Privacy Policy

1. Who We Are

Gallahadd Software LLC (“Gallahadd,” “we,” “us,” or “our”), based in Waxahachie, Texas, United States, operates AI Todo Plus (the “App”). For privacy and data-protection purposes, Gallahadd Software LLC is the operator and data controller of personal information processed in connection with the App, except where Apple, OpenAI, or another third party is the independent controller of data you provide directly to them (for example, Apple ID / iCloud / StoreKit, or OpenAI if you use your own API key under their terms).

Contact for privacy requests: [email protected]

2. Information We Collect

2.1 Information You Provide

• Task Data: Tasks, notes, due dates, priorities, and categories you create
• AI Prompts: Meal preferences, workout goals, natural-language inputs you submit to AI features, and food descriptions and meal photos you add in Food › Describe or Photo
• Nutrition Data: Foods you log (name, brand, amount, meal, date and time, and nutrition values), your saved foods, meals and recipes, and your optional daily nutrition goals
• Food Search Terms and Barcodes: Text you type into food search and barcodes you scan or enter
• Account / Apple context: Apple ID context used for iCloud sync (handled by Apple) and subscription status via StoreKit
• Optional API Keys: Your personal OpenAI API key and/or USDA FoodData Central (api.data.gov) key if you choose to use your own (stored in the device Keychain, never sent to Gallahadd)

2.2 Information That May Be Collected Automatically

The App may collect the following automatically to operate, secure, and improve the product:

• Usage Analytics: App usage statistics (for example, features used and session duration), which may be anonymous or aggregated. Collection may occur through Apple and/or Gallahadd’s configured analytics tooling as disclosed in App Store privacy labels and this policy.
• Device Information: iOS version, device type, and app version (as needed for support and compatibility)
• Crash Diagnostics: Technical information when the App encounters errors, which may be collected via Apple and/or Gallahadd’s configured crash/diagnostics tooling as disclosed in App Store privacy labels and this policy
• Subscription Data: Purchase history and subscription status via Apple StoreKit (Apple processes payment)

We do not invent or withhold the fact of analytics or crash collection: if your installed build and App Store privacy labels show such data types, treat this section as applying. Exact tooling may change over time; App Store privacy labels and this policy are the disclosures to rely on.

2.3 Information We Do Not Seek to Collect by Default

• Location data (unless a future feature requires it and you grant permission)
• Contact lists
• Photos or media, except a meal photo you choose or take in Food › Describe or Photo, which is sent to OpenAI only when you tap Estimate (see 4.1). Barcode and nutrition-label scanning and label text recognition run on your device, and those images are not stored or uploaded.
• Browsing history outside the App
• Health / HealthKit data from Apple Health. The App never reads data from Apple Health (see 2.4).

2.4 Apple Health (Optional, Write-Only)

If you turn on Save to Apple Health in Settings › Food and grant permission, the App writes the food you log to Apple Health as dietary energy, protein, carbohydrates, total fat, fiber, sugar, sodium and saturated fat (with the food name, time, and identifiers that let the App update or remove its own entries). The App:

• Requests write (share) permission only and never reads any Health data, including steps, heart rate, weight or data written by other apps
• Does not send Health data to Gallahadd, OpenAI, or any other third party, and does not use it for advertising or marketing
• Updates or deletes the Health entry it wrote when you edit or delete the logged food on the device that logged it

You can change or revoke this permission at any time in the Health app (Sharing › Apps) or iOS Settings › Health › Data Access & Devices, and turn off Save to Apple Health in the App. Entries already saved stay in Apple Health until you delete them there.

2.5 Calendar Sync (Optional)

Calendar Sync is off by default. If you turn it on in Settings › Calendar Sync and grant calendar access, the App writes the title, notes and due date of each open task that has a due date to a calendar named “AI Todo Plus” through iOS Calendar, so it can appear on your other devices and on wall displays that subscribe to your iCloud Calendar. The App only reads and changes events in that calendar; it does not read or change your other calendars and does not send calendar data to Gallahadd, OpenAI or any other third party. You can turn it off in the App, revoke access in iOS Settings › Privacy & Security › Calendars, and delete the “AI Todo Plus” calendar in the Calendar app.

