Todoist

Doist's privacy policy states user information is processed by employees and service providers in the US, on infrastructure spanning AWS, Microsoft Azure, and Google Cloud. Transfers from the EEA and UK rely on Standard Contractual Clauses rather than EU-only data residency.

Todoist's security page states that data in transit is protected with TLS 1.2 and 1.3, and that projects, tasks, comments, account information, and payment details are encrypted at rest. There is no mention of end-to-end encryption anywhere in the security or privacy documentation, so Todoist itself can access task content in plain form.

Doist's privacy policy states it does not sell personal data but lists "analytical and advertising cookies" as a distinct category "used for analytics purposes and advertising," alongside Google Analytics for user base segmentation. Independent static analysis of the mobile app by Counterspy found three third-party trackers, including a Firebase/AdMob SDK the report describes as built "to record how you use the app and serve ads." No CCPA-style breakdown of what is shared with ad networks is published, but the company's own language and this independent SDK audit both describe an advertising use, not a purely aggregated analytics one.

Todoist Assist, the product's AI layer, is opt-in rather than active by default. Most features run only when a user chooses to engage them. Doist states its AI infrastructure is "designed to keep your information safe and private from third parties by design" and that the third-party model providers it uses have committed that the processed data will not be used to train their models.

Todoist is closed source. Doist publishes some peripheral developer tools as open source, such as its Python and TypeScript API SDKs. The core Todoist application that stores and serves user data is not published anywhere.

Todoist announced SOC 2 Type II compliance in a help center update, directing users to its Trust Center for the underlying report, subprocessor list, and further compliance documentation. This is a current, named certification with public documentation, inside the three-year recency window.

Todoist is closed source with no published governance model, maintainer structure, or community decision-making process for the core product.

Todoist Pro is billed as an annual subscription by default, with a lower monthly rate than the standalone monthly option, and includes a permanently free Beginner tier. Business plans follow the same annual-first structure at a higher per-user rate.

The free Beginner tier is capped at 5 personal projects, 3 filter views, and 1 week of activity history, alongside core task creation and reminders. It does not monetize user data to offset the cost, but the project cap makes it a limited free plan for anyone managing more than a handful of areas.

Todoist's help center documents a clear self-service cancellation flow and a 30-day money-back guarantee on annual Pro and Business purchases. Monthly plans remain active until the end of the current billing period after cancellation, with no retention flow or hidden cancellation path found.

Todoist applies localized pricing in eight named countries, including Brazil, India, Turkey, and South Africa. Doist describes this as a gradual rollout rather than a complete or permanently documented policy. Users in some regions have reported the removal of prior regional discounts, effectively doubling their subscription cost.

Todoist's official per-project CSV export excludes completed tasks, and the account-wide Backups feature only covers active projects, maintaining a rolling window of 21 snapshots rather than a permanent archive. A complete export, including completed tasks, comments, and attachments, requires pulling data from the API through unofficial third-party tools rather than a single vendor-provided archive.

Todoist has no self-hosting option. It is a fully cloud-dependent SaaS product. All data storage, sync, and processing run on Doist-operated infrastructure.

Todoist requires being logged in before a device goes offline; once connected, task creation and edits work without a live connection and sync automatically on reconnection. Todoist's own help documentation warns that closing the app before an offline session finishes syncing can cause data loss, so offline use depends on a prior connection and a completed reconnection sync rather than working independently of the network.

Todoist ships official clients for Web, Windows, macOS, Linux, iOS, and Android, including an actively maintained Linux desktop build — an open, non-proprietary platform, not a browser-only fallback.

Todoist documents an extensive set of keyboard shortcuts across its web and desktop apps, a real accessibility-adjacent feature. However, no dedicated accessibility statement, VPAT, or WCAG conformance claim was found published anywhere on Doist's sites.

Doist has never taken venture capital or outside investment since founding Todoist in 2007. Its own about page states directly that the company has "no exit strategy" and will not be "selling out or getting acquired," and will instead run as a bootstrapped, founder-led, remote-first company.

Doist remains founder-owned, with no acquisitions, mergers, or outside investment rounds in its history, let alone in the past three years. Wikipedia's account of the company's history corroborates this independently, noting Todoist was built in 2007 "without any formal funding" and recording no acquisition or investment round since. The company's own materials describe permanence rather than an exit as the explicit goal.

Doist's terms of service include a standard prohibited-conduct clause covering harassment and abusive content, and its AI Assist page states a specific no-training commitment for user data. There is no standalone public ethics policy, responsible-AI framework, or advertising-limits statement beyond these scattered, partial commitments.

No public information, sustainability report, or infrastructure commitment regarding environmental impact was found on Doist's sites. The company frames "sustainability" only in terms of a durable, profitable business, not in terms of carbon or hosting footprints.

Todoist launched in 2007 and has been continuously developed and maintained for 19 years, including through Doist's ongoing independent ownership.

Todoist publishes a weekly changelog, crediting named team members for specific fixes and features, alongside a large, long-running user base and ongoing public release activity into 2026.