Privacy policy

Last updated: 29 October 2026 · Applies to the Tickbase apps and tickbase.app

1. Who we are

Tickbase is an independently built to-do app, designed and operated in the United Kingdom by Caesoose Studios Limited (“Tickbase”, “we”, “us”), a company registered in England and Wales, company number 16582592, registered office Office 9437kj, 182-184 High Street North, East Ham, London E6 2JA, England. Caesoose Studios Limited is the controller of your personal data. We are subject to the UK GDPR and the Data Protection Act 2018, and you can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data. We are the data controller for the personal data described in this policy. You can reach us at hello@tickbase.app.

2. What we collect

Using Tickbase without an account (Free)

Nothing about you or your tasks. The free app stores your tasks, lists, tags, notes and settings locally on your device. No account is created and none of that data is sent to us. If you use the web app at app.tickbase.app without signing in, your data lives in your browser's storage.

The one thing the free app does send is an anonymous daily check-in so we can count how many people use Tickbase: a random install id, the platform, the app version and whether the install is signed in. It contains no account id, no name or email and no content, we do not store the IP address it arrived from, and you can turn it off in Settings. Section 7 has the details.

Buying Premium without an account. On iPhone and Android you can buy Premium without signing in. The purchase is between you and Apple or Google, and it works on that device and the others signed in to the same Apple or Google account. RevenueCat, which handles in-app purchases for us (section 6), records it under a random id made on your phone, with no name or e-mail address, and we hold nothing about it. If you sign in later, now or whenever you like, the app passes that random id to us; we ask RevenueCat what it covers, give your account Premium, and keep the id with your account so its renewals reach you. Premium then works on every device you sign in on.

Using Tickbase Premium

We do not collect your contacts, location, calendar, photos or anything else from your device. Reminders are notifications scheduled on your device (on iOS and Android; browser notifications on web and desktop while the app is open); they do not pass through our servers. When something changes on another device, we send your phone an empty push so that it can sync in the background and work out its own reminders; the push says nothing but that there is something to fetch. We also send one such push each day just after midnight on your phone, so it recounts the day's badge, brief and reminders even when nothing changed. When you save a task whose reminder is due within 15 minutes, your device also asks us to send that push straight away rather than after a short wait; the request says only that, not which task or when.

If you turn on Show my calendar, the app shows your appointments beside the day's tasks. On iPhone and Android it reads the calendars you pick straight from the phone's calendar store and keeps what it reads on the phone; nothing about your calendar is uploaded or synced. You can also add a calendar's private iCal link; because a browser cannot read those links directly, the app asks our server to fetch the link and pass it straight back. The server does not log the link and does not keep the calendar; the events are parsed and kept on the device that read them. The links you add, and which events you dismissed, are part of your settings and sync between your devices end-to-end encrypted, like everything else in your account. Dismissing an event hides it in Tickbase on your devices and changes nothing in your calendar.

We looked at connecting Google Calendar through Google's own API and chose not to. It would have meant our server holding a key to your calendar and reading your appointments as they arrive, and we would rather see nothing. So everything to do with your calendar happens on your devices: the phone reads its own calendars; a subscription link is fetched through our server for the device that asked and never stored; and if you turn on My tasks in a calendar, the phone itself writes your tasks into a calendar you pick. If that calendar belongs to your Google or iCloud account, that account carries them on under its own terms — the titles you choose to write are then outside Tickbase's encryption, which the app says before you turn it on.

A phone can also share the calendars it shows with your other devices, so the appointments it reads appear on the web and the desktop too. Those go through your account the way a task does: the phone writes them encrypted end to end, the other devices decrypt them, and our server stores only the ciphertext. They stay on your devices, and a phone that stops sharing withdraws them.

3. How we use it

• To provide Premium: storing your tasks and delivering them to the devices signed in to your account.
• To run your account: sign-in, subscription status, trial reminders, and replying when you email us.
• To keep the service secure and working: rate limiting, abuse prevention, and fixing faults.
• To meet legal obligations, such as tax records for payments.

We do not use your tasks to train or feed any machine-learning or AI model, ours or anyone else's, and we do not read them. Synced data is encrypted on your device before upload; the only way we would ever see it in plain form is if you ask us to recover your account and have left support recovery on (see Encryption). Our legal bases under GDPR are performance of a contract (providing the service you signed up for), our legitimate interests in keeping the service secure, and compliance with legal obligations.

4. Where it's stored

Synced data is stored on Cloudflare's infrastructure. It is encrypted in transit (TLS), and your tasks are encrypted on your device before they are sent, so what is stored is ciphertext (see Encryption). Access to production systems is limited to the people who operate Tickbase and is protected by multi-factor authentication. Cloudflare's data centres are located worldwide; where data is transferred outside the UK or EEA, it is covered by Cloudflare's standard contractual clauses and equivalent safeguards.

