Todo Buttons

GDPR

Last updated: 27 October 2026

This page gives a practical overview of how Todo Buttons handles personal data under the General Data Protection Regulation (GDPR). It complements the Privacy Policy.

1. Our approach to processing

Bright Brain Games Studio d.o.o. processes personal data transparently, limited to a specific purpose, and to the smallest extent needed. We do not sell data, build hidden profiles, or run unapproved advertising.

2. Legal bases

We rely on performance of a contract to create your account and provide the service; on legitimate interest to offer shared lists, keep the service secure, and prevent abuse; on your consent for preferences such as language; and on legal obligation where the law requires us to retain certain data.

3. Categories of data

We process your account data (email and optional name), your content (lists and todos), sharing data (invite emails and roles), preferences (language and invitation settings), and, for Google sign-in, your profile photo URL. We do not request special categories of data and ask that you do not send them.

4. Your rights under the GDPR

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to lodge a complaint with a supervisory authority

5. How to exercise your rights

You can access, correct, export, and erase your data directly in the app. For anything else, email privacy@brightbraingames.com. We may ask for reasonable confirmation of your identity, and will respond within the legal time limit.

6. International transfers

Some technical providers — including Google Firebase (storage and authentication) and Namecheap (hosting) — may process data outside your country under their own safeguards. We use them only for functions the app requires.

7. Processors

Our processors are Google (Firebase Authentication, Realtime Database and, for persistent Google connections where enabled, Cloud Functions, Secret Manager and Cloud KMS) and Namecheap (hosting). We use no analytics or advertising processors. Google Calendar events are fetched directly for read-only display in browser memory or a device snapshot (on by default; it can be turned off in settings), never stored on our servers. Legacy connections keep access tokens locally. Persistent connections keep encrypted credentials and connection details on the server, linked to your Todo Buttons account. Signing out clears local access; Disconnect or account deletion removes saved credentials and attempts Google revocation. You can also revoke permission in Google Account settings. See Privacy Policy section 8 for retention and export details.