Privacy

ToHoot is a task and time tracker that runs on your own devices and talks only to accounts you connect it to. There is no ToHoot server, no account with ToHoot, and no analytics. Nobody but you can see what you track.

What the app stores, and where

Your tasks, projects, tags and tracked time live in an event log on the device. If you turn on sync, that log is also written to a private GitHub repository that you own, under your own GitHub account. The author of ToHoot has no access to it.

Credentials the app is given (a GitHub token, a Google grant, a Cloudflare token for one deploy) are kept on the device that signed in and are never written to the log, never synced, and never sent anywhere except to the service that issued them.

Google user data

If you press Sign in with Google, ToHoot asks for one permission: to see, edit, share and delete your Google Calendar calendars, which is the scope Google offers for reading a calendar and writing to one. The app uses it for two things only:

• reading the events of the calendars you have selected in Google Calendar, so your day appears next to your tasks on the device you signed in on;
• writing the time you tracked to a separate calendar named "to-hoot log", which it creates in your account on first use. Your other calendars are read and never changed.

Calendar data is read on the device and shown to you there. It is not stored beyond a cache for the current day, not written to the sync repository, not sent to any server operated by the author, and not shared with anyone. The email address of the account you signed in with is shown in Settings so you can tell which account is connected.

ToHoot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sign out in Settings revokes the grant with Google and removes it from the device. You can also revoke it at any time under your Google Account's third-party access page, and you can delete the "to-hoot log" calendar in Google Calendar like any other calendar.

Other services you may connect

GitHub holds the sync repository. Signing in asks for repository access so the app can create and write to that one private repository; the token stays on the device.

Cloudflare can host an optional endpoint that lets an AI assistant such as Claude or ChatGPT read and write your task list. The app signs in to your own Cloudflare account, uploads the endpoint, and revokes the sign-in token immediately afterwards. The endpoint runs in your account and holds only the settings it needs to reach your repository.

AI assistants and agents (Claude, ChatGPT, Codex, Gemini CLI, Cursor, VS Code and others) reach your tasks only through an endpoint you deployed and a URL you added yourself, or through a local process on your own computer that you added to that agent's settings. ToHoot sends nothing to any of them on its own.

This site

This page makes no third-party requests and sets no cookie. Your choice of light or dark mode is kept in your browser and nowhere else.

Contact

Questions about this policy go to contact@danieltyukov.com. The source code is at github.com/danieltyukov/to-hoot, so every claim above can be checked.

Last updated 19 September 2026.