The German version is legally binding.

Privacy Policy

Version date: 20 October 2026. Only the German version is binding; translations serve understanding only.

This policy tells you which personal data we process at todo.monster (hereinafter the “Service”), for what purpose, on what basis, who receives them and how long we keep them. “lit. a” to “lit. f” refer to Art. 6 (1) GDPR.

1. Controller and Contact

Coozinha UG (haftungsbeschränkt), Sonnenallee 26, 12047 Berlin, Germany, represented by its managing director Jan Kube. Commercial register: Amtsgericht Charlottenburg, HRB 239912 B. E-mail: support@todo.monster.

We have not appointed a data protection officer; we are not obliged to do so. Please send questions about data protection and requests regarding your rights to support@todo.monster.

2. Scope and Roles

This policy applies to the website and the web app at todo.monster. The Service is directed at entrepreneurs and not at minors; we conclude contracts only with persons aged 18 or over.

We are the controller for your account, the login, the security of the Service, billing, support, system e-mails and the pilot programme.

We are the processor (Art. 28 GDPR) for contents that a company customer and its members process in company areas: projects, tasks, comments, attachments, time tracking, company mailboxes, company calendars and the AI conversion from company mailboxes. The controller is the company customer; the basis is the data processing agreement (DPA (ADV)), which every customer accepts upon registration. If you are a member or guest of a company, please contact the company with questions about these contents; requests that reach us are forwarded to it. For your own account, we remain the controller.

If you process data of other persons in the Service, such as the senders of imported e-mails or the participants of appointments, you are responsible for this yourself.

3. Visiting the Website

On every visit we process technical access data: IP address, time, requested address, browser identifier and response status. The purposes are delivery, troubleshooting and defence against attacks (lit. f; our legitimate interest is secure operation). For throttling against abuse we keep the IP address only as a hash for minutes to hours; reports from your browser about our security policy (Content Security Policy) are logged in truncated form and without personal reference.

The Service is hosted by Mittwald CM Service GmbH & Co. KG, Espelkamp, in a data centre in Germany. We delete server and application logs after 30 days. We serve scripts, fonts and stylesheets ourselves; the exceptions are set out in section 5 (bot protection) and section 12.

4. Cookies and Storage on Your Device

The cookies todomonster_session and remember are strictly necessary for the Service you have requested (§ 25 (2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)); consent is not required, which is why there is no cookie banner. In the browser storage (localStorage, sessionStorage) we remember display settings such as column widths, dismissed notices and the last project selection; these values do not leave your browser. We do not use analytics, advertising or tracking cookies and no fingerprinting.

When you schedule tasks, we store the time zone used for planning with the task or recurring rule. This time zone information is included in your data export. Determining the device time zone does not require location permission.

5. Account, Login and Security

Registration and profile. For an account we need your first name, last name, e-mail address and a password, which we store only as a hash; you confirm the address with a code sent by e-mail. Without this information we cannot conclude a contract; all further information (status message, profile photo, language, display settings) is voluntary. The basis is the contract of use (lit. b). Your name, your photo and your status message are visible to members of your projects and companies. We delete unconfirmed accounts after 14 days.

Consents. As evidence that you have accepted the Terms and Conditions and the DPA, we store the time, the version and the IP address (encrypted) (lit. f; interest in evidence).

Login. We log every login attempt with e-mail address, time, IP address, browser identifier and result in order to detect attacks; after 20 failed attempts within 15 minutes we temporarily block the login (lit. f). We delete this log after 90 days. Administrators of the Service see the time of your last successful login.

Password check. When a password is set, we send a short fragment of its hash value to the service “Have I Been Pwned” (api.pwnedpasswords.com) and check the response locally. Neither your password nor your identity can be derived from this fragment; the password itself never leaves the Service (lit. f; account security).

Bot protection. On the registration page, your browser loads a verification script from the service EU-Captcha (Myra Security GmbH). In doing so, that provider receives your IP address, the browser identifier and the verification result (lit. f; protection against automated sign-ups).

Access for AI clients (MCP). Only administrators of the Service can generate access tokens for AI clients; the tokens expire after 30 days, and we log accesses with the IP address. For other users, no processing takes place there.

6. Contents: Tasks, Projects, Comments, Attachments, Times, Companies

You create projects, modules, tasks (title, description, dates, status, priority), comments, assignments, tags, attachments and time entries; we keep a change history and notifications for these. The basis is the contract of use (lit. b); for company contents, section 2 applies. Contents are visible only to the members of the respective project or company according to their role.

