Tavo keeps your tasks in an account, so they are the same on every device you sign into — and one day on the web and on Android too. That means we hold them, and this policy is mostly about what that does and does not entitle us to do.
What we hold: your lists, tasks, steps, tags, notes, dates and any place you attached, plus the email address you signed up with. What we do not do: read them for any purpose of our own, show you advertising, sell anything to anybody, or let another person see your lists unless you share one with them.
Tavo also counts how it is used — that a task was made, that the timetable was opened — with none of your words in it, and a switch in Settings to stop it. The sections below say all of this again in the specific way each question deserves.
This policy covers the Tavo app for iPhone, iPad and Mac, and the Tavo website.
The person responsible for your data — the "data controller", if you have met the term — is Aspen Koch, at the postal address under Contact at the bottom of this page. Write to that address or to tavosupport@gmail.com about anything here.
This policy does not cover Apple's services or anything else you reach from inside Tavo; those are governed by their own policies, and we link to them where they come up.
Tavo writes everything to the device you are holding first, so it works with no signal at all, and then copies it to your account:
One thing stays on the device and is never sent anywhere:
The copy on the device lives in the area iOS reserves for Tavo, which no other app can read, and is included in your encrypted iPhone backups. The copy in your account lives in a Postgres database run for us by Supabase, in the United States.
Counts of what happens in the app, and nothing else.
There is a fixed list of them: the app was opened, a task was made, finished or deleted, a list was made or opened, the timetable was opened, a place reminder was set, setup was finished, the paywall was seen, a purchase was started or finished, a switch in Settings was changed. Alongside each one we record the shape of it — whether a task had a date on it, whether it had a place, whether it was late — the version of the app, and whether it is an iPhone, an iPad or a Mac.
What is never sent: the words you write. No task titles, no list names, no notes, no steps, no tags, no place names, no search terms, no photographs. Your account holds those, as the sections above describe; these counts never carry a word of them.
These counts are tied to a random identifier the app makes up for itself when it is installed. It is not your Apple Account, not your iCloud identifier, not the advertising identifier, and not anything that identifies your device to anybody else — so it cannot be joined to you, or to what you do in any other app. Deleting Tavo ends it.
You can switch all of it off: Settings → Preferences → Usage → Share usage data. Off means off immediately, including anything that was waiting to be sent.
The only other thing that ever reaches us is a message you choose to send — an email to the support address below. If you write to us we will have your email address and whatever you put in the message, and we keep it only as long as it takes to answer you.
Tavo asks for four things. Every one is optional, the app works without any of them, and each is used for exactly one purpose:
Each of these can be withdrawn at any time in the iOS Settings app under Tavo. Withdrawing one stops the feature and nothing else.
Tavo requires one, and that changed in September 2026. Before then it had no sign-in at all; it now has an account because a task list that reaches your phone, your Mac, the web and an Android device has to be kept somewhere all four can ask.
You can sign in two ways. With an email address and a password, in which case we hold the address. Or with Apple, in which case Apple decides what we are told — if you choose to hide your address we receive a relay address that forwards to you and is useless for anything else, and we never learn the real one.
Alongside the address, your account holds the things you choose to put on it: the name you want to be called, a picture if you add one, and which of your milestones you show beside your name. All three are optional, all three are yours to change or clear at any time in Settings → Profile, and they exist so the phone and the Mac show the same person. Your device's time zone is kept too, so that a reminder set for seven in the morning is still seven after you travel.
There is nothing else. No phone number, no date of birth, no contacts, nothing inferred about you. Passwords are never stored by us in a form anybody can read, including us.
Tavo sends you one email a week, on Monday morning. It is on from the moment you make an account, at seven in the morning, and you can switch it off or move the hour — any hour between four and eleven — in Settings → Preferences → Weekly email.
It was a daily email until 25 September 2026 and is now weekly, which is fewer emails rather than more.
We have made it on rather than off, and would rather say why than let you find out from the first one. Tavo is a list you are meant to look at, and an app you have to remember to open is one you stop opening; the email is the part that arrives whether or not you thought of it. The cost of being wrong about that is one email with a link in it that stops them for good, which is why the link is in every single one.
It uses four things we already hold: the email address on your account, so it has somewhere to go; your device's time zone, so your Monday morning is yours and not ours; the titles of the tasks due in the week ahead; and the number of tasks you finished in the two weeks behind, and on which days, so it can tell you how the week went. Nothing else goes into it — no notes, no places, no steps, and never the title of anything you have finished.