Nothing is perfectly secure. If we ever become aware of a breach affecting your data we will tell you and the relevant regulator without undue delay, as the law requires.

5. Encryption

Every synced item (tasks, lists, tags, habits, habit logs, countdowns and focus sessions) is encrypted on your device with AES-256-GCM under a random key that belongs to your account, before it is uploaded. Our database holds only the ciphertext, together with each item's random id, last-updated time and a deleted flag, which sync needs in order to merge changes. A copy of the database on its own reveals nothing about your tasks.

If you lock the app or a list, the passcodes are kept only as scrambled hashes (PBKDF2-SHA256, with a random salt), inside your encrypted settings and lists, so they reach us as ciphertext like everything else and we never see them. Face ID, Touch ID and the like are checked by your phone; nothing about them reaches Tickbase. Whether a device locks the app, and how soon, stays on that device.

A list you make with Only on this device is never sent to us at all, encrypted or not: not the list, not its tasks, not their focus sessions. We hold nothing of it and cannot restore it. If you later move a task into such a list, your other devices are told only that the task was deleted.

Standard mode (default)

Your account key is stored sealed, two ways: encrypted with a secret that is kept outside the database, and separately to an offline recovery key held by the founder. Signing in on a new device unlocks the key; you have no passphrase to remember. We don't read your data and the database on its own can't reveal it. To be precise: someone with the database and that separate secret, or the founder's offline key, could read it. That is the trade-off for a passphrase-free account, and it is what allows us to give your data back if you ask for help.

Strict mode (optional)

In Settings → Encryption you can set a passphrase. Your key is then re-sealed with the passphrase and a one-time recovery code, and the server deletes its own copy of the seal. From that point the service cannot read your account and every new device must enter the passphrase or recovery code. A separate setting, Allow support recovery, controls whether the offline recovery key is kept: on, the founder can restore access at your request; off, nobody but you can open the account, and losing both the passphrase and the recovery code means the data is unrecoverable. The app tells you this before you turn it off.

Shared lists

Sharing a list does not weaken any of the above. Every account has a public key (an X25519 keypair; the private half is stored sealed with your account key, so only your unlocked devices can use it). A shared list has a random key of its own. Everything in it, its tasks, comments and activity feed, is encrypted under that key before it leaves a member's device, and the list key is sealed to each member's public key by the device of someone who already holds it. We store those seals and cannot open any of them; we never hold a list key. This works the same in Strict mode.

What we do see about a shared list is its shape: who shares which list with whom, each member's role and e-mail address, when they were invited and joined, when the list's encrypted rows change and how many there are. While an invitation is open we also hold the name of the list in plain text, so the invitation, and the e-mail we send about it, can say what it is for; it is deleted the moment the invitation is accepted or declined. Members of a list see each other's name, e-mail address and profile picture, including a picture that came from your Google account. Every member can open the files attached to the list's tasks; leaving or being removed ends that from our side, though a copy already opened on a device stays there.

When someone is removed from a list, or leaves, their seals are deleted and the list key is rotated, so they receive nothing new. What was already on their devices stays there: that is true of every end-to-end encrypted system and we would rather say so than imply otherwise. When the owner stops sharing a list, its encrypted rows, memberships and seals are all deleted from our servers.

Adding tasks by e-mail

If you turn this on (Settings → Integrations, Premium), your account gets a private e-mail address, and mail sent to it becomes a task. This is the one place where content reaches our server readable, and we want to be exact about it. A message arrives as ordinary e-mail. Our server parses it and, in the same moment, seals it for your devices: each attachment is encrypted under a key made for that one file, and the message itself (subject, text, who sent it, the attachments' keys) is encrypted under a random key that is sealed to your account's public key, the same one shared lists use. Nothing readable is stored. But for the moment between arrival and sealing the message is readable in our server's memory, so a compromise of our server at that moment could read mail as it arrives. That is a weaker promise than the one for everything you type into the app, which our server never sees at all, and the app says so before you turn the address on.

What we store is an envelope we cannot open, in Standard or Strict mode. Your device collects it on its next sync, makes the task, and we delete the envelope; if no device collects it within 30 days we delete it anyway, attachments included. What we keep about a message is that one arrived, when, how big it was and how many files it carried, plus for seven days a salted hash of its Message-ID so a mail server that retries does not make two tasks. Not the sender, not the subject, not a file's name. Mail that fails both SPF and DKIM, mail for an address nobody has, and mail for an account whose Premium has ended is refused. The address is the secret: anyone who has it can add tasks to your account, not read anything, and you can replace it at any time.

