Privacy policy
Last updated October 1, 2026
Hecho is a to-do app. To make it work we need to keep some information about you and your tasks. Here is what we keep, why, and what you can do about it, in plain words.
Who we are
Hecho is operated by App-tech ApS, a Danish private limited company (CVR 46817737), Nygade 9, 8850 Bjerringbro, Denmark. App-tech ApS is the data controller for the personal data described here.
What we collect
- Your account: name, email address, password (stored only as a secure hash), avatar, time zone and language.
- What you put in Hecho: tasks, projects, comments, labels, files you attach and your settings.
- Teams: the teams you belong to, your role, and invites you send or receive.
- Sign-in with Google or Apple: if you use it, we receive your name, email and an account identifier from them. Nothing else.
- Basic technical data: the device type and rough country when you sign up or log in, used for security and to fight abuse.
How we use it
- To run Hecho: show your tasks, sync them across devices and share them with your team.
- To send emails you need, like verification links, password resets, invites and reminders you turned on.
- To keep accounts safe and stop spam.
We don't sell your data and we don't show ads.
Where it's stored
Hecho runs on Cloudflare. Your data is stored in Cloudflare's databases and file storage and is encrypted in transit. Only a small number of people who operate Hecho can access it, and only to help you or keep the service running.
Payments
Subscriptions are sold through Google Play, the Apple App Store and, where available, our own web checkout. Google, Apple or our payment provider process the payment; we never see or store your card details. We only receive what we need to unlock your plan and keep invoices: the plan, amount, billing country and status.
Who else sees your data
- People in your teams see the team projects, tasks and comments you share there. Your personal projects stay private.
- Service providers that help us run Hecho (hosting, email delivery), only as needed to provide the service.
- Authorities, only when the law requires it.
Cookies and local storage
Hecho uses a few cookies and some storage in your browser. Advertising cookies (Meta) are used only if you allow Marketing cookies. When you first visit we ask which optional ones you allow, and you can change that any time with (at the bottom of every page, and in Settings → General in the app). Your choice is kept in a cookie called hecho_consent for 12 months.
- Necessary (always on): your sign-in session cookie, security protections for forms and accounts, and your language choice (the hecho_lang cookie). Hecho can't work without these, so they don't need consent.
- Preferences (optional): remember choices you make in the interface on this device, such as sort order, collapsed sections, layouts and dismissed tips. Your account settings, like theme, are saved in your account, not in cookies.
- Analytics (optional): our own first-party product analytics. With your OK, the app sends us simple events, such as when an upgrade screen is shown or a plan button is clicked, so we can improve Hecho. They go only to our own servers and are never shared with ad networks. Without your OK, nothing is sent.
- Marketing (optional): the Meta Pixel, which helps us see whether our ads on Facebook and Instagram lead to sign-ups and purchases. It sets Meta's _fbp and _fbc cookies. Without your OK it is never loaded.
Meta Pixel and Conversions API
If you accept Marketing cookies on hechotask.com, we use the Meta Pixel and Meta's Conversions API to measure our ads. Meta then receives the pages you visit and actions such as creating an account, starting a trial or buying a plan (with the plan and price), together with your IP address, browser details, Meta's cookie ids and a scrambled (hashed) version of your email address and account id. Meta, Meta Platforms Ireland Ltd., uses this to match the actions to its users and to report on and improve our ads; see Meta's privacy policy at facebook.com/privacy/policy. Purchases made in our Android app through Google Play are reported to Meta the same way. You can withdraw your consent any time in Cookie settings. Custom domains of Business teams never load the pixel.
Legal basis and how long we keep data
We process your data to provide the service you signed up for (performance of a contract), to keep Hecho secure (legitimate interest), to meet bookkeeping and tax rules (legal obligation) and, for optional cookies and marketing emails, with your consent. We keep your data while your account is active. When you delete your account we remove it within 30 days, except invoices and payment records, which Danish bookkeeping law requires us to keep for 5 years. Backups are overwritten within 90 days.
Your rights
Under the GDPR you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent at any time. Write to info@hechotask.com. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
Your choices
- You can edit your profile and settings anytime in Settings.
- You can delete your account anytime in Settings → Account. We remove your personal data and personal projects; content you shared with a team may stay for the team.
- You can ask us for a copy of your data, or ask any question about privacy, at info@hechotask.com.
Changes
If we change this policy in a meaningful way, we'll tell you in the app or by email before it takes effect.