Your data,
on your terms.

Controller and contact

MAROSCH UG (haftungsbeschränkt), Ulmenstr. 42, 22299 Hamburg, Germany, represented by Dr. Ronny Schüritz, is responsible for the processing described below. Contact: next@marosch-labs.com. This notice covers Next for Todoist and its product/support pages.

Todoist connection and local app data

Next connects directly to Todoist. It reads your account profile, tasks, projects and labels to display your queue, and sends task changes you request to Todoist. This includes task contents, identifiers, dates, priorities and assignments. OAuth connection credentials are stored in the device Keychain. Cached tasks and queued offline changes are stored locally; the widget receives a local snapshot through the shared app container. Next does not operate a backend that receives your Todoist credentials or task database.

Files you share to Next are kept on your device until Next has attached them in Todoist.

The purpose is to provide the app features you request (Article 6(1)(b) GDPR, where applicable). Todoist operates its own service and processes the data you send to it under its privacy policy: https://www.todoist.com/privacy . Next does not delete your Todoist account or its tasks when you disconnect.

Optional My iCloud Sync

When you enable My iCloud Sync, Next sends its own account-specific queue state to your iCloud account through Apple's key-value storage. This includes Running, Snooze and Not before state, hidden-task identifiers, For today picks, saved filter-group names and project identifiers, and revision/device markers needed to reconcile changes. These records do not include task titles or Todoist credentials. Group names you enter can themselves contain personal information.

Sync provides a feature you explicitly request (Article 6(1)(b) GDPR, where applicable). Apple's service is subject to https://www.apple.com/legal/privacy/ . Disabling sync or uninstalling Next does not automatically erase an existing iCloud copy.

Optional AI Agent Access

AI access is off by default. When you enable it on Mac, a client you configure can read your task contents through a local connection while Next runs. Read-and-write access also permits supported task changes. The chosen client can transmit these contents to its AI provider. Its provider, processing locations and retention depend on your chosen client and settings; a local connection does not make AI processing local. Enable access only for a trusted client and review its privacy information first. This feature provides the access you request (Article 6(1)(b) GDPR, where applicable).

Next Plus purchases

Apple handles Next Plus purchases, subscriptions, payments and restores through the App Store. Next uses Apple-verified purchase status on your device to enable Plus features. A local access-status record is shared with the widget through the app container and refreshed from Apple. We do not operate a purchase-verification server or receive your payment-card details.

This processing provides the purchase and features you request (Article 6(1)(b) GDPR, where applicable). Apple processes App Store account and transaction data under its own privacy information: Apple Privacy Policy.

Local retention and disconnect

Cached tasks support offline use and remain on your device while needed by the app. Disconnect removes the device's Todoist connection credentials and cached Todoist data, clears the displayed task/widget data, and detaches iCloud and AI access from that account. Next's own account state, queued changes, AI access preference and existing optional iCloud state remain for reconnection. Their retention follows your use and management of the app, rather than a publisher-controlled server period. Support cannot access or erase these local/iCloud records remotely. Revoke Next authorization under Todoist Settings → Integrations to prevent future Todoist access.

Support messages

Emailing support provides your email address, message, attachments and mail delivery metadata. The app's mail actions also prefill app version, build, operating-system version and device model; you can edit these before sending. Task contents and credentials are not automatically attached. These data let us answer your question and investigate problems.

The legal basis is Article 6(1)(b) GDPR for requests about providing the app and Article 6(1)(f) for other correspondence, with the legitimate interest of responding to inquiries and improving reliability. Support mail is hosted in Google Workspace and read/managed through Spark Mail, provided by Spark Mail Limited, Dublin, Ireland. Spark processes email contents, attachments and mail-related metadata to provide its features. Depending on the feature, this happens on the device or in Spark systems. Spark describes temporary storage of recent emails for four hours; shared emails, scheduled messages and other feature data can remain longer under its feature-specific rules. This is separate from retention of the underlying Google mailbox. Provider information: https://sparkmailapp.com/legal/privacy-app .

We retain support correspondence while needed to resolve your request and related follow-up, and longer only where a legal obligation or the establishment, exercise or defence of legal claims requires it.

Website hosting

The Next pages are hosted by Vercel, Inc. Delivery and protection of the website require processing connection/request data such as IP address, requested URL, request time, browser/client information and security signals. The purpose is to deliver the pages, maintain availability and detect misuse; the legal basis is Article 6(1)(f) GDPR, with the legitimate interest of operating a secure, reliable website.

The Next pages use local fonts/assets and include no publisher-added tracking scripts, advertising, analytics, forms or nonessential cookies. Vercel may process request and security logs to operate and protect its service. For information covered by its own Privacy Notice, Vercel describes retention according to legal and contractual obligations, service development, disputes, enforcement of rights and legitimate business needs. It describes deletion or anonymisation when an ongoing need ends, with secure storage where deletion is not possible, such as backups. These are provider retention criteria; they are not a fixed retention period for every website or security log. See Vercel Privacy Notice.

Recipients and international processing

Vercel, Google Workspace and Spark Mail process hosting/email data as described above, and may use subprocessors and systems outside the EEA, including in the United States. Google Workspace's accepted Cloud Data Processing Addendum and Spark's applicable data-processing terms provide transfer safeguards, including standard contractual clauses where applicable. Spark describes processing on EEA and US servers. Vercel describes its own processing, international transfers and safeguards in its Privacy Notice, including standard contractual clauses or other appropriate mechanisms where legally required. This does not mean that all processing stays in the EEA. Information about applicable safeguards can be requested from us.

Provider information: https://vercel.com/legal/privacy-notice ; Google Workspace Cloud Data Processing Addendum ; https://sparkmailapp.com/legal/data-processing-agreement . Copies/information about applicable safeguards can be requested from the controller.

Your rights

Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability. Where processing relies on legitimate interests, you can object for reasons relating to your particular situation. Where processing relies on consent, you can withdraw that consent for the future. Contact next@marosch-labs.com. You can complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information: https://datenschutz-hamburg.de/service-information/beschwerde-oder-hinweis-einreichen .

Providing support-message data is voluntary, but without a return address or sufficient problem details we may be unable to answer. Website connection data are necessary to deliver the pages. We do not use these processing activities for automated decisions producing legal or similarly significant effects. Requests concerning the independent services of Todoist, Apple or a selected AI provider should also be directed to the relevant provider.