Sinabro (the “Company”, “we”) publishes this Privacy Policy to explain how personal information is handled when you use the SimplyTodo application for iOS, macOS, and Android (the “App”). It applies to every user of the App.
1. Overview and Who Is Responsible
Sinabro, an individual developer based in the Republic of Korea, is the controller of any personal information processed through the App. Contact details are in Section 14.
The App keeps a single to-do list. It has no sign-up, login, or account: the Company does not collect your name, email address, phone number, or any other information that identifies you, unless you choose to email the Company (Section 14). Your tasks stay on your device and are never sent anywhere. The App’s only network activity is the purchase check described in Section 5, which goes to RevenueCat, Apple, and Google, and, on iOS and macOS, the check for a newer version described in Section 10, which goes to Apple.
This Policy is published in English and Korean. For users residing in the Republic of Korea the Korean version prevails; for all other users the English version prevails.
2. Information We Process, Purposes, Legal Basis, and Retention
The table below lists every category of information the App handles. “Legal basis” refers to the ground under the EU/UK GDPR where it applies; under the Korean Personal Information Protection Act the same processing is necessary to provide the service you requested.
| Information | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your tasks: the text you enter, when each was created, and when it was completed | Keep and show your list | Performance of the service you requested (GDPR Art. 6(1)(b)) | Until you delete a task or uninstall the App. A completed task is removed automatically once the day you completed it has ended, in your device’s local time |
| The theme you have chosen | Apply your preference | Performance of the service | Until you choose another theme or uninstall |
| The App version you last answered in the update prompt | Avoid showing the prompt again for the same version (Section 10) | Legitimate interest in keeping the App current (GDPR Art. 6(1)(f)) | On your device only, until you uninstall |
| Which paid themes you own, as reported by the purchase service | Unlock the themes you bought and restore them on a new device | Performance of the purchase contract | Held in memory while the App runs; the purchase SDK keeps its own cached copy on your device until you uninstall |
| An anonymous identifier generated by RevenueCat, your theme purchase and restore history, and basic request details (App and OS version, store country or region, connection IP address) | Verify and restore purchases (Section 5) | Performance of the purchase contract | Under RevenueCat’s policy; purchase records also stay with the App Store or Google Play under their policies |
| Emails you send to the Company: your email address, your message, and any attachment | Answer your inquiry | Steps you asked for (GDPR Art. 6(1)(b)) and legitimate interest in supporting the App (Art. 6(1)(f)) | 3 years after your inquiry is resolved, so that a repeat problem or a dispute can be handled; then deleted |
Where the table says “uninstall”: on a Mac, deleting the App can leave its data folder behind; Section 8 explains how to remove it.
The Company does not process sensitive information, location, contacts, or any government identifier. Your tasks are never sent to RevenueCat, to Apple, to Google, or to the Company.
3. Where Your Data Is Stored and Backups
Your tasks, the chosen theme, and the App version you last answered in the update prompt are stored in the App’s local storage on your device, on iOS, macOS, and Android. On a Mac, that storage is the App’s own sandboxed folder in your Library. The App does not sync your list to iCloud or to any other cloud service, so each device keeps its own list (a list on your iPhone does not appear on your Mac), and the Company operates no server.
If your device backup is turned on (iOS: iCloud Backup or a computer backup; macOS: Time Machine or another backup of your Mac; Android: the system backup kept under your Google Account), a copy of the App’s local data may be included in that backup. Backups are controlled by your operating system and your own account, not by the Company. For how Apple and Google handle backups, see the Apple Privacy Policy and the Google Privacy Policy.
4. App Permissions
On iOS and macOS, the App asks for no permissions at all: it does not access your location, camera, photos, contacts, calendar, or microphone, and it does not ask to track you. On a Mac, the App runs inside the system’s App Sandbox, where the only capability it is granted is making outgoing network connections, used for the purchase check (Section 5) and the update check (Section 10); it has no access to the files in your home folder outside its own folder and accepts no incoming connections.
On Android, the App uses only permissions that are granted automatically at install and never prompt you:
| Permission | Required or optional | Purpose |
|---|---|---|
| Internet and network state | Granted automatically at install | Verify and restore theme purchases through RevenueCat |
| Google Play billing | Granted automatically at install | Buy themes through Google Play |
The App does not request notification permission and does not send notifications (Section 10).
5. Theme Purchases (RevenueCat)
The System, Light, and Dark themes are free. The other themes are optional one-time purchases, not subscriptions. Payment is handled entirely by the App Store (Apple) on iOS and macOS and Google Play (Google) on Android; the Company never receives your payment details.
