Do you like cookies?

octo.do has no tracking and no analytics. Your choice only switches the chat assistant: accept, and it can open; decline, and it stays off.

Skip to content

Privacy Policy for octo.do

Version: 2026-10-24, applies from the move of octo.do to the new platform. The German version is the reference text.

1. Controller

Octily GmbH, Randolfstraße 18, 12524 Berlin, Germany, represented by its managing director Robert Bucher. Email: octily@octily.com. More details are in the legal notice.

We are not required to appoint a data protection officer (section 38 BDSG, Art. 37 GDPR). Questions about data protection: octily@octily.com.

2. In short

  • Your tasks are stored in a database in Frankfurt am Main (Amazon Web Services, region eu-central-1) and also on your devices.
  • There are no passwords, no ads, no tracking and no analytics cookies.
  • AI features in the app are only part of Pro and Lifetime; on the public pages there is a chat assistant if you allow it. Both run through Amazon Bedrock in data centres in the EU. Your input is not used to train models.
  • We do not sell data.

3. Visiting the website and the app

When you visit octo.do, our hosting provider Cloudflare processes technically necessary data: IP address, time, requested address, browser identifier. This is needed to deliver the pages and to fend off attacks. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Our server logs (Cloudflare Workers Logs) contain no full request logs, only errors and security events; they are deleted after at most 7 days. The database logs sign-ins to the database itself (service accounts, not people); AWS deletes these logs after 7 days.

To prevent abuse we count requests per IP address (for example for the chat assistant and the cancellation and withdrawal buttons). For this we store the IP address briefly together with a counter; it is deleted after at most two days.

4. Account and sign-in

For your account we store your email address, your name (if given), your profile picture (if Google or Apple provides one), the sign-in method and your active sessions (device, time). The legal basis is our contract with you (Art. 6(1)(b) GDPR).

  • Sign-in link by email: we send the link through the email service Resend (section 10). The link works once and for 10 minutes.
  • Google or Apple: if you sign in with them, we receive your email address, your name and an identifier from Google or Apple. Apple may offer to hide your address; we then receive a relay address. Google and Apple are independent controllers for the sign-in itself; their privacy notices apply.
  • Passkey: we only store the public key. The private key and your biometrics stay on your device.
  • Session: a sign-in stays valid for 30 days and is extended while you use octo.do.

5. Tasks and sync

We store what you create in octo.do: tasks, categories, WSJF values, notes, due dates, done status and the history of your changes. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

The data is stored encrypted in a database (Amazon RDS) in Frankfurt. Our own sync service (PowerSync, operated by us at Amazon Web Services in Frankfurt) brings it to your devices. Every device holds a copy of your lists in browser storage (IndexedDB) or app storage so that octo.do also works offline. When you sign out, we delete this copy on the device.

6. AI features in the app (Pro and Lifetime only)

When you use an AI feature, we send the content it needs (for example your message to the chat assistant, a task title or your answers in the setup assistant) to Amazon Bedrock, where the language model Claude by Anthropic answers the request.

  • The call goes to the AWS region Frankfurt (eu-central-1) and uses the EU inference profile, so AWS processes the request in one of its EU regions (Frankfurt, Stockholm, Milan, Spain, Ireland or Paris), never outside the EU.
  • The model runs at AWS; Anthropic has no access to your input and the answers. AWS and Anthropic do not use them for training. AWS may check them automatically for abuse (Amazon Bedrock abuse detection).
  • octo.do stores no chat log. Only what you take over (for example a new task) is stored, plus a counter of the tokens used per month (for the allowance).

The legal basis is our contract with you (Art. 6(1)(b) GDPR). Without Pro or Lifetime there is no AI processing in the app.

7. Chat assistant on the public pages

On the public pages of octo.do a chat assistant answers questions about octo.do, also without an account. It only appears once you choose "Accept" in the notice on your first visit.

  • Your messages and the page you are on go to Amazon Bedrock in the EU as in section 6. Please do not enter confidential data there.
  • We store no chat log. In the browser we store a random chat identifier (octodo-chat-session-id); with it and your IP address we limit the number of messages (section 3).
  • Legal basis: our legitimate interest in answering questions about octo.do (Art. 6(1)(f) GDPR) and, for the chat identifier in the browser, your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time by deleting the site data for octo.do in your browser; the chat assistant is then hidden again.

8. Payment (Pro and Lifetime)

Stripe handles payment, subscription management, invoices, credit notes and the VAT calculation (Stripe Tax). Stripe processes your payment data, your billing address (for the VAT of your country), your VAT identification number if you give one, and your email address. We never see card numbers. We store the ID of your Stripe customer, the plan, the status and term of your subscription, for purchases the amounts, the country for VAT and whether you requested the immediate start at checkout.