3. How We Use Your Information

4. AI and Third-Party Services

4.1 OpenAI Integration

When you use AI features (meal planning, workout generation, natural-language processing, and Food › Describe food estimates):

• Your prompts are sent to OpenAI’s API for processing: through the AI Todo Plus AI service described below, or directly from your device if you supply your own OpenAI API key
• Food › Describe and Photo: the food description you type (for example “two eggs and toast”), or a photo of your meal with an optional note, and the meal it is for are sent to OpenAI to estimate nutrition. A meal photo is reduced in size and sent without its location or other photo details, and is not stored by Gallahadd or on the AI Todo Plus AI service. Nothing is sent unless you tap Estimate.
• Requests made through AI Todo Plus AI may be covered by OpenAI’s data-sharing program for its complimentary usage tiers, under which OpenAI may use those inputs and outputs to improve its models. Requests made with your own key follow your OpenAI account’s data controls.
• OpenAI processes requests according to their privacy policy and applicable terms
• We do not store your prompts after receiving the AI response (per current product design)
• Personal information in prompts should be minimized; avoid including unnecessary identifiers
• You may use your own OpenAI API key for greater control over billing and access under OpenAI’s terms

AI Todo Plus AI (no personal key). When you use AI features without your own OpenAI API key, the App sends each AI request you start to an AI service operated by Gallahadd on Cloudflare, Inc.’s network (Cloudflare Workers, in the United States and other Cloudflare locations), which forwards it to OpenAI and returns the answer. Cloudflare acts as our processor. This service does not store or log the content of your requests or of the answers; it keeps only what it needs to prevent abuse: an anonymous per-install key identifier created by Apple’s App Attest (it does not identify you), request and token counts per day and month, and technical logs of the model, time, status and size of each request, kept for up to 7 days. To help OpenAI detect misuse, requests carry a one-way hash of that identifier. The service asks OpenAI not to store responses; OpenAI’s own retention and data-sharing terms still apply. With your own key, requests go directly from your device to OpenAI and never pass through this service.

Apple Intelligence on your iPhone (optional). On supported iPhones you can run some AI features with Apple’s on-device model: by choosing “Try on this device” after a request fails, or by turning on Settings › “Use Apple Intelligence on this iPhone when possible”. Those requests are processed on your device and are not sent to Gallahadd or OpenAI; results are labeled “Made on device”. When Food › Describe runs on device and you are online, it may look up food names in Open Food Facts or USDA FoodData Central, as described in 4.2.

4.2 Food Databases (USDA FoodData Central and Open Food Facts)

When you search for a food or scan a barcode while online, the search text or barcode is sent to the USDA FoodData Central API (U.S. Department of Agriculture, via api.data.gov) and/or Open Food Facts to return nutrition facts. These requests include the App name and version but no account, device or personal identifiers; like any internet request, the services receive your IP address. Without your own USDA key, USDA lookups use a shared demonstration key and run only when you tap Search or scan a barcode. The built-in food database works offline without any request.

4.3 iCloud Sync

If you enable iCloud sync:

• Data is encrypted in transit and at rest by Apple under Apple’s iCloud practices
• Syncs across devices signed into the same Apple ID (your tasks and your food log are private to your Apple ID; the App has no sharing with other people)
• You can disable sync in Settings

4.4 StoreKit (Subscriptions)

• Subscription purchases are processed by Apple
• We receive transaction / entitlement information needed to unlock features
• Payment card details are never accessible to Gallahadd

5. Data Sharing and Disclosure

5.1 We Do Not:

• Sell your personal information
• Share your data with advertisers for third-party advertising (no ads claimed in current product marketing)
• Read Apple Health data, or use or disclose data written to Apple Health for advertising, marketing or data mining
• Use your task content for marketing without your consent
• Access your task content unless you explicitly share it for support

5.2 We May Share or Disclose Data:

• With your consent: When you request or approve it
• Legal requirements: If required by law or valid legal process
• Service providers: OpenAI for AI processing (prompt content as needed, including Describe food descriptions); Cloudflare, Inc. as the processor that runs the AI Todo Plus AI service (requests pass through without their content being stored); USDA FoodData Central and Open Food Facts for food lookups (search text and barcodes only); Apple and/or Gallahadd’s configured analytics and crash-diagnostics tooling for product improvement
• Apple Health: Only if you turn on Save to Apple Health, and only into your own Health data on your device
• Business transfers: In connection with a merger, acquisition, or asset transfer, with notice where required