What the service can still see

Encryption covers the content of your items. In either mode we still know:

Profile pictures are the one exception to encryption: a picture you upload in Settings is stored as an ordinary image so that your other devices can display it. It is served from an unguessable URL tied to your account, is shown to the members of any list you share or join and to nobody else, and is deleted with your account or whenever you remove it in Settings.

Countdown photos are not an exception. A photo you add to a countdown is shrunk and encrypted on your device before it is uploaded, with a key that is kept inside the countdown itself, and the countdown is encrypted exactly as your notes are. We store the encrypted photo under a random name that says nothing about it, and hold no separate key for it: whatever protects your notes, including strict mode, protects your photos in the same way. It is deleted when you remove or replace it, delete the countdown, or delete your account.

Attachments on tasks work the same way. A file is encrypted on your device with a key made for that one file, the key is kept inside the task, and the task is encrypted exactly as your notes are; we store the encrypted file under a random name and hold no separate key for it. What we do hold about each file is its size, which account's storage it counts against (for a task in a shared list, the list's owner), who uploaded it, which shared list it belongs to, and when it arrived. We never learn the file's name, its type or which task it is on. It is deleted when you remove it from the task, delete the task, or delete your account. Attachments are part of Premium: once Premium ends they stay readable for 90 days, we e-mail you 30 days and 7 days before the end, and then we remove them, because we would rather not hold data you are no longer using, even encrypted.

If you sign in with Google and your account has no picture yet, the picture on your Google account becomes your Tickbase picture: we fetch it once from Google when you sign in and keep a copy in our own storage, exactly as if you had uploaded it, so your devices and the members of your shared lists load it from us and never from Google. We do not keep Google's link. You can replace the picture with one of your own or remove it in Settings at any time; because a Google sign-in fills in a missing picture, removing it and signing in with Google again copies it afresh, so upload a different one if you would rather it stayed away. Signing in with Apple or with an e-mail code sets no picture.

• your email address and name, from your Google or Apple sign-in;
• your subscription status (a Paddle customer reference, or App Store / Google Play status);
• when you sync and how much data is transferred;
• for each phone, its push address, its time zone offset, and when it was last woken to sync;
• how many encrypted rows of each kind (tasks, lists, tags, and so on) your account holds;
• each item's random id, last-updated time and deleted flag, which carry no content or dates;
• for shared lists, who is in which list with which role, and the list's name while an invitation to it is open (see Shared lists);
• if you add tasks by e-mail, your private address, and the size, arrival time and file count of each message waiting to be collected (see Adding tasks by e-mail).

On your devices

So that Tickbase opens instantly and works offline, each signed-in device keeps your account key and a plain local copy of your data, protected by the device's own security (the system keychain or secure storage on iOS and Android; browser storage on the web and desktop). In Strict mode, “Lock this device” forgets the key. Encrypting the local copy at rest is on the roadmap.

Calendar events shown beside your tasks (see above) are not part of your account: they are read on each device from that device's calendars or from your subscription links and never enter the encrypted store. Only the links and your dismissals do.

6. Who we share it with

We share personal data only with the processors needed to run the service, and only what each one needs:

• Cloudflare — hosting, storage and delivery of the service, and counting visits to this website.
• Paddle — the merchant of record for web purchases, including gifts. Paddle receives your email, country and payment details to sell you the subscription, charge the right tax and issue invoices. Your card or PayPal details are entered in Paddle's own secure checkout, which opens over our page; they go to Paddle and are never sent to us, so we never see or store them. If your subscription renews, it is Paddle that keeps the card for it, and Manage subscription in Settings takes you to Paddle to change it. What we keep is a Paddle reference for your account and its purchases, so we know you have Premium and can match a refund or a cancellation. See Paddle's privacy policy.
• Apple and Google — sign-in, and payments made through the App Store or Google Play. They see what they need to process the sign-in or purchase and nothing about your tasks. A purchase on the phone is paid with the card on your Apple or Google account, which they hold; we are only told whether you have Premium.
• RevenueCat (RevenueCat, Inc.) — handles purchases made through the App Store and Google Play for us, and tells us whether you have Premium. It receives the store's record of the purchase and either your account id or, if you bought without an account, a random id made on your phone. We send it no name, no e-mail address and nothing about your tasks. It is based in the United States. See RevenueCat's privacy policy.
• Expo (650 Industries, Inc.) — passes the empty wake-up pushes to Apple's and Google's push services, which deliver them to your phone. Expo receives your phone's push address and nothing else: no name, no e-mail address, nothing about your tasks. It is based in the United States.
• Resend — to send account emails such as sign-in links, receipts and the warnings before attachments are removed. Resend receives your email address and the contents of that email, and nothing about your tasks. It is based in the United States, so those transfers rely on standard contractual clauses. See Resend's privacy policy.