To know which themes you own, the App uses RevenueCat, a purchase-management service operated by RevenueCat, Inc. on the Company’s behalf. Each time you open the App or return to it, the App asks RevenueCat which themes you own, even if you have never bought anything. The request carries a random anonymous identifier generated by RevenueCat, which is not linked to your name, email address, or any account, and the information RevenueCat processes is limited to what is needed to verify purchases:
- the anonymous identifier
- your theme purchase and restore history, as reported by the App Store or Google Play
- basic technical details of the request: App and operating-system version, store country or region, and the IP address of the connection
Your tasks are never included. If the purchase service cannot be reached, the App keeps showing the theme you already use and does not take a purchased theme away. “Restore Purchases” at the bottom of the theme screen re-applies purchases made with the same store account. Refunds and purchase management follow each store’s policies; see the Apple Privacy Policy, the Google Privacy Policy, and the RevenueCat Privacy Policy.
6. Third-Party Disclosure and Processors
The Company does not sell, rent, or disclose your tasks or any other personal information to anyone.
Processors that act on the Company’s behalf:
| Processor | Country | Task entrusted | Information handled |
|---|---|---|---|
| RevenueCat, Inc. | United States | Verify purchases, look up which themes you own, and restore purchases | The anonymous identifier, purchase and restore history, and request details listed in Section 5 |
| Kakao Corp. (Daum Mail) | Republic of Korea | Run the Company’s support mailbox | Emails you send to the Company: your email address, your message, and any attachment |
Platform providers that process information for their own services, under their own terms and privacy policies:
| Provider | Country | Service | Information handled |
|---|---|---|---|
| Apple Inc. | United States | App Store payment and purchase history (iOS and macOS); the App Store version lookup (iOS and macOS, Section 10) | Your Apple Account and payment details, which the App never sees; for the version lookup, the App’s bundle identifier, your region code, and the IP address of the request |
| Google LLC | United States | Google Play payment and purchase history (Android); the Google Play update check (Android, Section 10) | Your Google Account and payment details, which the App never sees; for the update check, the App’s package name, passed to the Google Play Store app on your device |
Device backups, where you have turned them on, are handled by your operating system: under your own Apple or Google account, or, for a Mac backup such as Time Machine, on the backup disk you chose.
7. International Transfers
Emails you send to the Company are kept by Kakao, a company in the Republic of Korea, and the Company does not transfer them abroad. RevenueCat, Apple, and Google are located in the United States, so the information below leaves the Republic of Korea (and, for users elsewhere, your own country) when the App communicates with them.
| Recipient | Country | When and how | Information transferred | Purpose | Retention | Basis | How to refuse and what happens |
|---|---|---|---|---|---|---|---|
| RevenueCat, Inc. | United States | Over the network each time you open or return to the App, and when you buy or restore | Anonymous identifier, purchase and restore history, request details (Section 5) | Purchase verification and restoration | RevenueCat’s policy | Processing entrusted to a processor to perform the purchase contract | Cannot be refused separately; the App needs it to unlock paid themes. Using the App offline sends nothing |
| Apple Inc. (App Store) | United States | When you buy or restore on iOS or macOS | Purchase transaction, managed by Apple | Payment | Apple’s policy | Performance of the purchase contract | Do not purchase |
| Apple Inc. (App Store version lookup) | United States | At most once a day, over the network, when you open or return to the App on iOS or macOS | The App’s bundle identifier, your region code, and, as with any connection, your IP address; no user data | Show a notice when a newer version is available | Apple’s policy | Legitimate interest in keeping the App current | Cannot be turned off separately; using the App offline sends nothing |
| Google LLC (Google Play) | United States | When you buy or restore on Android | Purchase transaction, managed by Google | Payment | Google’s policy | Performance of the purchase contract | Do not purchase |
For users in the European Economic Area and the United Kingdom, these transfers rely on the safeguards each provider publishes, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses; see the Apple Privacy Policy, the Google Privacy Policy, and the RevenueCat Privacy Policy.
8. Deleting Your Data
- Tasks: swipe a task to delete it; on a Mac you can also Control-click (right-click) a task and choose Delete. Completed tasks disappear on their own once their day has ended.
- All data: the App has no separate “delete everything” control; on iOS and Android, uninstalling the App deletes all of its local data on your device. On a Mac, deleting the App can leave its data behind in the App’s own folder; to remove the data as well, delete the folder ~/Library/Containers/sinabro.simplytodo (in Finder: Go → Go to Folder).
- Backups: a copy included in a device backup (iCloud Backup, a computer backup, a Mac backup such as Time Machine, or Android’s system backup) is governed by your backup settings and may come back if you restore that backup; manage or delete backups in your device or account settings.
- Purchase records: records held by RevenueCat are linked only to the anonymous identifier. To have them deleted, write to the contact in Section 14; the Company may ask for an App Store or Google Play receipt to identify the purchase. Your purchase history with the App Store or Google Play is managed under Apple’s or Google’s policies.
