Privacy Policy for To Dos for Fastmail
Effective date: November 11, 2026
This Privacy Policy explains how the To Dos for Fastmail browser extension (the "Extension") handles information. The Extension is published by Aphex Creations LLC ("Aphex Creations", "we", "us"). It adds a To Dos tab to the Fastmail web app so that you can view and manage the to-dos stored in your Fastmail account.
This policy covers the Extension only. It does not cover the aphex.io website, Fastmail, or any other product or service. The Extension is unofficial and is not affiliated with or endorsed by Fastmail.
Summary
- We do not collect, receive, store, sell or share your personal information. The Extension has no server of its own.
- Your data moves only between your browser and Fastmail, over HTTPS.
- The Extension has no analytics, telemetry, advertising, tracking or remotely loaded code.
Information the Extension handles
The Extension handles the information below on your device so that it can work. None of it is sent to us.
| Information | Why it is needed | Where it is kept |
|---|---|---|
| Your Fastmail login email address and a Fastmail app password | To sign in to Fastmail's CalDAV service for you | In the Extension's local storage in your browser profile (chrome.storage.local), until you click Disconnect or remove the Extension |
| Your to-do lists and to-dos, including titles, notes, due dates and priority | To show them and let you edit them | Fetched from Fastmail. A temporary copy is kept in the browser's session storage (chrome.storage.session), which is held in memory and cleared when you close the browser |
| Two display preferences: the last list you opened and whether completed to-dos are shown | To reopen the To Dos tab the way you left it | In the Extension's local storage in your browser profile |
The Extension does not collect your browsing history, location, contacts, files, payment details or the content of your email.
How the information is used
The information is used only to provide the Extension's single purpose: showing and managing your Fastmail to-dos inside the Fastmail web app. It is not used for advertising, analytics, profiling or any other purpose.
Where information is sent
The Extension sends information only to Fastmail, over HTTPS:
caldav.fastmail.com: to read and write your to-dos and to-do lists. When you test or save an app password, the Extension also makes one write test to confirm that the password is not read-only. The test is built to be rejected without saving anything. If Fastmail does save the test item, the Extension deletes it right away.carddav.fastmail.comandmyfiles.fastmail.com: when you test or save an app password, the Extension tries it once against each of these services, only to confirm that the password cannot reach your contacts or files. The Extension refuses a password that has that access. No contacts or files are read.
The Extension does not send information to Aphex Creations or to any other party.
What the Extension accesses on the Fastmail page
The Extension runs on https://app.fastmail.com so that it can add the To Dos tab to the sidebar. It reads the page's layout and its light or dark theme so that the tab fits in. It does not read, collect or send your email, contacts or other page content.
Sharing and disclosure
We do not sell, rent, share or transfer your information, and we could not do so, because we never receive it. The only party that receives information from the Extension is Fastmail, the provider of the account you connect.
Third-party services
- Fastmail. Your to-dos and account are stored by Fastmail and are covered by the Fastmail Privacy Policy.
- Chrome Web Store. If you install the Extension from the Chrome Web Store, Google handles the installation and updates under the Google Privacy Policy. Google gives us only aggregate statistics, such as the number of installs. These do not identify you.
- Link to our website. The Extension shows a link to our website, aphex.io. The Extension sends nothing to that website. If you click the link, your browser opens the website in a new tab. The link includes a short tag (
f=tdff) that shows the visit came from the Extension. That website is separate from the Extension, uses analytics and advertising tags, and is not covered by this policy.
Retention and deletion
We hold none of your information, so we have nothing to retain or delete. You control the information on your device:
- Disconnect, on the Extension's settings page, deletes the stored login email address, app password and cached to-dos.
- Removing the Extension from your browser deletes everything it stored.
- Revoking the app password in Fastmail (Settings > Privacy & Security > Manage app passwords and access) ends the Extension's access to your account.
Your to-dos themselves stay in your Fastmail account until you delete them there or in the Extension.
Security
All communication with Fastmail uses HTTPS. The Extension asks for an app password limited to Calendars (CalDAV) access, never your main Fastmail password, and it refuses an app password that can also reach your contacts or files.
The app password is stored unencrypted in your browser profile, in the same way as other extension data. Access to it is limited to the Extension's own background service worker and settings page. The script that the Extension runs on the Fastmail page cannot read it. Anyone who has access to your browser profile on your device may be able to read it, so protect your device and revoke the app password in Fastmail if your device is lost or shared.
Chrome Web Store Limited Use
The use of information received from Fastmail and from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The information is used only to provide the Extension's single purpose. It is not transferred, sold, or used for advertising, for determining creditworthiness, or for lending purposes.
Your rights
Privacy laws such as the GDPR and the CCPA give you rights over personal information that an organization holds about you, including rights to access, correct and delete it. Because we do not receive or hold your information, we have nothing to provide, correct or delete. The information on your device is under your control, as described above. For the information in your Fastmail account, contact Fastmail.
We do not sell or share personal information, as those terms are defined in the CCPA.
Children's privacy
The Extension is not directed to children under 16. We do not collect personal information from anyone, including children.
Changes to this policy
If this policy changes, the new version will be posted at this address with a new effective date. If a change affects how the Extension handles your information, the Extension's Chrome Web Store listing will note it in the same update.
Contact
Questions about this policy can be sent to Aphex Creations LLC at build@aphex.io. If you email us, we use your email address and message only to reply to you.
About this page
This page is static. It has no scripts, cookies or analytics. As with any website, the hosting provider (Cloudflare) processes your IP address and request details in order to deliver the page.