Privacy policy
Last updated 21 October 2026
In short
- We keep what you put in Tickosh, so it's on all your devices.
- Your tasks, lists, notes and settings, and the account details you sign in with.
- We don't sell it, show you ads, or track you.
- There are no analytics or advertising tools in Tickosh, and your tasks are never used to train AI.
- A few services help run Tickosh.
- Each gets only what its job needs. They're all listed below.
- You can take your data with you, and have it deleted.
- Download your calendar from Settings, or email us for everything.
- Google Calendar data, once you can connect it, is only used to show and sync your calendar.
- As Google's Limited Use rules require.
Who looks after your data
Tickosh is run by Ordinal Works, based in Singapore. Ordinal Works decides how your data is used and is responsible for it; in this policy, "we" means Ordinal Works. Our data protection officer can be reached at privacy@tickosh.com.
This policy covers the Tickosh app and this website. The website itself sets no cookies and keeps nothing about your visit, apart from the request logs described below.
What Tickosh keeps
Your account
- Your name and email address.
- Your password, stored only as a one-way hash (Argon2id), so no one can read it back.
- If you use them: your passkeys (the public half only), and your two-step sign-in secret and backup codes, stored encrypted.
- A photo, if you add one. The app redraws it on your device first, as a small square picture, which leaves behind any location or camera details in the original.
What you put in Tickosh
Tasks, events, lists, folders, tags, notes, dates, repeats, reminders, saved filters, the names of calendar files you import, and your settings, such as your time zone, quiet hours and how Tickosh looks.
Your devices and security
- For each device you're signed in on: its IP address and the name of its browser, so you can see your devices in Settings and sign them out.
- A security log of sign-ins and changes to your password, passkeys and two-step sign-in, with the IP address each came from.
- If you turn on alerts: the address your browser's push service gives Tickosh, so alerts can reach that device.
- Short-lived counters of requests per IP address, which stop people guessing passwords.
When something breaks
An error report: what went wrong, where in the app, the browser and its version, and your account's id. Reports leave out cookies, what you type, request contents and your IP address.
What Tickosh doesn't collect
Your location, your contacts, advertising identifiers, or analytics about how you use the app.
What it's used for
- Running Tickosh for you: keeping your data in sync across your devices, sending the reminders you set, and sending the emails you ask for, such as confirming your address or the morning overview. This is what our agreement with you, the terms of use, needs.
- Keeping accounts safe: limiting sign-in attempts, keeping the security log, and checking new passwords against known breaches. This is in your interest and ours.
- Fixing problems: error reports tell us when something breaks, so we can fix it.
We don't sell your data, use it for advertising, build a profile of you, or use your tasks to train AI. We don't send marketing emails. We read your data only if you ask us to, for example to help with a problem, or if the law requires it.
Services that help run Tickosh
These services handle data for us, under their own data processing terms, and only for the job described. Your tasks and account are stored in Singapore.
| Service | What for | What it gets | Where |
|---|---|---|---|
| Google Cloud | Servers, the database, backups and request logs | Everything kept in Tickosh | Singapore; request logs in Google's global logging |
| Postmark | Sending email | Your name, email address and the email itself | United States |
| Cloudflare | The "are you a person" check on sign-up and password reset | Your IP address and browser details during the check | Worldwide |
| Sentry | Error reports | The report described above | European Union (Germany) |
| Have I Been Pwned | Checking a new password hasn't leaked elsewhere | The first 5 characters of a hash of the password, never the password, and not enough to work it out | Worldwide |
| Your browser's push service (Apple, Google, Mozilla or Microsoft) | Delivering alerts to your device | An encrypted alert it can't read, and when it was sent | Chosen by your browser |
An alert shows the task's name and time on your lock screen, and the morning overview email names your first few tasks. Turn on "Hide task names" in Settings and both say only how many things there are.
Each of these providers offers terms that cover moving data between countries, including the standard contractual clauses used for data from Europe.
Google user data
Tickosh can't connect to Google accounts yet. When you can connect Google Calendar, this is how its data will be handled:
- Tickosh will read and change events only in the calendars you choose, to show them in Tickosh and keep both sides in sync.
- The keys Google gives Tickosh will be stored encrypted.
- Your Google data won't be used for advertising, sold, or used to train AI, and no person will read it unless you ask us to, it's needed for security, or the law requires it.
- You'll be able to disconnect at any time, from Tickosh or from your Google account, and Tickosh will then delete what it holds from Google.
Tickosh's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and your device
Tickosh uses only the cookies it needs to sign you in:
- a sign-in cookie, which lasts 30 days and renews while you use Tickosh;
- two short ones while you sign in with a passkey or a two-step code, which last 5 and 10 minutes;
- a cookie that skips the two-step code on one device for 30 days, only if you tick "Don't ask again on this device".
There are no tracking or advertising cookies, so there's no cookie banner.
So that Tickosh works without a connection, your device keeps a copy of your data, along with your preferences and recent searches. Signing out deletes that copy and your recent searches; preferences such as the theme stay. The copy is protected by your device's own lock, not by Tickosh, so keep your device locked.
How long things are kept
| What | How long |
|---|---|
| What you put in Tickosh | Until you delete it. The trash empties itself after 30 days. |
| Your account | Until you ask us to delete it; we do so within 30 days of the request. |
| Backups | Up to 30 days. Anything deleted is gone from them within 30 days. |
| A signed-in device | Until you sign it out, or 30 days after it was last used. |
| The security log | 1 year |
| Records of alerts already sent | 30 days |
| Emails | Deleted from our queue once sent. Postmark keeps its own copy for up to 45 days. |
| Request logs | 30 days |
| Error reports | Up to 90 days |
After something is deleted for good, a note that it existed (its id and nothing else) is kept for 120 days, so your other devices learn that it's gone.
Keeping it safe
- Every connection to Tickosh is encrypted.
- The database sits on a private network with no public address, and Google encrypts it and its backups at rest.
- Passwords are hashed with Argon2id. You can add passkeys and two-step sign-in, and see and sign out your devices in Settings.
- Alerts are encrypted on the way to your device, so the push service can't read them.
If a breach affects your data, we'll tell you without undue delay, and tell the authorities where the law requires.
Your rights
Wherever you live, you can ask us for a copy of your data, to correct it, to delete it, or to stop using it for something. Depending on where you live, laws such as the GDPR or Singapore's PDPA give you these rights formally, and the right to complain to your data protection authority.
- A copy: Settings, Calendar files, downloads your events and dated tasks. For everything, email privacy@tickosh.com and we'll send it within 30 days.
- Correcting: change anything in the app, or ask us.
- Deleting: delete items in the app. Account deletion is coming to Settings; until then, email privacy@tickosh.com from your account's address.
We'll answer within 30 days, and won't charge for it.
Children
Tickosh isn't for children under 13. If you think a child under 13 has an account, tell us and we'll delete it.
Changes to this policy
If we change this policy in a way that matters, we'll email you at least 30 days before. The date at the top always shows the latest version.
Contact
Email privacy@tickosh.com with any question about your data. For security problems, email security@tickosh.com.