It is sent for us by Resend, who are listed under Third parties below. They receive your address and the text of that one message, to deliver it, and nothing more.
Every email carries an unsubscribe link, and the switch in Settings does the same thing. Neither asks you to sign in and neither asks why. Turning it off stops the next one, for good, and we keep no record of what was in the ones already sent.
It is the only recurring email Tavo sends. Nothing else arrives on a schedule, there is no newsletter, and switching this off does not stop the messages your account itself needs — confirming an address, resetting a password — which are not marketing and have no unsubscribe because they only ever arrive in answer to something you did.
Your account is the copy every device reads from, so signing in on a new phone brings your lists with it.
Who can see it: you, on anything signed into your account, and anyone you deliberately share a particular list with. The database refuses to return one person's rows to another — that rule is enforced by the database itself rather than by the app, which matters because the app is the part an attacker could tamper with.
We can technically read it, and we say so plainly rather than implying otherwise. Tavo is not end-to-end encrypted, and claiming it was would be a lie. What we commit to is this: nobody reads your tasks except to fix a fault you have reported to us and asked us to look into, and nothing in them is ever used to build a profile, train anything, or sell to anyone.
All purchases go through Apple's App Store. Tavo never sees your card, your billing address, or your Apple Account details — Apple handles the transaction and tells the app only whether a purchase is active.
Apple may provide us with anonymous, aggregated sales figures, in the same form every developer receives: totals by country and by day, never tied to a person.
Tavo relies on four outside services:
Each of them is bound by a contract requiring them to protect your data to at least the standard set out in this policy, to use it only to provide their service to us, and not to use it for anything of their own.
In data-protection terms these are our processors and we are the controller: they act on our instructions and hold nothing of yours on their own account. Supabase, PostHog and Resend each operate under their standard data processing agreement, which is what obliges them to that. If we ever change who runs the database, this page says so before it happens.
There are no others. No advertising networks, no attribution or install-tracking software development kits, no data brokers, no customer-messaging tools.
Tavo counts how it is used, in the specific and limited way set out under “What we receive”. The purpose is to find out which parts of the app earn their place and which get in the way. It can be switched off in Settings → Preferences → Usage.
Tavo contains no crash reporting. If it crashes, we find out because somebody writes to us — or because Apple's own opt-in diagnostics, which you control in iOS Settings, shows us an anonymous stack trace with nothing of yours in it.
Tavo contains no advertising. Nothing you do here targets an advert, here or anywhere else, and nothing about you is sold or shared for that purpose.
Tavo does not track you in the sense Apple means by that word: it never links what you do here to your identity or to your activity in other companies’ apps and websites, and it does not use the advertising identifier. That is why it does not ask for permission to track — the permission covers something Tavo does not do.
The Tavo website is a handful of static pages. It sets no cookies, runs no analytics, and has no accounts, comment fields or forms.
It loads its typefaces from Google Fonts, which means your browser requests those font files from Google's servers and Google sees the request in the ordinary way any web request is seen. Nothing else on the page reaches out anywhere.
Whoever hosts the site keeps standard server logs — the sort every web server keeps — which may include an IP address and the page requested. We do not analyze them and do not connect them to anything.
Your data is kept for exactly as long as you keep it. Delete a task and it goes to Trash; empty the Trash and it is gone from your account too. Delete everything from Settings and all of it goes at once, everywhere.
Delete your account and every list, task, step and tag attached to it is erased with it, immediately and with no recovery period. That is not a policy we apply by hand — the database is built so those rows cannot outlive the account they belong to.
Two honest footnotes. Deleted rows leave a small marker behind — an identifier and a time, nothing you wrote — so that your other devices learn the thing is gone rather than quietly putting it back. And our database provider keeps encrypted backups for a short period as protection against their own failures; a deleted account can persist in those until they age out, after which it is gone from there too. Nobody restores a backup to recover one person's deleted tasks.
An email you send to support is kept as long as it takes to answer you, and then deleted.
The copy on your device sits inside the app's sandbox, which iOS isolates from every other app. It is protected by your device passcode, Face ID or Touch ID, and by iOS file-level encryption whenever the device is locked.
The copy in your account travels over an encrypted connection (TLS) and is stored encrypted at rest. Access to it is decided by rules held inside the database, so one account cannot read another's rows even if the app asks it to — that matters because the app is the part somebody could tamper with and the database is not. Your sign-in is kept on the device in the iOS Keychain, which is the encrypted store iOS provides for exactly that, and never in ordinary app storage. Passwords are stored only as a salted hash, by our authentication provider, and cannot be read back by us or anybody else.
