Today Loop
Privacy Policy
Today Loop is built to be calm, helpful, and respectful of your privacy. This policy explains, in plain language, what happens to your data.
Short version: Your tasks stay on your device. We do not run user accounts and we do not sell your data. You choose how AI runs in Settings: On-device only (nothing leaves your device), Full privacy (on-device plus Apple's Private Cloud Compute, which does not retain your data — on Free only as a limited fallback; Pro unlocks fuller Apple cloud AI), or Hybrid AI (also uses our proxy to third-party models). With Hybrid AI, individual request text — plus, for list suggestions, a short list of typical words per list computed on your device — is sent through our proxy to generate a result and is not kept on our servers; we only retain pseudonymous usage counters to enforce fair-use limits.
What we collect
- Your content (tasks, notes, summaries, reminders, recurring templates). Stored locally on your device using Apple's on-device database. We do not store task content on our servers.
- No account. Today Loop has no sign-up and no login, so we do not collect your name, email, or a user profile. For Hybrid AI, the server may use a pseudonymous identifier (a hash derived from your App Store subscription / app transaction id) — not your email or name — to verify Pro status and enforce limits.
- Subscription verification (Hybrid AI). When Hybrid AI is enabled, the app may send a signed App Store transaction to our proxy so we can confirm an active subscription. We verify it and may cache Pro status briefly; we do not store payment details (Apple does).
- Usage counters (Hybrid AI). After proxy AI calls we store only numeric counters (tokens / ops) keyed by the pseudonymous id, to enforce fair-use limits.
- App integrity (Hybrid AI, when enabled). We may use Apple App Attest key identifiers and attestations to help ensure requests come from genuine app builds. This is not an advertising identifier and does not include your location or device name.
- Diagnostics. We send anonymous usage signals (for example that you finished onboarding or opened the app again) to TelemetryDeck, a privacy-focused analytics service in the EU. Signals do not include task titles, notes, amounts, or any identifier you typed. TelemetryDeck assigns a random install id; this is not an advertising id and is not used to track you across apps. You can turn analytics off in Settings → Privacy. Proxy logs (Hybrid AI only) contain metadata only (latency, status, token counts) — never task text. We do not run advertising SDKs.
AI processing modes
You choose how AI runs in Settings → Privacy. Whatever the mode, secret lists / secret tasks are never sent off your device, and on-device AI is always used when it can handle the request in the content's language.
On-device only
All AI ("Structure with AI", summaries, tags, challenge plans) runs on your device using Apple Intelligence. Your text never leaves the device. When your device or the content's language is not supported on-device, unsupported AI features are simply hidden or replaced by non-AI (algorithmic) results.
Full privacy (on-device + Apple Private Cloud Compute)
Adds Apple Private Cloud Compute (PCC) on supported devices. On Free, PCC is used only as a limited fallback when on-device AI cannot serve a request (for example unsupported content language). Pro unlocks fuller Apple cloud AI for Pro features such as challenge planning. PCC runs Apple-operated models inside Apple's privacy-preserving cloud: requests are processed to return a result and are not stored or used to train models, and no third party is involved. This is the default mode for new installs.
Hybrid AI (adds our proxy)
Hybrid AI is Pro-only and opt-in: you enable it in Settings and accept a one-time consent before the first request. It adds our own proxy to third-party models on top of the above (for top-quality models and broader language coverage). You can switch back to another mode anytime.
What is sent (Hybrid AI): Only the minimal text for that single request (for example a note to structure, day-summary facts, or a challenge goal) — never your full history.
List summaries (Hybrid AI, list suggestions only): When the app suggests which list a task belongs in, it also sends a short summary of your lists, computed on your device: for each list, up to twelve single words that are typical of it (for example "kitchen, repair, plumber"), most typical first. This is derived data rather than your content — it contains no sentences, no counts and no task text, and a word cannot be traced back to the task it came from. It is used only to pick a better list, is not kept on our servers, and is never sent in the other AI modes. Secret lists and secret tasks are excluded.
How it is processed (Hybrid AI): Requests go through our Cloudflare Worker proxy. By default the model is served via OpenRouter, which routes to an underlying model provider (currently OpenAI GPT-5.6 Luna). If OpenRouter is unavailable or out of credit, we may use DeepSeek directly. Providers process the request to return a result; we do not keep the request text on our servers.
Image generation (Hybrid AI, Pro): If you choose to generate a motivational cover or milestone artwork for a challenge, the challenge description you wrote (for example "train for a triathlon") is sent through the same proxy to a third-party image-generation provider to create the picture. Only that text is sent — never your photos, contacts, or identity — and we do not keep it on our servers. Images are generated only when you ask (never automatically) and the result is stored locally on your device.
Subscriptions
Purchases are handled by Apple via the App Store (StoreKit). We do not see your payment details. Apple shares with us only whether a valid subscription is active, so we can unlock Pro features. Manage or cancel anytime in your Apple account settings. Hybrid AI requires a recurring subscription (monthly or annual); we do not offer a lifetime unlock for Hybrid AI.
Notifications
Reminders are scheduled locally on your device. Granting notification permission is optional and does not affect core features.
Camera
When you tap Scan receipt, Today Loop uses the device camera to capture a receipt. Text recognition runs on your device. The photo stays on the device as a task attachment and is never uploaded. You can decline the camera prompt and still pick a photo from Photo Library.
Data sharing
We do not sell, rent, or trade your data. We do not share it with advertisers. Third parties involved are Apple (App Store, on-device AI, Private Cloud Compute, App Attest); TelemetryDeck (anonymous usage signals, unless you turn analytics off); and, only if you opt into Hybrid AI, our proxy host (Cloudflare) and AI providers (DeepSeek and, when used, OpenRouter / underlying models) for that single request — and, only when you generate challenge artwork, a third-party image-generation provider that receives the challenge description for that request. Apple Private Cloud Compute (used in Full privacy and Hybrid AI) is operated by Apple and does not involve any other third party.
Your control
- Delete any task, summary, or template at any time inside the app.
- Delete the app to remove all locally stored data from your device.
- Decline notifications, AI, or the camera — the app still works. Without the camera you can still pick a receipt from the photo library.
- Choose On-device only in Settings to keep everything on your device, or a non-Hybrid mode to stop sending request text to our proxy.
- Turn off Anonymous analytics in Settings → Privacy to stop sending usage signals to TelemetryDeck.
Children
Today Loop is not directed at children under 13 and does not knowingly collect their data.
Changes
If this policy changes, we will update the date above and post the new version here.
Contact
Questions about privacy? Email us at [email protected].