Privacy Policy

Last updated 27 September 2026

This policy explains what personal data tududi Cloud and this website collect, why, and what you can do about it. The controller of that data is Chris Veleris, an individual based in Greece. Contact: info@tududi.com.

If you run tududi on your own server, none of this applies to you: your data never reaches us.

1. What we collect

• Account data: your email address, name, password (stored only as a one-way hash), language, timezone and profile settings.
• Your content: everything you put into tududi, such as tasks, notes, projects, areas, habits, comments and uploaded files, plus the people and groups you share with.
• Billing data: your subscription status, plan and renewal dates, and the customer and subscription identifiers from our payment provider. We never see or store your full card details.
• Technical data: IP address, browser user agent, and request logs, used for security, rate limiting and troubleshooting.
• Integrations you turn on: for example a Telegram chat id, calendar feed addresses (stored encrypted) or API tokens.
• Website: if you join the mailing list, your email address and the language you signed up in.

2. Why we use it (legal basis)

• To provide the service you signed up for: storing and showing your content, sign-in, sharing, email notifications you enable. Basis: performance of our contract with you.
• To take payment and keep billing records. Basis: contract, and legal obligations for tax and accounting records.
• To keep the service secure, prevent abuse and fix problems. Basis: our legitimate interest in running a safe service.
• To send release notes if you ask for them. Basis: your consent, which you can withdraw with the unsubscribe link in any email.
• To measure visits to this website with Google Analytics. Basis: consent where required. The tududi app itself contains no analytics or tracking.

We do not sell your data, show you ads, or use your content to train AI models.

3. Who processes it for us

We use a small number of service providers, each only for the purpose listed:

• Vultr: servers and storage where the service and its database run.
• Lemon Squeezy: checkout, payments, invoices and tax, as merchant of record. See their privacy policy.
• Resend: sending account and notification email.
• Cloudflare Turnstile: bot protection on the sign-up and password reset forms.
• Our AI model provider: only when you use an AI feature, the text that feature works on is sent to this language model provider to generate a response.
• Google Analytics: visit statistics on this website (tududi.com), not inside the app.

Some of these providers are based outside the European Economic Area. Where data is transferred there, it is covered by the European Commission's standard contractual clauses or an adequacy decision.

4. Cookies

The app uses a session cookie to keep you signed in and a few strictly necessary cookies for security. This website sets a cookie to remember your language, and Google Analytics sets its own cookies to count visits.

5. How long we keep it

• Your account and content: for as long as your account exists. When you delete your account, it is removed from the live database straight away.
• Backups: database backups are kept for up to 30 days, after which deleted data is gone from them too.
• Request and security logs: only as long as needed to investigate problems, then rotated out.
• Billing records: as long as tax law requires (Lemon Squeezy holds the invoices).
• Mailing list: until you unsubscribe.

6. Your rights

Under the GDPR and similar laws you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw consent at any time. Much of this you can do yourself in the app: edit your profile, export everything from Profile › Backup, or delete your account from Profile. For anything else, email info@tududi.com and we will answer within 30 days.

You can also complain to your local data protection authority. In Greece that is the Hellenic Data Protection Authority.

7. Security

Connections are encrypted with TLS, passwords are hashed, calendar feed addresses are encrypted at rest, and access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

8. Children

tududi Cloud is not meant for children under 16, and we do not knowingly collect their data.

9. Changes

If we change this policy in a way that matters, we will email account holders before the change takes effect. The date at the top shows the latest version.