Privacy Policy
Version 2026-07-27
· Applies to the ittto closed beta
Plain-language summary. We do not sell your data, run ads, or use analytics or trackers. Your vault secrets are encrypted in your browser and we cannot read them. The rest of the app — tasks, notes, budgets — is stored in readable form in our database, so technically we could read it, though we do not. You can export everything or delete it whenever you want. This summary does not replace the text below.
1. Data controller
José Ricardo Lizano Monge, national ID (cédula) 1-1290-0291, domiciled in Costa Rica, is the controller of personal data collected through ittto.app.
Privacy contact: privacidad@ittto.app
2. Scope
This Policy describes what personal data we process, for what purpose, on what legal basis, who we share it with, and what rights you have. It applies to the public site (/about/, /beta/) and to the authenticated application.
3. What data we process
3.1 Account data
Username, email address, first and last name (optional), and the hash of your login password. We never store your login password in readable form.
3.2 Content you create in the app
This content is stored in readable form in our database and is technically accessible to personnel with infrastructure access:
| Module | Data stored |
|---|---|
| Tasks | Title, notes, priority, due date, status, project, category, timestamps |
| Notes | Title, full Markdown body, tags, category, timestamps |
| Budget | Name and period, opening balance, country and currency, and per line: description, amount, amount paid, payment date, status |
| Categories | Name and colour |
| Drive | Module currently non-functional. No files are stored. |
Important. Notes and budgets are not end-to-end encrypted. If you need to store particularly sensitive information — health data, legal matters, professional secrets — bear that in mind when deciding what to write in those modules.
3.3 Password vault
The vault uses client-side encryption (AES-256-GCM with a key derived via PBKDF2-SHA256, 600,000 iterations). The distinction matters, so we state it precisely:
| Data | How it is stored |
|---|---|
| Username, password, URL, card number, CVV, command, query, entry notes | Encrypted in your browser. The server only ever receives and stores ciphertext. We cannot decrypt it. |
| Entry name | Readable. Stored unencrypted so the list can be displayed without decrypting it. |
| Entry type, category, expiry date, creation and modification timestamps | Readable. |
| Cryptographic salt, key check value and iteration count | Readable. They do not allow deriving your master password. |
Put bluntly: we cannot see your passwords, but we can see that you have an entry called "Banco Nacional". Your master password is never transmitted to the server and cannot be recovered by us.
3.4 Technical and security data
- Login attempts (via django-axes): username, IP address, browser user agent and timestamp. Recorded to detect and block brute-force attacks.
- Legal acceptance record: timestamp, IP address, user agent, language and accepted document versions. This is the evidence of your consent.
- Server logs: generated by our infrastructure provider; may include IP, requested path and timestamp.
- Email verification: the verified address, the verification timestamp and the hash of the confirmation token — never the token itself.
- Second factor (2FA), only if you enable it: the TOTP secret shared with your authenticator app and the hashes of your recovery codes. The readable codes are displayed once and never stored.
- Session: session identifier stored in a cookie.
3.5 Beta waitlist
If you sign up at /beta/: email address, pay cycle and current budgeting tool (both optional), language, IP address, timestamp, and the version of this Policy at the moment of your consent.
3.6 Data we do NOT process
We use no web analytics, tracking pixels, advertising cookies, device fingerprinting or ad networks. We do not profile users. We make no automated decisions producing legal effects concerning you. We do not use your content to train artificial-intelligence models.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service and storing your content | Performance of the contract (the Terms of Service) |
| Authenticating you and protecting accounts against brute force | Legitimate interest in the security of the Service |
| Sending payment reminders you configured yourself | Performance of the contract |
| Notifying you of security incidents or changes to the legal documents | Legal obligation and legitimate interest |
| Contacting you to invite you to the beta | Consent (withdrawable at any time) |
| Retaining evidence of your acceptance of the legal documents | Legal obligation (demonstrating consent) |
5. Emails we send
We send: (a) reminders of upcoming payments, only if you set a payment date in your budget; (b) essential service communications (security, legal changes, end of beta); and (c) if you are on the waitlist, your invitation.
We do not send commercial newsletters or third-party promotions. You can turn off reminders by removing payment dates from your budgets. Service communications cannot be turned off while you hold an active account, because they are necessary for us to meet our obligations.