6. Data Security

We implement reasonable technical and organizational measures appropriate to the App’s design:

• Encryption in transit: Network communications use TLS where applicable
• Local protections: Platform storage / Keychain for sensitive items such as optional API keys
• Access control: Device and Apple ID authentication as provided by Apple
• Updates: Security-related app updates as issues are identified

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Privacy Rights

You may have the right to:

• Access: Request access to personal information we hold about you
• Correction: Update or correct information
• Deletion: Delete data you control in-app and request deletion of information we hold
• Portability: Export data in available formats
• Opt-out: Disable optional analytics and AI features where offered in Settings or via device/OS controls
• Restrict processing: Limit certain processing where applicable law provides

How to Exercise Rights:

• In-App: Settings → Privacy / Manage Data (paths may vary by version; use options as offered in Settings)
• Export: Settings → Backup / Export (if available in your version)
• Delete: Settings → Delete / erase local and synced data as offered
• Contact: [email protected]

For data stored only in your iCloud account or processed solely by Apple or OpenAI, those parties’ tools and policies also apply.

8. Subscription and Payment Privacy

Subscription tiers described in the App Store listing and in-app purchase screens control access to AI limits and other paid features. Prices and entitlements may change; the App Store listing controls current offers.

Trial: If a free trial is offered, Apple handles billing after the trial per your Apple ID settings. Cancel anytime through Apple to avoid charges after the trial.

9. Children’s Privacy

AI Todo Plus is not directed at children under 13. The Terms of Service require users to be at least 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact [email protected] and we will take appropriate steps.

10. International Data Transfers

Your data may be processed in:

• Your device / region: Local storage
• Apple’s systems: Based on your Apple ID / iCloud region
• OpenAI: Typically United States (for AI features), subject to OpenAI’s practices
• Cloudflare (AI Todo Plus AI service): United States and other Cloudflare network locations (AI requests in transit; usage counts and technical logs)
• USDA FoodData Central / Open Food Facts: United States / France (food lookups only)
• Gallahadd: Support email and configured analytics/crash tooling may be processed in the United States (Waxahachie, Texas base)

Where required, appropriate safeguards for international transfers are a matter of the applicable provider’s terms and applicable law.

11. California Privacy Rights (CCPA / CPRA)

California residents may have additional rights, including rights to know, delete, and correct certain personal information, and to non-discrimination for exercising rights. We do not sell personal information as “sale” is commonly understood under CCPA. To submit a request: [email protected].

12. European / UK Privacy Rights (GDPR / UK GDPR)

For individuals in the EU/EEA/UK where those laws apply:

• Legal bases: May include performance of a contract (providing the App), consent (optional features), and legitimate interests (security, product improvement including analytics/crash diagnostics) where appropriate
• Data Controller: Gallahadd Software LLC
• Data Retention: Until you delete data / stop using the App, or as needed for legal obligations
• Complaints: You may lodge a complaint with your local supervisory authority

Contact the controller at [email protected].

13. Data Retention

14. Changes to This Policy

We may update this privacy policy to reflect product or legal changes. We will post the updated date on this page and, for material changes, may provide in-app notice. Continued use after the effective date means you acknowledge the updated policy.

15. Contact Us

For privacy-related questions or requests:

• Email: [email protected]
• Privacy: https://gallahadd.com/legal/ai-todo-plus/privacy
• Terms: https://gallahadd.com/legal/ai-todo-plus/terms
• Support: https://gallahadd.com/legal/ai-todo-plus/support
• Entity: Gallahadd Software LLC

Privacy contact (no separate DPO appointed unless required):
Gallahadd Software LLC
Waxahachie, Texas, United States
[email protected]

This privacy policy is a publish-ready working copy for Gallahadd Software LLC / AI Todo Plus. It is not legal advice and does not guarantee regulatory “coverage.” Effective as of the Last Updated date above.

© 2026 Gallahadd Software LLC. All rights reserved.