candytuft.

Privacy policy

Last updated 8 November 2026

Candytuft is a to-do list for couples. We built it so that the things you plan together stay between the two of you. This page explains what the app stores, what we can and cannot see, and how to delete everything.

The short version

  • Your tasks, routines, names, photos and home are encrypted on your iPhone before they are sent anywhere. Only you and your partner hold the key. We cannot read them.
  • You don't need an email address, phone number or password to use Candytuft.
  • No ads, no analytics, no tracking, and we never sell or share your data.
  • You can delete your account and data from inside the app at any time.

On your iPhone

Everything you add to Candytuft is saved on your iPhone. If you only use Candytuft by yourself, it never leaves your phone.

When you share a home

To keep two phones in sync, Candytuft uses Google Firebase (Cloud Firestore and Firebase Authentication) as its server.

  • End-to-end encryption. Before anything leaves your phone, it is locked with a 256-bit key using AES-GCM encryption. That key is created on your phone and passed to your partner's phone through the server, locked so that only their phone can open it. It never reaches us in a readable form.
  • Where your keys live. Your keys are stored in your iPhone's Keychain. If you use iCloud Keychain, Apple syncs them between your own devices with its own end-to-end encryption.
  • An anonymous account. The app signs in with a random anonymous ID. It isn't linked to your name, email or Apple ID.

What our server can see

To deliver changes to the right phones, the server has to see a small amount of information that is not encrypted:

  • random IDs for your account, your home and each item;
  • which accounts belong to which home;
  • when each item was last changed, and by which account;
  • whether an item has been deleted;
  • public keys used to share the home key between your phones;
  • partner invite codes, when they were created and when they expire;
  • the size of the encrypted data.

Like any internet service, Google's servers also process technical information such as your IP address so the connection can work. Google handles this as our service provider under the Firebase privacy terms.

Invite links

An invite link contains a short code and a secret. The secret sits after the # in the link. Browsers and apps never send that part to a server, so even our website never sees it. Invites expire after 14 days.

Notifications

Task reminders and love notes are scheduled on your iPhone. They are not sent from our server.

Deleting your data

In Candytuft, open Settings and tap Delete my account and data.

  • Your anonymous account and your profile in the shared home are deleted from the server.
  • If you were the last person in the home, the whole home and everything in it is deleted.
  • If your partner is still in the home, they keep the shared list on their side.

Deleting the app removes your list and home from your iPhone.

Children

Candytuft is made for couples and is not directed at children under 13.

Changes

If we change how Candytuft handles your data, we will update this page and the date at the top.

Contact

Questions about privacy? Email hello@candytuft.app.