Your data, your account

A short, plain-English account of what GRC Todo does and doesn't do with your data.

Isolated by user

Each account has its own private partition in Azure Cosmos DB. Tasks, folders, contexts, attachments, and AI brief cache are scoped to your Firebase user id. No one else — not even the owner of the deployment — can read your tasks via the app's UI.

You bring your own AI key

The AI features (daily brief, triage, chat) call Anthropic with your personal API key. The key is stored only in your browser's localStorage and is sent only to the server function that proxies the call to Anthropic. The owner's deployment also has an env-var fallback key for convenience, but you can override it with your own at any time in Settings → AI.

No tracking, no analytics

No third-party scripts, no behavior pixels, no marketing cookies. No Google Analytics, no Segment, no anything. Application Insights on the Azure Functions side records standard server-level errors and request rates (no message content), used only for debugging crashes.

What's stored where

Cosmos DB: tasks, folders, contexts, AI brief/suggestion cache (per user, partitioned by uid).
Azure Blob Storage: file attachments you upload to tasks, also scoped to your uid.
Browser localStorage: your Anthropic API key (if you provided one), UI preferences (column widths, rail collapsed state), the SWR cache for fast initial paint.
Anthropic: only what you send when you trigger an AI feature — task titles, priorities, due dates, your typed constraint. They retain prompts per their own retention policy.

Account removal

Ask the deployment owner. They can delete your Cosmos partition and any blob attachments. Local browser data clears with the usual "Clear browsing data" flow.

License

The source code is licensed under the PolyForm Noncommercial 1.0.0 license. Use freely for personal, hobby, research, or nonprofit purposes. Commercial use is not permitted.