What this policy covers
This policy explains how One More (Android package com.firefly.mytaskstodo), its web app, desktop builds, and Telegram Mini App handle information. One More is a task and project manager. The app does not require an account for local use.
Information stored on your device
One More stores the task and project information you create, including titles, descriptions, dates, priorities, completion state, project and backlog relationships, and app settings. The local database and exported data files use encryption for basic protection on the device. The app does not send this local data to us unless you choose a feature that transmits it.
Optional cloud sync and backups
If you create or join a cloud space, One More sends the data needed to sync your selected tasks and projects between paired devices. The service may store:
- Task, project, backlog, and change records, including the content you entered.
- Workspace identifiers, record identifiers, versions, timestamps, device names, and device token hashes.
- Hashed recovery keys and one-time pairing-code hashes.
- Encrypted backup snapshots when you use cloud backup.
- Rate-limit and security records, which can include an IP address and request time.
Cloud records and snapshots are encrypted at rest with AES-256-GCM. This is server-side encryption, not end-to-end encryption: the PHP service can decrypt synced records to validate changes and provide sync. Use cloud sync only for information you are comfortable sending to the service.
Payments and subscriptions
Android Pro subscriptions are processed by Google Play. Google handles payment details such as card information. One More receives and sends to its service the Google Play purchase token and product information needed to verify entitlement, and may store the token, workspace, product, order identifier, subscription state, and expiry timestamps. The current Android product is com.firefly.mytaskstodo.pro.monthly.
If you use the Telegram Mini App, Telegram processes Telegram Stars payments. One More receives authenticated payment and Telegram account identifiers from Telegram so it can verify the payment and apply access to the selected cloud space. See Telegram’s privacy policy for Telegram’s own processing.
Advertising on Android
Free Android use can show a Google Mobile Ads banner and an interstitial ad when you move between app pages. Ads are requested only after the Google consent flow allows them. Google and its advertising partners may process device or advertising identifiers, IP address, approximate location derived from network information, ad interactions, and diagnostics for ad delivery, measurement, fraud prevention, and frequency capping. One More does not send your task titles or descriptions to AdMob for ad targeting.
You can change available advertising privacy choices from the app’s Settings screen. Learn more in Google’s Privacy Policy and Google Mobile Ads privacy documentation.
How information is used and shared
One More uses information to provide local task management, sync and recovery that you request, cloud backup, subscription verification, security and rate limiting, customer support, and service maintenance. We do not sell your task or project content. Information is shared with providers only when needed for the feature you use, including hosting and database providers, Google Play, Google Mobile Ads, and Telegram. Providers may process information in other countries.
One More does not request contacts, microphone, camera, precise location, health data, or access to files outside the data you choose to import or export. You can still choose to type sensitive information into a task; avoid adding information you do not want stored on your device or in optional cloud sync.
Retention and deletion
Local data remains until you delete it, reset the app, remove the browser profile, or uninstall the app. Cloud data and backups remain while the cloud space and its records are needed to provide the service, subject to operational and legal retention. Disconnecting a device stops that device’s sync access but does not by itself delete the cloud space.
You may request deletion of a cloud workspace and associated records by contacting the developer through the One More support page. Do not include task content, recovery words, purchase tokens, or other private information in a public issue. We may ask for information needed to verify the request and may retain limited records where required for security, fraud prevention, payments, or law.
Children
One More is a general-purpose productivity app and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact us through the support page so we can review and remove it where appropriate.
Security
Connections to the cloud service use HTTPS. Device tokens and recovery credentials are stored as hashes, and synced records and cloud snapshots are encrypted at rest. No method of storage or transmission is completely secure, so protect your devices, recovery words, and exported files.
Changes to this policy
We may update this policy when the app or its data practices change. The effective date at the top will change with each revision. Continuing to use a feature after an update means the updated policy applies to that feature.
Contact
For privacy questions or deletion requests, use the One More support page on GitHub. Please do not post personal information or task content in a public issue.