6. Who we share data with
We do not sell or rent personal data. We share it only with the following processors, to the extent necessary to operate the Service:
| Provider | Function | Data received | Location |
|---|---|---|---|
| Railway | Application hosting and PostgreSQL database | All stored data | United States |
| Configured SMTP provider | Transactional email delivery | Your email address and the message content | Provider-dependent |
| Cloudflare (R2) | File storage | None at present — the Drive module is not operational | — |
| Google Fonts, jsDelivr, unpkg, cdn.tailwindcss.com | Delivery of fonts and interface libraries | Your IP address and browser data, when the page loads | Global network |
About vault icons. Vault entries show a locally generated initial, not the real site icon. We could fetch that icon from an external service, but doing so would reveal the domain of every credential you store — precisely the metadata the encryption is meant to protect. Your browser makes no third-party requests when you open the vault.
We may also disclose data if a competent authority requires it through a valid order. In that case we could only hand over what we actually hold: your encrypted vault content is undecryptable by us and therefore useless in response to such a request. Unless legally prohibited, we would notify you.
7. International transfers
Our infrastructure is hosted in the United States. If you reside in Costa Rica, the European Union, Brazil or another jurisdiction, your data is transferred and processed outside your country. These transfers rely on your informed consent and on the contractual clauses agreed with our providers.
8. Cookies and local storage
We use no advertising or analytics cookies, which is why we show no cookie consent banner. We use only:
| Name | Type | Function | Duration |
|---|---|---|---|
sessionid | Cookie | Keeping you signed in | 2 days |
csrftoken | Cookie | Cross-site request forgery protection | 1 year |
django_language | Cookie | Remembering your chosen language | 1 year |
ittto-theme | localStorage | Remembering the light/dark theme | Until you clear it |
ittto-vault | IndexedDB | Holding the unlocked vault key for the session. Never sent to the server. | Until the tab closes or the vault locks |
9. Data retention
- Content and account: for as long as the account is active. On deletion, removed immediately from the active database.
- Backups: backup copies rotate within a maximum of 30 days. Deleted data may persist in backups until then, after which it is permanently gone.
- Login attempt logs: up to 90 days.
- Legal acceptance records: kept while the account exists and for up to 4 years after its deletion, as proof of consent against potential claims.
- Waitlist: until you ask to be removed, or up to 24 months after signup, whichever comes first.
10. Security
We apply, among others: encryption in transit (HTTPS with HSTS), client-side encryption for vault secrets, password storage using resistant hashing algorithms, optional two-factor authentication (TOTP), brute-force lockout after 10 failed attempts, a Content Security Policy with no external image origins, strict per-user data isolation at the query level, and encryption of SMTP credentials at rest.
We recommend turning on two-factor authentication under Settings → Security, especially if you use the vault: without it, your login password is the only thing between an attacker and your account.
No measure is infallible. If we detect a security breach posing a risk to your rights, we will notify you without undue delay by email and, where applicable, the competent supervisory authority within the applicable legal deadlines.
If you find a vulnerability, write to security@ittto.app. We will not pursue legal action against anyone researching in good faith and disclosing responsibly.
11. Your rights
You may exercise at any time the rights of access, rectification, erasure, portability, objection, restriction of processing and withdrawal of consent.
Two of them are automated and need no request: under Settings → Privacy & data you can export all your data in machine-readable JSON and delete your account immediately and irreversibly.
For the rest, write to privacidad@ittto.app. We will respond within the applicable legal deadlines — at the latest within 5 business days under Costa Rica's Law 8968, or 30 calendar days if the European GDPR or the Brazilian LGPD applies to you. We may ask you to verify your identity before acting on the request.
If you believe we did not handle your request properly, you may lodge a complaint with the competent supervisory authority: PRODHAB in Costa Rica, your national data protection authority in the European Union, or the ANPD in Brazil.
12. Minors
The Service is not directed at people under 18 and we do not knowingly collect their data. If we detect an account belonging to a minor without the authorization of their legal guardian, we will delete it.
13. Changes to this Policy
We may update this Policy. Each version is identified by the date shown at the top. For material changes we will notify you by email and/or require your in-app acceptance before you continue using the Service.
14. Contact
Privacy and exercise of rights: privacidad@ittto.app
Security: security@ittto.app
General: hola@ittto.app