today-md privacy policy

Your work stays on your Mac

today-md is provided by liebhardt.io UG (haftungsbeschränkt), Nußbaumstraße 29, 66121 Saarbrücken, Germany. Contact hello@toolstokeep.com for privacy questions. This policy covers the macOS app; our website privacy notice covers checkout, account access, downloads, support, and the licensing service.

today-md stores tasks, lists, notes, settings, and backups locally. It does not send your tasks, notes, or calendar content to us. The app has no advertising, tracking, telemetry, or third-party analytics SDKs. Purchase and license information is handled separately as described below.

Local storage, exports, and folder sync

The app uses a local SQLite database and can write Markdown mirrors and backups. You choose whether to export files or enable folder sync. When you choose a sync folder, today-md reads and writes files there and stores a security-scoped bookmark on your Mac to retain the access you grant.

If the folder is managed by iCloud Drive, Dropbox, OneDrive, or another provider, that provider handles the files under its own terms and privacy policy. We do not receive a copy. Deleting a file locally does not necessarily remove a provider’s backups or synced copies.

Optional Calendar access

With your macOS permission, today-md uses Apple EventKit to read availability and create calendar time blocks at your direction. It processes this information on your Mac and does not send it to us. Your calendar provider may sync changes according to your calendar settings. You can revoke Calendar permission in macOS System Settings.

App Store purchases

Apple processes Mac App Store payments through StoreKit. The app receives product and transaction information to determine whether Pro is unlocked. Apple handles your Apple Account, billing, purchase restoration, and refund requests under Apple’s privacy policy. We do not receive full payment-card or bank details.

The currently published Mac App Store edition unlocks Pro through its in-app purchase. Website licenses apply to the direct-download edition described below.

Website purchases and license activation

A website purchase uses Stripe Checkout and a purchase email address. The website privacy notice explains order, account, payment, invoice, and license records. Your short ttk_ key is a random reference to a signed license containing your purchase email address and license limits. When you enter a short key, the app retrieves the signed license from https://toolstokeep.com/api/activate, verifies its signature, and stores it in the macOS Keychain. This first activation requires a connection; subsequent local verification works offline. Older signed keys remain supported.

The direct-download edition also contacts the activation service when you enter an older signed key, and again about once a week to check whether the license was refunded or revoked. The Mac App Store edition only contacts this service if you choose to enter a short key, with no weekly checks. Each request sends the key or stored signed license and a SHA-256 hash derived from the Mac’s hardware identifier. We store the hash, the associated license, and activation time to enforce the device allowance. The raw hardware identifier stays on your Mac. The hash can be associated with your license and is pseudonymous rather than anonymous.

Activation requests also expose normal connection information such as the IP address to our Cloudflare-hosted service. Activation and delivery rely on contract performance (Article 6(1)(b) GDPR), and protection against license misuse on legitimate interests (Article 6(1)(f)). Between these checks, signature verification takes place locally, and a failed check because you are offline changes nothing. No task, note, or calendar content is included in activation requests.

Optional feedback and update checks

The Feedback window prepares a draft addressed to feedback@todaymd.app in your chosen email app. The draft contains the report type, summary, and message you write, plus the app version, build number, and macOS version. You review and send it yourself. Copy Report places the report on your Mac’s clipboard instead. The app does not automatically attach tasks, calendars, license keys, or diagnostic files.

If you send the email, we also receive the sender address and other information included by your email service. We use the report to respond, investigate problems, and improve the app. Purchase-related support relies on Article 6(1)(b) GDPR; other feedback relies on our legitimate interest in responding and improving the product (Article 6(1)(f)).

The website direct-download edition does not currently contain an automatic updater. Download included updates from My tools. Some GitHub editions offer Sparkle update checks, with an automatic-check setting in the app. Those checks and downloads contact the configured GitHub release feed and download hosts, which receive ordinary connection information such as the IP address. System profiling is disabled in that configuration. Mac App Store updates are handled by Apple.

Support, retention, and your controls

You control locally stored content. You can delete tasks and notes in the app, turn off folder sync, revoke Calendar access, remove exports and backups, and remove the app and its local data. Uninstalling the app does not necessarily remove its Keychain entry or files in a sync folder. We cannot recover or erase content that exists only on your device.

If you contact support, we process what you choose to send. Avoid posting private task, calendar, license, or payment data in public GitHub issues. Account and activation records are retained to provide your license, manage device limits, and meet legal obligations, as explained in our website notice. Deleting local files does not delete purchase records.

The website notice describes recipients, international processing, retention criteria, and your rights to access, correction, erasure, restriction, portability, objection, and complaint. Contact hello@toolstokeep.com to make a request. You may complain directly to the Unabhängiges Datenschutzzentrum Saarland or another competent supervisory authority.