Privacy policy — Always Today

Last updated: 18 October 2026

Always Today is made by Empatiq Limited, 66 Paul Street, London EC2A 4NA, United Kingdom, registered in England and Wales, company number 13746700 (“we”). We are the controller of the personal data described here. Contact: apps@guzh.uk or +44 7776 912598.

The short version

• Your lists live on your device. Without an account, nothing you write leaves it.
• If you sign in to sync, our server keeps your email address, a name for each of your devices and the changes you make, so it can pass them between your devices. If you turn on end-to-end encryption, those changes are encrypted on your device and we can’t read them.
• No ads, no analytics, no tracking. We never sell or share your data for advertising.
• When you buy a plan, Stripe (on the web) or Google Play (on Android) sells it and handles the payment. We never see your card.
• You can export everything at any time, and delete your account from the app.

On your device

Everything you write (to-dos, notes, checklists, dates, tags, lists and projects) is stored in a database on your device, and the app works fully without an account. The app doesn’t encrypt that database itself: your device’s own disk encryption and screen lock protect it. On Android the app tells the system to leave the database, your sign-in and your encryption key out of Google’s device backups and phone-to-phone transfers, so they aren’t copied there.

Some features stay on your device and never reach us:

• Reminders are scheduled by your device itself.
• The calendar in Today reads your phone’s own calendars on Android. On a computer, if you give it a calendar file or a calendar’s address, the app reads the file or fetches that address directly. Fetching is off until you turn it on, and the address is never sent to us.
• Speak (Android) listens through your phone’s microphone only while its sheet is open, and only once you’ve allowed it. Your phone’s own speech recognition turns what you say into text, on the phone itself where it can (Android 12 and later, with your language downloaded); otherwise your phone’s speech service, usually Google’s, may handle the audio under its own privacy terms. We never receive any audio, only the to-dos it makes, as if you had typed them.
• Import and export read and write files on your device.

What the sync server keeps, and why

Only if you sign in to sync. Our server runs on Cloudflare. This is everything it stores about you.

Your account

Your email address, the date the account was created, and which plan it has. There are no passwords: you sign in with a link we email you, which works for 15 minutes, once. While a sign-in is waiting, the server keeps your email address, the name of the device signing in and a short code; it deletes the request within about a day after it expires.

Legal basis: contract — the account and the sync you asked for.

Your devices

For each signed-in device: its name (your phone’s maker and model, or your computer’s network name), when it signed in and when it last synced, and a scrambled copy of its sign-in key. The key itself is never stored, so a copy of our database can’t sign anyone in.

Legal basis: contract — keeping your devices in sync, and letting you see and sign them out.

Your changes

Every addition and edit to your lists, each with the time it was made and which of your devices made it. That is what sync is: your devices send their changes to the server and fetch the ones they haven’t seen. Without end-to-end encryption, a change includes what you wrote. We never read, analyse or sell your lists or use them for anything but passing them between your devices. They travel over HTTPS, and Cloudflare stores them encrypted at rest.

Legal basis: contract — sync.

Keeping the service safe

To stop abuse, the server counts sign-in attempts per IP address for one minute; nothing is kept after that. Cloudflare, our hosting provider, keeps technical logs of each request (the time, the address asked for, the result and network details including your IP address) for up to 7 days, to deliver and protect the service and so we can find faults.

Legal basis: legitimate interests — keeping the service running and secure.

Sign-in emails

Sign-in links are delivered by Resend (Plus Five Five, Inc.), which receives your email address and the link to send.

Legal basis: contract — signing you in.

End-to-end encryption

End-to-end encryption is optional and off until you turn it on. With it on, each change is encrypted on your device, with a key protected by your passphrase, before it is sent. The server then stores only data it can’t read: titles, notes, dates, tags, list names and even which item a change belongs to are hidden.

Sync still needs a few things in the open: that your account exists, its email address and devices, how many changes you make and when, roughly how large each change is, and the locked envelope that holds your key, which only your passphrase or your recovery key can open. If you lose both your passphrase and your recovery key, we can’t recover your synced lists for you.

Payments

Sync is a paid plan after a free trial. We never see or store your card or bank details.