Legal bases: contract (Art. 6(1)(b) GDPR) and statutory retention duties (Art. 6(1)(c) GDPR, section 147 AO, section 257 HGB, section 14b UStG; periods in section 14). Stripe is an independent controller for fraud prevention and its own legal duties.

9. Cancellation and withdrawal

If you cancel or withdraw with the buttons "Verträge hier kündigen" or "Vertrag widerrufen" or signed in in the app, we process the details from the form (name, email address, contract, requested end, for an extraordinary cancellation the reason), the time of receipt and briefly your IP address (section 3). You receive a confirmation of receipt by email, we keep a copy as evidence.

The legal basis is our legal obligation (sections 312k, 356a BGB; Art. 6(1)(c) GDPR) and our legitimate interest in being able to prove cancellation and withdrawal (Art. 6(1)(f) GDPR). We keep the copy for three years from the end of the year of the declaration (regular limitation period, sections 195, 199 BGB); if it belongs to a refund or credit note, the period for accounting records applies (section 14).

10. Service providers (processors)

These providers process data on our behalf. With each of them there is a data processing agreement under Art. 28 GDPR; it is part of the respective service agreement.

  • Amazon Web Services EMEA SARL, Luxembourg: database, sync service, backups, logs and alarms in the Frankfurt region (eu-central-1); AI through Amazon Bedrock in EU regions.
  • Cloudflare, Inc., USA: delivery of the website and app, programming interface (API), connection to the database, protection against attacks. Cloudflare works worldwide at the location closest to you.
  • Stripe Payments Europe, Ltd., Ireland: payment, subscriptions, invoices, VAT (see section 8).
  • Resend (Plus Five Five, Inc.), USA: sending our emails (sign-in links, order and receipt confirmations). Resend stores account, log and sending data in the USA.

Google and Apple, when you sign in with them (section 4), and Stripe for its own purposes (section 8) are independent controllers, not processors.

11. Transfers outside the EU

Cloudflare and Resend are based in the USA; Stripe transfers some data to Stripe, LLC in the USA. These companies are certified under the EU-US Data Privacy Framework (list on dataprivacyframework.gov, checked on 2026-10-24), covered by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

12. Interfaces: API tokens, MCP and connected accounts

  • API tokens: we store the name, permission, expiry date, last use and a checksum of the token, never the token itself.
  • MCP: if you connect an AI assistant (for example Claude Code), we store the grant (assistant, permission, times) and a log of the accesses. The data the assistant reads goes to its provider, who is responsible for it.
  • Connected accounts (octily.io): we store the connection and an encrypted access key. Your octily.io tasks are only displayed; they stay at most 60 seconds in memory and are never stored in our database or on your devices.

The legal basis is our contract with you (Art. 6(1)(b) GDPR).

13. Cookies and browser storage

octo.do uses browser storage almost only where it is strictly necessary for the service (section 25(2) no. 2 TDDDG); this needs no consent.

  • Sign-in cookies with the prefix octo_do (Better Auth) for the domain octo.do and its subdomains: keep you signed in. HttpOnly, Secure, SameSite=Lax, up to 30 days.
  • Browser storage (localStorage): language, appearance (light/dark), the account used last, the day of the last list reset, whether you have seen the introduction, the sample tasks of the demo on the home page, your choice in the notice on your first visit.
  • Local database (IndexedDB): your lists for offline use (section 5).

Only the chat identifier of the chat assistant on the public pages (section 7) needs consent. The notice on your first visit asks for it; if you decline, the chat assistant stays hidden and everything else works. We set no tracking, advertising or analytics cookies.

14. How long we keep data

  • Account and tasks: as long as your account exists. Deleted tasks stay in the trash for 30 days and are then removed for good.
  • Deleting your account: if you delete your account (Settings > Account), we remove the account and tasks from the database at once; a running subscription is ended first. Backups still contain the data for up to 35 days; if a backup is restored, we delete the data of deleted accounts again before the database is used.
  • Invoices, credit notes and other accounting records: 8 years; commercial and business letters 6 years; each from the end of the calendar year (section 147 AO, section 257 HGB, section 14b UStG). This data is held by Stripe and in our accounting.
  • Evidence of cancellations and withdrawals: see section 9.
  • Logs and abuse counters: see section 3.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)). Write to octily@octily.com.

You can complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, who is responsible for us.

16. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR. The WSJF order and AI suggestions are aids that you can change at any time.

17. Changes

If the service or the law changes, we update this policy. The date at the top shows the version.