can technically access workspaces. We use this access only for support, by stating a reason and through a support session limited to two hours; every session is logged and the workspace admins can see this history. While monitoring the delivery of notifications, they can see the titles and texts of work notifications; for Personal reminders they see only the type and delivery status, not the content.

4.Service providers

Currency, gold and crypto prices (TCMB, Truncgil, CoinGecko) are fetched by our server; no information about you is added to these requests.

5.Todi (artificial intelligence)

Todi runs only if the system administrator has turned it on, and only when you press the relevant button. While it is off, or when you do not use it, no data is sent to the artificial intelligence provider. Each operation sends only the following data:

Your account ID and email address are not added to the requests. We do not store request and response texts; only a usage record (feature, model, tokens, cost, duration) is kept. The transcript of a voice message can be seen by the people who can see the message. The retention policies of OpenRouter and of the model providers apply. Todi’s suggestions may be wrong; check them before saving.

6.How long do we keep it?

7.Closing your account

You can delete your account yourself in the app under Profile → Account and data → Delete my account, by confirming your email address and password; if you prefer, you can also request it by writing to [Email for KVKK requests — Odin → Settings → Legal information] from your registered email address. When your account is deleted, your profile, memberships, notifications, notification subscriptions, support requests and all your records in the Personal area are deleted; workspaces used only by you are deleted too. The tasks, messages and files you created in workspaces remain as the team’s work record; your author information is removed from them and they appear as "Deleted user".

Before deleting, you can get a copy of your data as a single JSON file with Profile → Account and data → Download my data.

If you are the owner of a workspace that has other members, you must transfer ownership to another member or delete the workspace before deleting your account.

8.Security measures

• All connections are encrypted with HTTPS; browsers are told to use secure connections only (HSTS).
• Passwords are stored only as one-way hashes.
• Every row in the database is protected by permissions (row-level security): a user can read only the records they are authorized to see, and every change goes through a permission check on the server.
• Files are kept in storage that is closed to the public and are opened only for an authorized person, through signed links that are valid for a few minutes.
• API keys are stored in an encrypted vault; they never reach the app’s screens.
• Sign-in, sign-up and password operations are protected by rate limits; administrative actions are written to the audit log.
• Pages are served with a strict content security policy (CSP); other sites are prevented from opening our pages inside a frame.

No system is entirely free of risk. If a security breach affects your data, we will notify the Personal Data Protection Board and you as soon as possible, as provided for by KVKK.

9.Children

The Service is not intended for people under the age of 18. If we become aware of an account belonging to someone under 18, we will delete the account and its data.

10.Your rights and contact

You can find your rights under Article 11 of KVKK and how to apply on the KVKK privacy notice page. You can write to [Email for KVKK requests — Odin → Settings → Legal information] with any question about privacy, and to destek@todix.com.tr about any other matter related to the Service.

11.Changes

This policy may be updated. The version in force is [Version — Odin → Settings → Legal information], effective from [Effective date — Odin → Settings → Legal information]. We will inform you within the app of any significant changes.