Privacy
Last updated 13 November 2026
todo.link lets you make a to-do list and share it with a link, with no account. This page says what the site keeps when you use it, why, and for how long. It is run by Imagine Something Inc. ("we"). Questions go to hello@imaginesomething.co.
The short version
- There are no accounts, no ads, and no analytics or tracking scripts.
- We keep what you put in a list, so that it can be shown to whoever has its link.
- We use cookies only to make the site work, such as to recognise a browser that owns a list or has been let into a locked one.
- If you buy a name for a list, we keep your email address and a record of the purchase. Your card details go to Stripe and never reach us.
- We don't sell what we keep, and we don't share it except as set out below.
What we keep, and for how long
| What | Why | How long |
|---|---|---|
| What's in a list: the todos, the names you assign them to, and when each was done | To show the list and keep it in step for everyone who has it open | Until the list is deleted. A list is deleted by itself 7 days after anyone last opened it if it has no todos, and 30 days after if it has. A list someone bought a name for is kept until we are asked to delete it. |
| A cookie holding a random code. Lists store a scrambled form of it, not the code. | To recognise the browser that bought a list's name, opened its admin link, or entered its passcode | 400 days from your last visit to a list, or until you clear it in your browser |
| The network address (IP address) your requests come from, in a scrambled form | To limit how fast one person can make lists and add todos, and how often a passcode can be guessed | 1 hour for adding todos, 1 day for making lists, and 30 days for wrong passcodes |
| If you buy a name: your email address, the name, the amount, and Stripe's reference for the payment | To email you the list's admin link and other messages about the service, and to find the purchase if you ask for help | For as long as the list exists |
| If you lock a list: the passcode, in a scrambled form that can't be read back | To check the passcode when someone enters it | Until the lock is removed or the passcode changed |
| A log of each request, kept by our host: the address asked for, the time, and technical details such as the network address and the kind of browser | To find faults and stop abuse | Up to 7 days |
| A count of how many lists are made on the site each hour | To see how much the site is used | For as long as the site runs. It is only a number: it says nothing about who made a list, or which list |
"Scrambled" means stored as a hash: a fingerprint that the original can't be read back from. It still counts as your information, and we treat it as such.
Who can see a list
Anyone who has a list's link can read and change it. That is how sharing works here. Names you assign todos to are shown to everyone who opens the list. Links are short, so treat a list as unlisted, not secret, and don't put anything in one that you wouldn't want someone with the link to see.
If the owner locks a list, only browsers that have entered its passcode can open it. List pages are marked to keep them out of search engines.
Who else is involved
- Cloudflare runs the site for us: it serves the pages, stores the lists, keeps the request log and sends our emails. It may handle your information in the United States and other countries.
- Stripe takes payment when you buy a name. It does so as the seller, under the name Link: the checkout page, the receipt and the charge on your statement come from Link. Stripe collects your payment details, billing address and email under its own privacy policy. It tells us your email address, the amount and a reference for the payment. It doesn't tell us your card number.
We don't pass what we keep to anyone else, unless the law requires us to.
Cookies
todo.link uses cookies that the site needs in order to work, such as one that recognises a browser that owns a list or has been let into a locked one. We don't use cookies for advertising or tracking. Stripe's checkout page is on Stripe's own site and sets its own cookies.
Emails
When you buy a name, we email the list's admin link to the address you gave at checkout. We may also send other emails about the service to that address, for example about your list, your purchase, or changes to todo.link. Receipts come from Link. We don't send marketing email.
Your choices
- You can delete any todo yourself. A list nobody opens is deleted by itself, as set out above.
- You can clear todo.link's cookies in your browser at any time. A browser without them no longer owns its lists.
- To have a list or your purchase details deleted sooner, or to get a copy of what we hold about you, write to hello@imaginesomething.co. Tell us the list's link, and for a purchase, write from the address you bought with.
- For what Stripe holds about a payment, you can also ask Link, at link.com.
Depending on where you live, the law may give you the right to see, correct or delete your information, to object to how it is used, and to complain to your data protection authority. We'll act on any such request whoever you are.
Where the law asks what we rely on to use your information: we use it to provide the service you asked for, and because we have a legitimate interest in keeping the site working and stopping abuse of it.
Children
todo.link isn't meant for children under 13, and we don't knowingly keep information about them.
Keeping it safe
The site is served only over an encrypted connection. Cookie codes, admin links and passcodes are stored as hashes, and wrong passcodes are limited. No system is perfectly secure, which is one more reason not to keep secrets in a list.
Changes
If what we keep or why changes, we'll change this page and the date at the top before it takes effect.
Contact
Imagine Something Inc., 3500 S Dupont Hwy, Dover, DE 19901, United States. Email: hello@imaginesomething.co.