Privacy policy

Last updated October 9, 2026

Yarukoto is a todo app that talks to a server you run yourself. The short version: the apps send your data to that server and nowhere else, and the developer of Yarukoto never receives it.

Yarukoto is made by Justin Wyne, an individual developer. For anything about privacy or your data, email yarukoto@justinwyne.com.

What the apps send, and where

To work, the apps send this to the Yarukoto server address you enter, and only there:

• Your content: tasks, notes, subtasks, tags, due dates, reminders, lists, folders and saved filters.
• Account details: the names of the people in your household, their account IDs, and a name and sign-in token for each signed-in device.

That data is used only to sync your tasks and run your household. It isn't used for advertising, analytics or profiling, and it isn't sold or shared. The server is run by you or by someone in your household, so whoever operates it controls the data on it and is responsible for it. A copy is also kept on your device so the app works offline.

The developer receives none of this data. The iPhone, Android, Mac and web apps contain no analytics, advertising, crash reporting or tracking of any kind, and they don't send data to third parties.

If you choose Explore with sample data, nothing is sent anywhere: the sample tasks live on your device and are discarded when the app reloads.

How your data is protected

• In transit. The Android app connects to servers over HTTPS only. The iPhone and Mac apps also use HTTPS, and allow plain HTTP only to a server on your local network, such as one at home. The documentation recommends HTTPS for any server reachable from the internet.
• Sign-in. Each device gets its own token, approved from a device that is already signed in. The server stores only a hash of each device's token, and any device can be signed out from Settings.
• Who sees what. Private lists and your Inbox are visible only to you. Shared lists are visible to your household.

Device permissions

• Camera. Used only to scan a sign-in QR code shown by another of your devices. Camera images are read on the device and never stored or sent.
• Notifications. Task reminders are scheduled on your device. Yarukoto doesn't use push notifications, so no notification token is collected.
• Local network. Used to reach a Yarukoto server running on your home network.

Deleting your data

Signing out of a device or deleting the app removes its local copy. To delete your account, open Settings → Account and choose Delete my account. That permanently erases your account, your devices' sign-ins, your private lists and Inbox, every task you added to a shared list, lists you shared unless someone else's tasks are in them, and your own folders and filters. If you run the server, your account is the server's own: Settings → Account → Erase all data erases everything on it, including its backups. If you no longer have the app, ask the person who runs your household's Yarukoto server: your data lives only there, so they are the one who can erase it, and we hold nothing to delete. Because the data lives on your own server, its operator can delete any of it at any time, and backups the server already made keep a copy until they are rotated out.

This website

yarukotoapp.com is a static page hosted on GitHub Pages. It sets no cookies, uses no analytics and loads no third-party fonts or scripts. GitHub may log visitors' IP addresses for security, as described in GitHub's privacy statement.

Changes and contact

If this policy changes, the new version will be posted here with a new date. Questions go to yarukoto@justinwyne.com, or as an issue on GitHub.