Privacy Policy

Privacy Policy for toldly

Effective date: 17 July 2026

1. Controller

The controller responsible for this app and this website is:

Tim Kolodziej Fontanestr. 6 34246 Vellmar Germany

Privacy email: E-Mail Support: E-Mail

2. Overview

toldly is a local-first organizer for moments, notes, contacts, birthdays, reminders, groups and personal organization. The app can generally be used without a user account, without sign-in, without advertising and without analytics or tracking SDKs. Optional online features such as cloud sync, backup, sign-in or groups are used only when you actively use them.

Your content stays local on your device by default. Data only leaves your device when you enable or use features that technically require processing outside the device, or when device or operating-system services are used. This particularly applies to AI features including the automatic daily briefing when AI is enabled, optional cloud features, speech recognition and visits to this website.

3. Locally stored app content

Content you create, such as moments, appointments, tasks, reminders, notes, contacts, people, companies, birthdays, groups and optional profile pictures, is stored locally on your device by default. If you enable optional cloud sync, backup or groups, selected content and account-related data may be processed through Supabase for those features.

toldly does not operate its own user-account server for this local content and does not synchronize this data with a toldly backend by default. The data remains stored until you delete it in the app, reset the local app data or uninstall the app.

4. AI Assistant

Use of the AI Assistant is optional. When you use an AI feature through text input or a voice command after conversion into text, the text to be processed is sent to a toldly Supabase Edge Function and from there to OpenRouter. OpenRouter routes the request to the model provider in use, for example OpenAI or another available AI provider.

Depending on your input, this text may contain personal data, such as names, appointments, contacts, notes or other information you enter yourself.

The purpose of the processing is to provide the assistant feature, in particular to understand your input, generate a response and execute permitted app commands.

The legal basis is Art. 6(1)(b) GDPR where the processing is necessary to provide the app feature you requested. Where required, we additionally rely on Art. 6(1)(f) GDPR, our legitimate interest in providing a functional, secure and user-friendly app.

toldly does not permanently store your AI inputs in its own user database. However, technical operational data, log data or metadata may be processed by involved service providers for provision, security, error analysis, billing or abuse prevention. Processing by OpenRouter and connected model providers is also subject to their respective terms and privacy information.

Simple commands may be recognized and processed locally on your device. In these cases, no AI request is triggered and the input does not leave your device.

4.1 Automatic AI daily briefing

When AI is enabled in Settings, toldly automatically creates a summary of today’s entries when you open the Assistant. The data needed for the briefing is sent to Supabase and then through OpenRouter to the model provider in use, for example OpenAI. This may include, in particular, titles and times of today’s moments and, where included for the summary, names and notes.

The purpose is to provide an up-to-date daily overview in the Assistant. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can disable AI, and therefore the automatic daily briefing, at any time in Settings. Withdrawal applies for the future; when AI is disabled, opening the Assistant does not request an AI daily briefing.

This processing may involve a transfer to the United States. Where required, the transfer is based on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses. Data is encrypted in transit using HTTPS.

5. Speech recognition

Voice input is optional. It uses the speech recognition functionality of the device or operating system. Depending on the device, operating system, language setting and configuration, audio may be processed locally or by services of the operating-system provider.

toldly itself does not operate its own audio server for voice input. The app receives the recognized transcript as text. You can review and edit the text before sending it. Only when you send the text will it be processed like normal text input.

6. Optional accounts, cloud sync, backup and groups

toldly provides optional online features such as sign-in, private cloud sync between devices, backup and shared group spaces. These features are not required for local basic use.

If you enable such features, account information, technical identifiers, selected moments, notes, group memberships, invitation codes, colors, completion states and metadata such as creation or modification times may be processed.

The purpose is to provide the online feature you activate, including synchronization, recovery, sharing and abuse prevention. The legal basis is Art. 6(1)(b) GDPR where processing is necessary to provide the function, and Art. 6(1)(f) GDPR for security and stability.

toldly may use Supabase as a technical provider for these functions. Google sign-in may be offered; Apple and Microsoft sign-in may follow. Identity providers process data under their own privacy notices.

7. Import and export

toldly may offer import and export features such as JSON backup, vCard, ICS, CSV or text. Exported files are created by you and stored or shared outside the app. Keep them secure because they may contain personal content.

8. App permissions

toldly only requests permissions when they are needed for a specific feature:

Microphone / speech recognition: for optional voice input.

Camera / photos: when you take or select a profile picture.

Notifications: for local reminders on your device.

Local reminders are provided without a dedicated push server.

9. Website and server log files

When you visit toldly.app, the website hosting provider processes technically necessary access data so that the website can be delivered. This may include, in particular, IP address, date and time of access, page accessed, browser type, operating system, referrer URL and technical status information.

The website hosting provider is:

TrafficPlex GmbH Project lima-city Konsul-Smidt-Str. 90 28217 Bremen Germany

The purpose of the processing is the secure and reliable provision of the website. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in operating, securing and maintaining the technical stability of the website.

toldly.app does not use analytics or tracking tools and does not use advertising cookies.