- Emails you sent: deleted from the support mailbox 3 years after your inquiry is resolved. To have them deleted sooner, write to the contact in Section 14.
Apart from emails you have sent, the Company holds no copy of your tasks, so there is nothing further for the Company to delete.
9. Your Rights and How to Exercise Them
You have the right to access, correct, delete, and restrict the processing of your personal information, to receive a copy in a portable format, to object to processing, and to withdraw any consent you have given, with effect for the future. Where you act on behalf of a child, the child’s legal representative may exercise these rights.
Because your tasks exist only on your device, you exercise these rights directly in the App and in your device settings. For purchase records held by RevenueCat, or anything else that requires the Company, write to the contact in Section 14; we answer within 10 days.
You have the right to lodge a complaint with a supervisory authority: in the European Economic Area and the United Kingdom, the data protection authority of your country; in the Republic of Korea, the bodies listed in Section 14.
The Company does not sell personal information. The App does not use browser cookies and does not respond to browser “Do Not Track” signals, because it does not track you across websites.
10. Analytics, Tracking, Notifications, and Update Check
The App shows no advertising and embeds no analytics, advertising, or crash-reporting SDK. It does not track you across other companies’ apps or websites and does not collect any advertising identifier (IDFA or Advertising ID). The only third-party SDKs are the purchase SDK described in Section 5 and, on Android, Google’s Play In-App Updates library, used for the update check below. No usage statistics reach the Company. If you have enabled your operating system’s diagnostic sharing (iOS: Settings → Privacy & Security → Analytics & Improvements; macOS: System Settings → Privacy & Security → Analytics & Improvements; Android: usage and diagnostics), Apple or Google may deliver anonymous, aggregated crash reports to the Company; they contain no personal information.
To tell you when a newer version is available, the App checks at most once a day, when you open it or return to it. On iOS and macOS it asks Apple’s public App Store lookup service; the request contains only the App’s bundle identifier and your device’s region code (on a Mac, also a fixed marker saying the question is about Mac software), and, as with any internet connection, Apple sees the IP address of the request. On Android it asks the Google Play Store app on your device through Google’s Play In-App Updates library, and the App makes no network request of its own for this. No tasks, settings, or device identifiers are sent. If a newer version exists, the App shows a notice once for that version, and “Update” opens the App’s store page; a version you have answered is not raised again, and a failed check shows nothing.
The App does not send device notifications and does not ask for notification permission; the update notice above appears only inside the App.
11. Security Measures
The Company collects the minimum information necessary and keeps none of your tasks on infrastructure it operates. On your device, your data is protected by the operating system’s storage protection and device encryption; on a Mac, by the App Sandbox, which keeps other sandboxed apps out of the App’s folder, and by disk encryption where your Mac provides it or you have turned on FileVault. Purchase and update-check traffic is encrypted in transit and handled on infrastructure covered by the security programs of RevenueCat, Apple, and Google. The support mailbox is protected by Kakao’s account security, and only the Company has access to it.
12. Children
The App is not directed at children, and the Company does not knowingly collect personal information from children under 14, or under the age at which your country requires parental consent (for example 13 in the United States and up to 16 in the European Economic Area). If you believe a child has used the App in a way that involved personal information, contact us (Section 14) and we will help remove it.
13. Changes to This Policy
When this Policy changes, the Company publishes the revised version at this address with a new “Last updated” date and the date it takes effect, and records the change below so the old and new versions can be compared. The Company holds no email address for you unless you have written to it, and therefore does not notify you individually.
- September 30, 2026: added the update check (Apple’s App Store lookup on iOS, the Google Play update check on Android); Sections 1, 2, 3, 6, 7, 10 and 11 changed accordingly.
- September 30, 2026: added the Mac (macOS) version of the App; the introduction and Sections 1, 2, 3, 4, 5, 6, 7, 8, 10 and 11 changed accordingly.
- October 9, 2026: support mail now goes to support@sinabroapps.com, a mailbox run by Kakao (Daum Mail) in the Republic of Korea; added the emails you send to the Company, their 3-year retention, and Kakao as a processor. Sections 1, 2, 6, 7, 8, 11 and 13 changed accordingly.
14. Privacy Contact and Complaints
Questions about this Policy, requests to exercise your rights, and privacy complaints are handled by:
- Privacy protection and complaints: Sinabro Privacy Team
- Email: support@sinabroapps.com
If you are in the Republic of Korea and your issue is not resolved, you may also contact:
- Personal Information Infringement Report Center (KISA): 118 (no area code), privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, kopico.go.kr
- Supreme Prosecutors’ Office cybercrime: 1301, spo.go.kr
- National Police Agency cybercrime: 182, ecrm.police.go.kr
This Policy takes effect on October 9, 2026.