Privacy Policy

This policy explains what personal data Totil collects, what it uses it for and what your rights are. Totil (Portugal) is the controller of your data. For any questions, contact suporte@totil.net.

1. What data we collect

• Email — to create your account and sign in (passwordless authentication).
• Profile — display name, avatar and time zone (optional).
• Your content — lists, items, notes, dates, sections and categories you create.
• Sharing — the emails of people you invite to lists and who checked off each item.
• Notifications — push notification subscriptions (if you enable them) and preferences.
• Technical data — minimal operational and security logs (e.g. errors, requests).
• Country — your country is derived from your IP address at sign-in; we keep only the country (the IP is not retained).

2. What we use the data for

• Providing the service: storing and syncing your lists across any device.
• Authenticating you by email (magic link or code), without passwords.
• Sending due-date reminders by email and push notifications (if enabled).
• Enabling sharing and collaboration on lists.
• Keeping the service secure and improving it.
• Aggregated internal statistics — usage metrics (totals, averages, countries), without identifying individual users, to monitor and improve the product.
• AI features — when you use an AI feature (generating text or lists), the text you write in that request is sent to an AI model provider solely to generate the response. These features are optional and only triggered by you.

3. Legal basis (GDPR)

We process your data to perform the contract (providing the service), on the basis of your consent (notifications) and our legitimate interest (security and product improvement).

4. Who we share with

We do not sell your data. We use trusted subprocessors only to operate the service:

• Supabase — database and authentication (hosted in the European Union).
• Vercel — application hosting.
• Resend — sending emails (access and reminders).
• Cloudflare — DNS and abuse protection.

5. Retention and deletion

We keep your data for as long as your account exists. You can delete your account at any time in Profile → Account and data; when you do, we permanently delete your data (lists, items, shares and subscriptions).

6. Your rights

You have the right to access, correct, export, restrict the processing of and delete your data. In Totil you can export your data and delete your account in Profile → Account and data. For any other request, contact suporte@totil.net. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).

7. Cookies and local storage

We use only essential storage: your sign-in session, preferences (e.g. view) and a local copy of your lists for offline use. We use anonymous usage statistics (Vercel Analytics), with no third-party tracking cookies or advertising.

8. Security

Data is transmitted over an encrypted connection (HTTPS) and access is protected by per-user rules. Even so, no system is 100% secure — use an email account you trust.

9. Changes

We may update this policy. When we do, we change the date above. Significant changes will be communicated in the product or by email.