PRIVACY POLICY

Effective Date: May 15, 2026 Last Updated: July 20, 2026

Electric Lantern LLC ("we," "us," or "our") operates To Do Machine (the "Service"), an AI-powered to-do list application. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service, you agree to the practices described here.

1. WHO THIS POLICY APPLIES TO

The Service is currently offered to users located in the United States. If you access the Service from outside the U.S., please be aware that your information will be transferred to, stored, and processed in the United States.

2. INFORMATION WE COLLECT

We collect the following categories of information:

Account Information. When you create an account, we collect your email address and any password or authentication credentials you provide.

To-Do Content. The tasks, lists, notes, due dates, and other content you create, upload, or store in the Service.

Generated AI Outputs. When the Service generates app configurations for you using AI, we store only the resulting outputs so you can access, edit, and re-use them.

Chat Conversations. Your conversations with the AI assistant are stored on our servers so you can revisit them, continue them later, and access them from any of your devices. You control this history: you can delete individual conversations, clear your entire history, or set an auto-delete policy at any time (see Sections 6 and 8).

App Configuration Data. Settings, preferences, integrations you enable, and other configuration data tied to your account.

Usage Analytics. Information about how you interact with the Service, including features used, buttons clicked, session duration, error logs, crash reports, and approximate timestamps. We use this data to understand how the Service is performing and to improve it. Our analytics do not include the content of your chat conversations; for AI requests we capture only technical metadata such as token counts, latency, and the model used.

Technical Information. IP address, browser or device type, operating system, and similar technical identifiers automatically collected when you use the Service.

We do not intentionally collect precise geolocation data, biometric data, or sensitive personal information.

3. HOW WE USE YOUR INFORMATION

We use the information described above to:

• Provide, operate, and maintain the Service;
• Process your to-do items and generate AI-powered content on your behalf;
• Authenticate your account and prevent unauthorized access;
• Improve the Service, debug issues, and develop new features;
• Communicate with you about your account, updates, and support requests;
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your to-do content or generated code to train our own AI models.

4. AI PROCESSING AND THIRD-PARTY AI PROVIDERS

To deliver AI features, we send certain user content to Anthropic, PBC, which processes your data on our behalf using its Claude API. Anthropic is currently our only third-party AI provider.

The user content we send to Anthropic to power AI features consists of: task titles and notes, project and section names, due dates, your assistant context, and the chat conversation history. We do not send your email address, password, or other account credentials to Anthropic as part of normal AI processing.

On our iOS and macOS apps, we ask for your explicit consent before the assistant sends any chat message to Anthropic; you can revoke this consent at any time in Settings → AI Assistant. On the web app, sending a message to the assistant directs us to process it as described in this section.

Anthropic's commercial API terms state that prompts and completions submitted through the API are not used to train Anthropic's models. Under Anthropic's current commercial terms, API inputs and outputs are retained for up to 30 days for trust and safety purposes, after which they are deleted (longer retention may apply in limited cases, such as where required by law or to investigate a confirmed policy violation).

For more information about how Anthropic handles data, please review:

• Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy
• Anthropic Commercial Terms of Service: https://www.anthropic.com/legal/commercial-terms

If we add, remove, or change AI providers in a way that materially affects how your data is handled, we will update this policy.

5. HOW WE SHARE INFORMATION

We share personal information only in the following circumstances:

Service Providers. We share information with vendors who help us operate the Service, under contracts that limit their use of your information. Our current sub-processors include:

• Anthropic, PBC — AI processing for assistant and generation features (see Section 4).
• Fly.io — application hosting and compute.
• Neon — managed Postgres database hosting.
• Additional vendors for authentication, analytics, and customer support tooling.

Legal Requirements. We may disclose information if required by law, subpoena, court order, or other legal process, or to protect the rights, safety, or property of Electric Lantern LLC, our users, or others.

Business Transfers. If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

With Your Consent. We may share information with other parties when you direct us to do so.

We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising.

6. DATA RETENTION

We retain your account information, to-do content, generated content, and configuration data for as long as your account is active. If you delete your account, we will delete or de-identify your personal information within 30 days, except where we are required to retain it for legal, accounting, or security reasons (for example, fraud prevention or tax records).

Usage analytics and aggregated data may be retained in de-identified form for longer periods.

Chat conversations with the AI assistant are stored on our servers so that your chat history is available across your devices. We retain your chat history until you delete it: you can delete individual conversations or clear your entire chat history at any time in the app, and you can optionally set an auto-delete policy that automatically removes conversations older than a period you choose. Deleting your account deletes your stored chat history as described above. Anthropic retains API request data for up to 30 days for abuse monitoring under their commercial terms, after which it is deleted.

7. DATA SECURITY

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption in transit, access controls, and regular security review. However, no system is completely secure, and we cannot guarantee absolute security.

8. YOUR CHOICES AND RIGHTS

You can:

• Access, update, or delete your account information through the Service's settings;
• Export your to-do content and generated code;
• Delete your AI chat history at any time — remove individual conversations or clear your entire history in the app, or set an auto-delete policy to remove conversations automatically after a period you choose;
• Close your account at any time, which will trigger deletion as described in Section 6;
• Opt out of non-essential analytics where offered in the Service settings;
• Revoke AI consent at any time in Settings → AI Assistant, which will stop new chat messages from being sent to Anthropic;
• Contact us at support@todomachine.com with questions or requests about your information.

NOTICE TO CALIFORNIA RESIDENTS

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share;
• Request access to and a copy of your personal information;
• Request deletion of your personal information;
• Request correction of inaccurate personal information;
• Limit the use of sensitive personal information (note: we do not currently use sensitive personal information for purposes that would trigger this right);
• Not be discriminated against for exercising these rights.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these rights, contact us at support@todomachine.com. We may need to verify your identity before responding.

NOTICE TO OTHER STATE RESIDENTS

Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, and others as applicable) may have similar rights to access, delete, correct, and obtain a copy of their personal information. To exercise these rights, contact us at support@todomachine.com.

9. CHILDREN'S PRIVACY

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us with personal information, please contact us at support@todomachine.com.

10. THIRD-PARTY LINKS AND INTEGRATIONS

The Service may link to or integrate with third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any information.

11. GOOGLE WORKSPACE API DATA

The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service before the changes take effect. The "Last Updated" date at the top reflects the most recent version.

13. CONTACT US

If you have any questions or concerns about this Privacy Policy or our data practices, contact us at:

Electric Lantern LLC 418 Broadway, STE N Albany, NY 12207 USA Email: support@todomachine.com