No system is perfect and we will not claim otherwise. Tavo is not end-to-end encrypted: we hold keys to the database, which means a serious enough breach of our systems could expose task text. We think you should know that rather than be reassured. What is not there to lose: no card details, no postal addresses, no contacts, no location history, no advertising identifiers.
If a breach ever does put your data at risk, we will tell you and the relevant regulator, within 72 hours of finding out, as the law requires — and we would tell you anyway.
Your account is stored in the United States, so if you are outside it your tasks are transferred there.
For people in the United Kingdom or the European Economic Area, that transfer relies on the Standard Contractual Clauses our infrastructure provider has in place. If you would rather your tasks did not leave your device at all, Tavo is not currently the right app for you, and we would rather say so than bury it.
If you are in the United Kingdom or the European Economic Area, the UK GDPR and GDPR give you rights over personal data we hold about you: to be told about it, to see a copy, to correct it, to have it erased, to restrict or object to how it is used, and to take it elsewhere in a portable form.
Most of them you can exercise yourself, without asking us. Your lists and tasks are in front of you in the app: read them, change them, export them by sharing them, delete them. Settings → Account → Delete account erases the whole account and everything in it immediately. Settings → Preferences → Usage switches off the usage counts.
For anything else — a copy of what we hold, a correction you cannot make yourself, a restriction — write to the address under Contact and we will do it within a month, free of charge.
Why we are allowed to hold any of it:
If you think we have got this wrong, you can complain to a data protection regulator — the Information Commissioner's Office in the UK (ico.org.uk), or the supervisory authority in your own EEA country. You do not have to come to us first, though we would rather you did.
The CCPA and CPRA give California residents the right to know what personal information a business collects about them, to see it, to have it deleted, to correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising any of that.
What we collect, in the categories the law uses:
We collect nothing else. No contacts, no biometrics, no browsing history, no inferences drawn about you, no sensitive personal information as the CPRA defines it.
Tavo sells no personal information and shares none for cross-context behavioral advertising, has not done so in the past twelve months, and has no mechanism by which it could. There is therefore no "Do Not Sell or Share My Personal Information" link to offer you, because there is nothing for it to switch off.
To see or delete what we hold: Settings → Account → Delete account does it immediately and completely, or write to the address under Contact.
Tavo is not directed at children under 13, and you must be at least 13 to make an account — 16 in countries whose law sets that age for this kind of service. We do not knowingly collect personal information from anybody younger.
If a child under 13 has made an account, write to the address under Contact and we will delete it and everything in it. If you are a parent or guardian and want to see what is held first, ask and we will show you.
Tavo shows no advertising to anybody, of any age, and there is no third-party advertising or tracking software in it at all.
Your account, and everything in it: Settings → Account → Delete account. Immediate, complete, no recovery period, no retention offer, and no email to anybody. Apple requires this to be possible from inside the app and we agree with them.
Just the contents: Settings → Preferences → Delete Everything erases every task, list, tag and note while keeping the account, on this device and in your account, and the deletion reaches your other devices the next time they sync.
Deleting the app removes the copy on that device. It does not delete your account, so signing in again brings your lists back — which is the point of having one, and worth knowing before you assume otherwise. It also does not cancel a subscription; that is done in your Apple Account settings.
If this policy changes, the date at the top changes with it, and the new version appears here and on tavolist.com at the same time. Where a change materially affects what we do with your data, we will tell you in the app before it takes effect rather than quietly swapping the page.
It has changed twice in ways worth naming out loud. Earlier versions of Tavo collected nothing at all and said so; Tavo now counts how it is used, in the limited way described above, with a switch to stop it. And until September 2026 Tavo had no accounts and held none of your data — tasks lived on your device and in your own iCloud, and this policy said they never reached us. Tavo now keeps your tasks in an account on our own server, which is a materially different thing, and the sections above describe it plainly rather than leaving the old wording to imply otherwise.
Questions about this policy, or about anything Tavo does with your data:
Aspen Koch<br>2820 S Alma School Rd, Ste 18 #4395, Chandler, AZ 85286, United States<br>tavosupport@gmail.com
Tavo is made by one independent developer. There is no support department; the address above reaches a person.
Written to describe what Tavo actually does, in plain language rather than boilerplate. It has not been reviewed by a lawyer.