Privacy Policy for GXB Todos

Last updated October 8, 2026

This policy tells you what personal information GXB collects when you use GXB Todos at https://todo.gxb.vc, why we collect it, who receives it, and what you can ask us to do with it.

Who we are

GXB, LLC ("GXB", "we", "us") is a Delaware limited liability company based in Dallas, Texas. We build and run GXB Todos.

What we collect

When you sign in

  • You sign in with your GXB account at auth.gxb.vc. We receive your email address, your name and an account ID. We do not receive your password.
  • Each time you sign in, we save your IP address and your browser type with that sign-in, so that we can keep you signed in. When you sign out, we delete that record.

What you create in the app

  • The areas, projects and to-dos you make: titles, descriptions, deadlines, priorities and the questions on a to-do.
  • Your answers to those questions, your comments, and the email addresses of the people you invite.
  • A history of each change: who made it and when. When someone edits a title, a description or the questions on a to-do, we keep the old text. The history does not keep answers.
  • Your email alert settings. For an API key, we keep its name and a one-way digest, not the key. For a webhook, we keep the web address you give us, an encrypted signing secret and a list of recent deliveries.

Files and recordings

  • Files you attach, voice memos, and screen recordings with the sound from your microphone. They are stored in a private storage bucket. Only people who can see the to-do can open them, through a link that checks access and expires after one hour or less.

Technical data

  • When you open a page, our server records your IP address and the page you opened, with the time. Our logs leave out email addresses, passwords, tokens and answers. GXB Todos does not send page views to an analytics system.

Cookies

  • We use one cookie: a session cookie that keeps you signed in. We do not use advertising cookies or tracking cookies. Your browser also stores your light or dark mode choice and which projects you opened. While you record your screen, your browser keeps the parts of the recording until our server has them.

Why we use it

  • To sign you in and keep your account secure.
  • To show you only the information you have access to.
  • To run the features of GXB Todos: give a to-do to a person, collect their answers, email them about new to-dos, changes and invites, and send webhook messages that you set up.
  • To check that a new to-do is clear before someone gets it.
  • To find and fix errors.
  • To meet our legal duties.

Who we share it with

We do not sell your personal information. We do not share it for advertising.

Other people in the app see what you add to a shared space. The people on a project see its to-dos, answers, files and comments. The person who asked for a to-do and the person who does it can always see it. When someone removes you from a project, you lose access to it at once. Only the person who asked for a to-do can read an answer to a password question. The app administrator at GXB can open any to-do to give support and keep the app working.

We use these service providers. They process data only to provide their service to us.

  • DigitalOcean hosts the app, the database backups and the files, in New York.
  • Mailgun sends the app's emails, from todo@gxb.vc.
  • AI model providers: TypeSafe, Deepgram, AssemblyAI and Anthropic. See "AI processing" below for what goes to each.
  • Analytics: GXB Todos does not use an analytics system. We do not use ad pixels, session replay, or outside analytics companies.
  • Code libraries: pages load some JavaScript libraries from jsDelivr and JSPM. These hosts receive your IP address when they send the file.
  • Other GXB services: auth.gxb.vc signs you in. avatars.gxb.vc shows profile photos and receives your email address to find yours. scribe.gxb.vc makes the transcript of a screen recording.
  • Webhooks you set up: we send a short, signed message to the web address you choose when a to-do changes. It has the to-do number, title, status, project, link and the name of the person who made the change. It never has descriptions, answers, comment text, file names or email addresses.

We can also share information when the law requires it, or to protect the rights and safety of GXB and the people who use the app. If GXB merges with or is sold to another company, the information can move to that company, and this policy continues to apply to it.

AI processing

GXB Todos sends:

  • the title, the description and the names and choices of the questions of a new or edited to-do to TypeSafe, to check that the to-do is clear. It never sends answers, comments, files, passwords or names of people.
  • the sound from your microphone to Deepgram while you record a voice answer, to turn your speech into text. Your browser sends it to Deepgram directly.
  • the sound of a screen recording to scribe.gxb.vc, our transcript service. Scribe sends it to AssemblyAI to make the transcript and can send the transcript to Anthropic to make a title or a summary.

We do not use your information to train AI models.

How long we keep it

  • Your account and what you create: while the app is in use for your project. Ask us and we will delete it, unless the law requires us to keep it.
  • Files and voice memos: until the to-do they belong to is deleted.
  • Screen recordings: deleted after 180 days, or after the time the person who asked for the to-do set on the question. The transcript in scribe.gxb.vc follows the rules of that service.
  • Webhook delivery records: 14 days.
  • Backups: copies of deleted data can stay in backups for a short time before the backups are replaced. Before a large update, we also keep a copy of the database on our server until we remove it.

Security

We use encrypted connections (HTTPS), sign-in through one central account system, access rules that limit each person to their own projects, private file storage, and continuous database backups. Answers and webhook secrets are encrypted when we store them. API keys and invite links are stored only as one-way digests. No system is fully secure. If you find a security problem, email christian@gxb.vc.

Your choices and rights

You can turn email alerts on or off in Settings. Invites and notices that a to-do is blocked or unblocked always go.

You can ask us to:

  • tell you what personal information we have about you, and send you a copy;
  • correct information that is wrong;
  • delete your information.

Send your request to christian@gxb.vc from the email address you use in the app. We reply within 45 days. We may need to confirm who you are before we act. We do not treat you differently because you made a request.

California and Texas residents have these rights under state law. You can also name an agent to make a request for you. If we refuse a request, you can appeal by replying to our answer. We will reply to the appeal within 60 days.

Children

GXB Todos is not for children. We do not knowingly collect information from anyone under 13. If you think a child gave us information, email christian@gxb.vc and we will delete it.

Changes to this policy

If we change this policy, we will change the "Last updated" date at the top. If the change is large, we will also tell signed-in users in the app or by email.

Contact

Email christian@gxb.vc.