• On the web (Windows, Mac and Linux), plans are sold by Stripe through its Managed Payments service, shown at checkout as Onelink. Stripe is the seller and handles your payment details, tax and receipts as a controller in its own right, under the Stripe privacy policy and the Link privacy policy. To open the checkout, our server sends Stripe your account’s internal reference (a random code), the plan, and your account’s email address so the checkout is filled in for you. Stripe then tells us when the purchase is made, renews, is refunded or disputed, or ends.
• On Android, plans are sold by Google through Google Play, under the Google privacy policy. The app tells Google only your account’s internal reference, never your email; Google tells our server the purchase’s reference, product, status and dates. Google’s billing library inside the Android app also sends Google its own logs of how the purchase screens are used, as part of how Google Play handles payments.
• On iPhone and iPad, when that app arrives, plans will be sold by Apple through the App Store in the same way, under Apple’s privacy policy.

For each purchase our server keeps the store, the store’s reference for it, the product, its status and when it renews or ends, so every device knows that sync is included.

Legal basis: contract — the plan you bought.

The free trial, and deleting an account

Each email address gets one free trial. If you delete your account, we keep a scrambled, one-way copy of your email address, with the date your free trial ends, for two years, only so that the same email can’t start another free trial; it can’t be turned back into your address.

Legal basis: legitimate interests — one free trial per person.

What we never collect

• No analytics, usage statistics or crash reports from the app.
• No advertising, no advertising identifiers, no tracking across apps or websites.
• No third-party code in the apps apart from Google’s billing library on Android. The apps connect only to our sync server, to Google Play for purchases on Android, and to a calendar address if you add one.
• No contacts, location or photos. The microphone only for Speak, while you use it (see above); we never receive any audio.

Who else handles your data

• Cloudflare, Inc. runs our server and stores what it keeps.
• Resend (Plus Five Five, Inc.) delivers sign-in emails.
• Stripe, Google and Apple sell plans and handle the payments, as described above, under their own privacy policies.

Cloudflare and Resend work only on our instructions, under data processing terms. We share nothing else with anyone, unless the law requires it, for example a court order, and then only what is required.

Where your data is kept

The server stores your account and your changes with Cloudflare in the European Union. Cloudflare answers each request from the location nearest to you, and Cloudflare and Resend are based in the United States, so some data passes through or is handled outside the UK. Where it is, it is protected by the safeguards UK law requires, such as the UK’s adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or the UK’s international data transfer agreement.

How long we keep it

• Your account, devices, changes and plan: for as long as you keep the account. Deleting the account deletes them at once.
• Backups: the server’s storage can be rolled back to any moment in the last 30 days, so a deleted account stays in those backups for up to 30 days, and is then gone for good. We roll back only to recover from a fault.
• Sign-in requests: within about a day after they expire.
• Request logs at Cloudflare: up to 7 days.
• The scrambled copy of your email after deleting an account: two years.
• Purchase records: after you delete your account, a purchase’s store reference, product, status and dates are kept with no link to you or your email, so a refund or a dispute can still be handled and a store purchase can be restored to a new account. Stripe and Google keep their own records of the sale, as sellers must.
• Emails you send us: as long as we need to answer you, and no more than two years after the conversation ends, or sooner if you ask.

Deleting your account

In the app, open Settings and choose Delete my account; it offers to export everything first. This removes your account, your devices and every change you have synced from our server. Your lists stay on your devices until you remove the app. You can also email apps@guzh.uk and we’ll do it for you.

Deleting your account doesn’t cancel a plan you pay for: cancel it with Onelink at link.com or in Google Play too. Stripe deletes the payment data it holds if you ask Onelink.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask for a copy of the personal data we hold about you, have it corrected (for example a new email address), have it deleted, restrict or object to how we use it, including anything we do under legitimate interests, and take it with you: Export everything in the app saves all your lists as a JSON file at any time. Email apps@guzh.uk from the address on your account. We answer within one month, free of charge.

If you’re unhappy with how we handle your data, please tell us first and we’ll try to put it right. You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Union, you can also complain to the regulator where you live.

These web pages

The Always Today pages on guzh.uk set no cookies. They load the Geist typeface from Google Fonts, and visits are counted by Cloudflare Web Analytics, which sets no cookies and stores nothing on your device.

Children

Always Today isn’t meant for children under 13, and we don’t knowingly create accounts for them. If you think a child under 13 has given us their email address, tell us and we’ll delete the account.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change matters, for example a new company handling your data, we’ll email account holders before it takes effect.