Privacy Policy

Last Updated: September 20, 2026

Introduction

This Privacy Policy explains how Outstanding Today handles personal information in connection with the Services available at https://outstanding.today, https://app.outstanding.today, related subdomains, and the Outstanding Today applications for Android and iPhone.

Outstanding Today is a task manager. You sign in with a Google account, and the epics, goals and work items you create are stored under your own user identifier and are readable only by you.

For convenience, we use the term "personal information" to mean information that identifies you or can reasonably be linked to you. "Your Content" means the epics, goals, work items, titles, descriptions, labels, locations, due dates, reminder times and settings you create in the Services.

This Privacy Policy is incorporated by reference into the Outstanding Today Terms of Use at https://outstanding.today/terms and should be read together with it. If you do not agree with this Privacy Policy, please do not use the Services.

1. Scope and Roles

This Policy applies to:

The marketing website at https://outstanding.today.
The web application at https://app.outstanding.today.
The Outstanding Today applications for Android and iPhone.

Outstanding Today is the controller of the personal information described in this Policy.

The Services do not include server-side code that we operate ourselves. Authentication and storage are provided by Google Firebase, which acts as our processor. Section 7 describes this.

2. Information We Collect

2.1. Information You Provide Directly

Account information. You sign in with Google. We receive from Google the identifier for your account, your email address, your display name and your profile picture where you have one. We do not receive your Google password and we cannot read anything else in your Google account.

Your Content. The epics, goals and work items you create, including their titles, descriptions, labels, locations, effort values, device values, due dates, reminder times, statuses and timestamps, and the list of locations and the default reminder time you configure in settings.

Correspondence. If you contact us, we receive the message you send and the address you send it from.

2.2. Information We Generate

Derived counts. The number of completed work items per goal, the number of active goals and ready work items per epic, and the date each goal and epic was last reviewed. These are computed from Your Content.

Plan information. Whether your account is on the Free or the Pro plan.

Invitation records. If you create an account by following another user's invite link, we store one record naming that user as the person who invited you and the time the record was created. If you invite others, we store one such record for each account created from your link. These records exist to decide how many active goals a Free account may hold. Section 6 describes them further.

2.3. Information Stored on Your Device

The applications keep a local copy of Your Content so they work without a network and synchronise when one returns. The web application stores a session so that you stay signed in. If you enable reminders, reminder times are scheduled with your device's own notification system. This information sits on your device and is not a separate collection by us.

2.4. Information We Do Not Collect

We do not use analytics, advertising identifiers, tracking pixels, session recording, or third-party advertising software development kits. We do not sell personal information and we do not share it for cross-context behavioural advertising. There are no advertisements on either plan.

3. How We Use Information

We use personal information to:

Provide the Services, which means storing Your Content and returning it to you across your devices.
Authenticate you and keep your data separate from every other user's.
Compute the derived counts and the review dates the Services display.
Apply the limits of your plan, including any additional active goals earned through invitations.
Respond to you when you contact us.
Keep the Services secure, investigate abuse, and comply with law.

We do not use Your Content to train machine learning models.

4. Legal Bases

Where the General Data Protection Regulation or equivalent law applies, we rely on:

Performance of a contract, to provide the Services to you under the Terms of Use.
Legitimate interests, to keep the Services secure, to prevent abuse of the invitation feature, and to operate and improve the Services in ways you would reasonably expect.
Legal obligation, where we must retain or disclose information to comply with law.
Consent, where we ask for it, such as your device's permission to show reminder notifications. You may withdraw that permission in your device settings at any time, and the rest of the Services continue to work without it.

5. Where Your Information Is Stored

Your Content is stored in Google Cloud Firestore in the eur3 multi-region, which comprises data centres in the European Union. Authentication is provided by Google Firebase Authentication.

Access to Your Content is restricted by security rules enforced by the database itself: a request may read or write a record only where the signed-in account is the owner named in that record's path. A request from any other account is refused by the database, not merely by the application.

6. Invitations

Outstanding Today allows a Free account to hold more active goals when other people create accounts from that account's invite link.

An invite link contains the inviting account's user identifier. That identifier is not a credential and knowing it grants no access to anything.

The record of an invitation is written by the invited account when it is created, names the inviting account, and cannot afterwards be changed or deleted through the applications. Each account may be recorded as invited once. The inviting account can see how many such records name it, and can see the records themselves; it cannot see the invited people's content, email addresses or names, and it does not become able to read anything in their accounts.

If you would rather not be recorded as having been invited, do not create your account from an invite link.

We do not sell personal information. We share it only as follows:

Service providers. Google LLC and its affiliates provide authentication, database storage and application distribution, and process personal information on our instructions. Apple Inc. and Google LLC operate the application stores through which the mobile applications are distributed and through which in-app purchases are made.

Payment and subscription providers. Where a subscription service is used to verify purchase receipts and record your plan, that provider receives the information needed to do so, which is the purchase receipt from the store and your user identifier. We do not receive or store your card number. At the date above, no payment provider is connected and no purchases are possible.

Legal and safety. We may disclose information where we believe in good faith that it is required by law, or necessary to investigate fraud, abuse, or a threat to the safety of any person.

Business transfers. If Outstanding Today is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will give notice before your information becomes subject to a different privacy policy.

8. Cookies and Similar Technologies

The marketing website does not set advertising or analytics cookies.

The web application stores authentication state and a local copy of Your Content in your browser so that you remain signed in and can work offline. This storage is necessary for the application to function and is not used to track you across other websites.

9. Retention and Deletion

We retain Your Content for as long as your account exists.

You may delete individual records at any time. Deleting a record from within the Services removes it.

You may delete your account from the account section of settings. Deleting your account removes your records and then the account itself. Invitation records naming your account as an inviter are not removed by this, because they belong to the accounts that created them and record a fact about those accounts; they contain your user identifier and no other information about you.

Backups and logs held by our service providers may retain information for a limited period after deletion, after which it is overwritten in the ordinary course.

10. Security

Access to Your Content is enforced by database security rules rather than by application logic alone, and those rules are tested automatically as part of our development process. Connections to the Services use transport encryption. Data stored by our service providers is encrypted at rest.

Your plan and your invitation count are not writable by any client application, because a client that could write them could grant itself a paid plan or additional goals. They are set outside the client.

No service can promise perfect security, and we do not.

11. Your Choices and Rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it in a portable form, and to withdraw consent you have given.

Much of this is available to you directly: Your Content is visible and editable in the Services, and the account section of settings deletes your account and your records.

To make a request we cannot satisfy through the Services, contact us at the address in Section 16. We may need to verify that the request comes from you. We will not discriminate against you for exercising these rights.

If you are in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your supervisory authority.

12. International Processing

Your Content is stored in the European Union. Our service providers may process personal information in other countries in the course of operating their services, including the United States. Where personal information is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's standard contractual clauses or another lawful transfer mechanism offered by the provider.

13. Children

The Services are not directed to children. You may not use the Services if you are under 16 years old, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.