Titles, descriptions, comments and access credentials of connected mailboxes and calendars are stored encrypted on the server side (AES-256); we store your password only as an Argon2id hash. In normal operation we do not access contents. The exceptions are restoration from the recycle bin at your request, during which administrators see the user name, e-mail address, project, module and task titles and deletion times, and error diagnosis; both are logged.

Deleted contents remain in the recycle bin for 30 days and are then permanently removed. We delete notifications after 30 days. You can retrieve your own working data as an export; the download is available for 24 hours.

Companies and invitations. For a company we store the name, owner, members and roles as well as a log of administrative actions (who changed what), which we retain for three years (lit. f; traceability). If you are invited by e-mail to a project or a company, we have received your address from the inviting person (Art. 14 GDPR); we process it only for the invitation (lit. f; the inviting party's interest in collaboration). The invitation expires after 7 days, and we delete the record after 30 days. The invitation e-mail links to this policy.

7. Connected E-mail Mailboxes

You can connect your own mailbox (IMAP/SMTP). We store the server, user name and password (encrypted) and retrieve messages every five minutes: sender, recipients, subject, text and attachments. Subject and text are stored encrypted. A spam filter learns from the markings you make. The basis is the contract of use (lit. b). The counterpart is the e-mail provider you have chosen; company mailboxes are connected by the company, and section 2 applies to them.

The senders and recipients of these messages hear nothing from us; the source of their data (name, address, contents) is your mailbox, and you or your company are responsible for it.

We remove deleted messages from the recycle bin after 45 days, a removed mailbox including its access credentials after 30 days, and retrieval logs after 7 days at the latest.

8. AI Function “E-mail to Task”

Only if you choose “With AI” in the mailbox do we transmit the sender name, sender address, time of receipt, subject and the cleaned text of the selected e-mail (at most 24,000 characters, no attachments) to a language model from Mittwald AI Hosting (Mittwald CM Service GmbH & Co. KG). The model runs in Germany; Mittwald has undertaken not to use the inputs for training models. What comes back is a proposal for title, description and date, which you review and change; no automated decision takes place.

For your data, the basis is the contract of use (lit. b); for the sender's data, our and your legitimate interest in prompt handling (lit. f). Before the first use we draw your attention to the transmission in the dialog; you can choose “Without AI” for each conversion or permanently switch the function off in your settings.

For each call we log the user, message, model, volume, duration and result without contents (lit. f; billing and abuse prevention) and delete the log after 90 days.

9. Calendars: Google, Microsoft and CalDAV

Google. You can connect a Google account. You sign in directly with Google and allow us there to read and write your calendars. We store the access tokens (encrypted) and the address of the account and retrieve appointments from the selected calendars: title, description, location, times and participants. Appointments that you create or change in the Service are transmitted by us to Google, including the names and addresses of the participants.

Microsoft. You can connect a personal Microsoft account (Outlook.com, Hotmail, Live). You sign in directly with Microsoft and allow us there, on a permanent basis, to read and write your calendars. We store the access tokens (encrypted) and the address of the account and retrieve appointments from the selected calendars: title, description, location, times, participants and attachments up to 5 MiB. Appointments that you create or change in the Service are transmitted by us to Microsoft, including the names and addresses of the participants; Microsoft may send them invitations.

CalDAV. Alternatively, you connect a calendar server of your choice (such as Nextcloud or Fastmail) with address, user name and password (encrypted); synchronisation works in the same way.

The basis is the contract of use (lit. b), because you set up the connection yourself. Google, Microsoft and your CalDAV provider are independent controllers of your choice, which you link on your own initiative; Google and Microsoft also process data in the USA (section 15). When we read appointments from your calendar, the calendar is the source of the data (Art. 14 GDPR); when we write appointments, the calendar provider is the recipient. You are responsible for the data of appointment participants. If you disconnect the connection, we delete the access credentials and retrieve nothing further; imported appointments remain until you remove them or your account is deleted.

10. Paid Plans, Invoices, Contracts

If you book a paid plan, we store the billing name and address, billing e-mail, where applicable VAT ID and commercial register number, the contract, invoices, payments and direct debit mandates (lit. b). We retain invoices and accounting records for ten years (lit. c; § 147 AO (German Fiscal Code), § 14b UStG (German VAT Act)). We verify your VAT ID via the EU Commission's validation procedure (VIES); we redact the response after 400 days. When you book, we log the time, version and IP address (encrypted) of your consents and delete the IP address three years after the end of the contract. In a company, the owner sees which members are billed. If you use a referral code, we store the link between the referring and the referred account for the credit (lit. b).