10. Closed Test Registration

If you register for the closed test of toldly, we process the data you provide in order to manage your registration, contact you regarding the closed test, organize suitable test spots, and respond to follow-up questions.

The following data may be processed in particular: email address, selected platform such as Android or iOS, language or region, optional message, time of registration, and technical metadata that may be generated when submitting the form.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by emailing E-Mail or E-Mail.

We use Supabase as a processor for the technical provision and management of registrations. We use Resend as a processor for sending internal notifications related to the closed test. Data processing agreements are in place with both providers.

Depending on the provider, data may also be processed outside the European Union or the European Economic Area. In such cases, processing is based on appropriate safeguards, in particular standard contractual clauses where required.

We generally store your data only for as long as necessary to organize and conduct the closed test. If you withdraw your consent or request deletion, we will delete your data unless statutory retention obligations prevent deletion. After completion of the closed test, we will review whether the data is still needed and delete data that is no longer required.

10.1 In-app feedback and bug reports

If you voluntarily send a bug report or feature idea in the app, we process the message type, your message, an optional contact email address and accompanying technical data such as app version, platform, language and submission time.

The message is processed through a Supabase Edge Function and sent to the toldly support inbox using Resend. We do not maintain a separate permanent feedback database for this purpose. The involved service providers may temporarily process technical logs for security, error analysis and abuse prevention.

The purpose is to handle your feedback, fix errors and improve toldly. The legal basis is Art. 6(1)(b) GDPR where your message relates to the use or provision of the app, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in support, security and product improvement. Providing a contact email address is optional.

Feedback messages are deleted when they are no longer needed for handling and traceable error resolution, generally no later than twelve months after final handling, unless legal obligations or the defense of specific legal claims require longer retention.

11. Contact by email

If you contact us by email, we process the data you provide, in particular your email address, the content of your message and technical email metadata, in order to handle your request.

The legal basis is Art. 6(1)(b) GDPR if your request relates to the use of the app or to pre-contractual or contractual matters. In other cases, the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in handling inquiries.

12. No advertising, no tracking

toldly contains no advertising, no advertising SDKs, no analytics SDKs and no tracking SDKs. toldly does not use advertising IDs, create advertising profiles or share data for advertising purposes.

13. Processors and other recipients

When using the app locally without AI or online features, your locally stored content is not transmitted to toldly servers. Depending on the feature you enable or use, the following processors and other technical recipients are involved:

Supabase, for Edge Functions, optional accounts, private sync, backups, groups and closed-test registrations.

OpenRouter, for technically routing and processing AI requests, including the daily briefing.

Connected AI model providers, in particular OpenAI and, where applicable, other providers depending on the model used.

Resend, for internal email notifications related to closed-test registrations or support processes.

Identity providers such as Google and, in the future, possibly Apple or Microsoft, if you use optional sign-in.

TrafficPlex GmbH / lima-city, for hosting and delivering the website and for technically necessary server log files.

These service providers may receive personal data only to the extent necessary to provide the respective feature.

14. International data transfers

When using AI features, data may be transferred to service providers or model providers outside the European Union or the European Economic Area, in particular to the United States.

The transfer is encrypted via HTTPS. Where required, such transfers are based on appropriate safeguards such as standard contractual clauses, adequacy decisions or comparable protection mechanisms of the involved service providers.

The website hosting provider is located in Germany.

15. Storage period and deletion

Locally stored content remains stored on your device until you delete it in the app, use the “Delete local data” function or uninstall the app.

toldly does not permanently store AI inputs in its own user database. Where technical metadata, log data or billing data is created by service providers, the respective retention periods of those service providers apply.

Website log files are stored only for as long as necessary for operation, security, error analysis or abuse prevention.

You can remove local data in the app through Settings → “Delete local data”. You can delete an optional user account and its associated cloud data in the app through Settings → Account → “Delete account”. You may also request deletion through E-Mail. Public instructions are available at https://toldly.app/account-deletion/.

We process verified requests to delete an account and its associated cloud data without undue delay, generally within 30 days. Data that must be retained for legal obligations or to prevent abuse and defend legal claims is restricted from other uses and kept only for the required period. Account deletion does not remove content stored exclusively locally on your devices.

16. Your rights

Where the GDPR applies, you have the right of access, rectification, erasure, restriction of processing, data portability and objection.

Because toldly works by default without a user account and your main data is stored locally on your device, toldly cannot centrally view, modify or delete much of your local content. Deletion of your local content takes place directly on your device through the app settings or by uninstalling the app.

You also have the right to lodge a complaint with a data protection supervisory authority.

17. No automated decision-making

toldly does not use automated decision-making within the meaning of Art. 22 GDPR and does not create user profiles for advertising or tracking purposes.

18. Children

toldly is not directed at children. The app is intended as a personal organizer for general users and does not contain content specifically directed at children.

19. Changes to this Privacy Policy

We may update this Privacy Policy if toldly, service providers used by toldly or legal requirements change. The current version is available at toldly.app/privacy. The effective date above indicates the latest update.

20. Contact

Privacy: E-Mail Support: E-Mail Legal inquiries: E-Mail Security reports: E-Mail