When you share a list, or join one, the other members of that list see your name, e-mail address and profile picture, and what you do in the list. That is sharing you chose, with people you chose; we deliver it and don't read it.

We do not sell personal data. We do not share it with advertisers, data brokers or analytics companies. We will disclose data if legally compelled to, and will tell you unless the law prevents it.

7. Analytics and tracking

There is no third-party tracking in the apps or on this website: no advertising SDKs, tracking pixels or social-media embeds. The apps contain no third-party analytics at all. The only cookies or local storage we use are strictly necessary: your sign-in session, your theme preference, and the install id described below. Because we don't use cookies for anything else, there is no cookie banner.

Counting users

We would like to know how many people use Tickbase, so each installed app checks in with our server at most once a day. The check-in contains exactly four things: a random install id that the app generated when it was first opened, the platform (web, Mac, Windows, Linux, iOS or Android), the app version, and whether the install was signed in at the time. That is all. It carries no account id, name, email, task, list or tag; we do not store the IP address it came from; and the install id is never linked to an account, even if you are signed in. We use these check-ins only to count installs, active installs and downloads per platform.

You can turn the check-in off at any time in Settings → Data → Privacy (web and desktop) or Settings → About → Privacy (iOS and Android). The setting applies to that device. Installs that have not checked in for twelve months are deleted.

When you download the desktop app from this website, the download link passes through our server so we can count downloads per platform and per day. No IP address, user agent or other detail is kept.

Our hosting provider records standard server logs (see section 2), which we use only for security and fault-finding. This website (not the apps) also counts visits with Cloudflare Web Analytics, from the same company. A small script reports the page you are on, the page that sent you there, your browser type, how quickly the page loaded and, from your connection, your country. It sets no cookies, stores nothing on your device, does not fingerprint you or follow you to other sites, and we see only totals.

8. Retention

• Account and task data: kept while your account exists. When you delete your account, it is removed from live systems immediately and from backups within 30 days.
• A note of a deleted account: kept for two years after the deletion, so we can answer a question about a payment or a support request afterwards. It holds the account's random id, when it was made and deleted, its plan, how it signed in, how many devices and items it had and when it last synced, and a one-way fingerprint of its e-mail address, from which the address cannot be read back. Nothing you wrote is in it.
• Premium bought on this website: the e-mail address is kept until the purchase is on an account, then deleted; the record of the payment is kept like any other (below).
• Shared lists: a list's encrypted rows, memberships and sealed keys are kept while the list is shared, and deleted when its owner stops sharing it or deletes their account. Leaving a list, or being removed, deletes your seals at once; the rows stay with the list for the people still in it. An invitation that is declined is deleted at once.
• Attachments: kept while the task exists and Premium continues. Deleted when you remove them, delete the task, or delete your account; and 90 days after Premium ends, after two e-mail warnings. The encrypted files themselves are not in our backups, only the record of who stored what.
• Mail sent to your task address: kept sealed until one of your devices collects it, and deleted then; or after 30 days, attachments included; or when you turn the address off or delete your account. The hash kept to spot a retried delivery goes after 7 days.
• Push addresses: deleted when you sign out on that phone, when Apple or Google report that the app has gone from it, when you delete your account, or after 60 days without the app being opened.
• Server logs: 30 days.
• Usage check-ins: an install record is deleted twelve months after its last check-in. Download counts are kept only as daily totals per platform.
• Payment records: as long as tax and accounting law requires (typically 6–7 years), held by Paddle and in our accounting records; these contain the transaction, not your tasks.

9. Your rights

Wherever you live, you can do the following directly in the app, without asking us:

• Export everything as a JSON file, or your tasks as a CSV: Settings → Export.
• Delete your account and all data on our servers: Settings → Account → Delete account. One tap, with one confirmation.
• Correct your name in Settings; your email comes from your Google or Apple sign-in.

If you are in the UK, EU or EEA, you also have rights under the UK GDPR and EU GDPR to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to complain to a supervisory authority (in the UK, the Information Commissioner's Office; in the EU, your national data-protection authority). Residents of other places, including California, may have similar rights under local law. To exercise any right not covered by the in-app controls, email hello@tickbase.app; we respond within 30 days and never charge for it.

10. Children

Tickbase Premium accounts are for people aged 16 and over (or the age of digital consent where you live, if higher). The free app collects nothing and can be used by anyone. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

If we change this policy in a way that matters, we'll email account holders and show a notice in the app before the change takes effect. The “last updated” date at the top always tells you the current version. Previous versions are available on request.

12. Contact

Questions, requests or complaints: hello@tickbase.app.