Payments are processed by Mollie B.V., Amsterdam, Netherlands. Mollie receives the name and e-mail address of the billing account, the amount, the payment reference and the payment method, and reports the payment status back to us. Mollie is an independent controller; its privacy policy: mollie.com/de/privacy.

11. System E-mails and Support

We send you e-mails that the Service needs: confirmation code, login link, invitations, invoices, notifications, confirmations regarding contract and deletion (lit. b). They are sent via Mittwald's mail server in Germany; the sending log contains neither the address nor the subject.

If you write to support@todo.monster, we process your address and the content in order to handle the request (lit. b, otherwise lit. f). We retain support requests for a further 12 months after completion for follow-up questions.

12. Optional Integrations: Error Reporter and Videos

Error reporter. When logged in, you can report an error to us. Only when you trigger the report do we transmit a screenshot of the current page (it may show contents of other persons), title and description, optionally your contact details, page address, browser, device, screen size and time to our reporting server at Strato (Germany) (lit. f; troubleshooting). The report window loads its script from this server and stores no identifiers in your browser. We delete reports and screenshots after 90 days.

Videos. We embed introductory videos via YouTube only after you click (two-click solution); before that, your browser has no contact with Google. By clicking, you consent to Google receiving your IP address and usage data of the video (lit. a; § 25 (1) TDDDG). “Always load” stores this consent in your account; you can withdraw it at any time with effect for the future. Google also processes data in the USA (section 15).

13. Pilot Programme and Onboarding

If your company takes part in the pilot programme, we accompany the rollout: for each company we keep a file with history, checklists and a contact log, invite you to live sessions, ask about your satisfaction (surveys, NPS, free-text responses) and store your progress with the introductory videos. The basis is the pilot agreement (lit. b) and our interest in improving the product (lit. f). If a prospect names a contact person to us, we receive that person's name, e-mail address and telephone number from the prospect (Art. 14 GDPR) and use them only for the invitation.

Periods: surveys lose their personal reference after 12 months; we delete free-text responses and files after 24 months, recordings of live sessions after 30 days, and completed pilot invitations after 12 months. We log access requests regarding these data, without contents, for three years.

14. Recipients

We have contracts under Art. 28 GDPR with our processors; the complete list with addresses is set out in Annex C of the DPA. Authorities receive data only if we are legally obliged to provide them (lit. c).

15. Transfers to Third Countries

Everything we commission ourselves (hosting, data backup, mail delivery, AI model, error reporter, payment) runs in the EU. Outside the EU, only what you initiate is processed: if you connect a Google or Microsoft account, Google or Microsoft respectively also processes your calendar data in the USA; if you load a YouTube video, Google receives data in the USA. The basis is the EU Commission's adequacy decision on the EU-US Data Privacy Framework, insofar as the recipient is certified under it; otherwise it is the EU Commission's standard contractual clauses. A mailbox or a calendar server outside the EU is your own choice. The hash fragment of the password check (section 5) goes to a service outside the EU but contains no personal data.

16. Retention Periods

After the account is deleted, a record without personal reference (“Deleted user”) remains, because contributions in shared projects, invoices and contracts refer to it; your contributions remain available to the other members without your name. Login logs retain a truncated IP address without browser identifier until their period expires.

17. Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You change your name, address and settings in your profile; you export your working data there as a file; you delete your account there yourself. You can withdraw a consent (videos, section 12) at any time with effect for the future; processing up to the withdrawal remains lawful. For everything else, an informal e-mail to support@todo.monster is sufficient. If your request concerns the contents of a company, we forward it to the company (section 2).

Right to object (Art. 21 GDPR). You can object at any time, on grounds relating to your particular situation, to processing that we base on a legitimate interest (lit. f). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not engage in direct marketing.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de.

18. Automated Decisions

We do not make decisions based solely on automated processing, and we do not create profiles. The AI function (section 8) only provides proposals, which you review.

19. Changes

We adapt this policy when the Service or the legal situation changes. If we wish to process data for a purpose other than the one stated here, we will inform you beforehand. The version published on this page with the version date in its header applies.