Local-first. Cloud-ready. Always encrypted. Your tasks, habits, and personal plans are stored on your device and protected with AES-256 encryption — whether or not you use cloud sync.
10 to Win is designed with a local-first, privacy-respecting approach. Here is exactly how your data is protected.
All task data and all habit data are encrypted on your device using AES-256 — the same standard used by banks and governments. Plaintext is never written to local storage.
Cloud sync is entirely optional. Without an account, nothing leaves your device. With an account, your tasks sync over TLS-encrypted connections. Habit data stays local only.
We do not run advertising, build advertising profiles, or sell your data to any third party under any circumstances. Your productivity patterns are yours alone.
Encryption keys are stored in your device's most secure compartment — iOS Keychain on iPhone and Android Keystore on Android — never in plain app storage.
Three overlapping layers ensure your data is never overwritten by sample content and survives reinstalls, storage clears, and app updates.
You have the right to access, export, and permanently delete all data associated with your account at any time. No waiting period, no hassle.
Whether you use 10 to Win offline or with a cloud account, the following data never leaves your device and is never accessible to us:
Full transparency on every category of data, how it is used, and where it lives.
| Data Type | Collected When | Where Stored | Used For |
|---|---|---|---|
| Nothing | No account, no integrations | Device Only | The app runs entirely offline. No data is collected or transmitted. |
| Email address | Account creation (optional) | Our Server | Account authentication, welcome email, password reset. Never shared or sold. |
| Task list | When logged in with cloud sync | Our Server | Sync across devices. Encrypted in transit via TLS. Deleted when you delete your account. |
| Habit data | Always | Device Only | Habit data is never synced to the cloud. AES-256 encrypted on-device only. |
| Phone number | Pro subscribers who opt in to SMS or voice notifications | Twilio | Delivering SMS reminders and voice call notifications. Stored by Twilio per their privacy policy. Not used for marketing. |
| Payment information | Paid subscription or one-time purchase | Stripe | Processing payments. We never see or store your card number. Stripe handles all payment data per their PCI-DSS compliance. |
| Integration tokens | When Todoist, VoiceStamps, or Zapier is connected | Device Only | Authenticating API calls to third-party services. Stored securely on-device. Never transmitted to our servers. |
| Crash reports | If the app crashes | Our Server | Diagnosing and fixing bugs. Reports contain stack traces only — no task data, no personal information. |
How AES-256 encryption works inside 10 to Win, and what the multi-layer protection system means for your data.
Every task you create is encrypted with AES-256 before being written to local storage. When the app reads a task, it decrypts it in memory — the on-disk representation is always encrypted ciphertext, never plaintext.
Habit data — completions, streaks, history — is encrypted with a separate AES-256 key. Habits are never synced to the cloud and exist exclusively on your device in encrypted form.
A multi-layer sentinel system prevents sample data from ever overwriting real user data — even after a reinstall, storage clear, or app update.
Every API call from the app to our servers is sent exclusively over HTTPS/TLS. There is no plaintext fallback — if a TLS connection cannot be established, the request fails rather than falling back to unencrypted HTTP.
When you connect optional integrations, the following third-party services become involved. Each integration is fully optional — disconnecting it at any time removes their access.
Task synchronization across devices
If you connect Todoist, your tasks sync to Todoist's servers, enabling access across all your devices. This feature is entirely optional and can be disconnected at any time from Settings.
Automation and cross-app task import
The optional Zapier Power Boost provides a personal webhook URL that can receive tasks from over 5,000 external services. You configure which apps may send tasks — we do not access those apps on your behalf.
Billing, Record, Reminder, and Verification task feeds
Pro subscribers can connect VoiceStamps sync feeds, which automatically push tasks from business systems into their priority queue. This is intended for business users in roles that involve billing, verifications, appointments, and recordings.
?email= filter limits results to tasks assigned specifically to you.Subscription billing and one-time purchases
All payments are processed by Stripe. We never see, receive, or store your credit card number, CVV, or full payment details.
Welcome emails and account notifications
We use Resend to send transactional emails (welcome messages, password resets). These are sent from @voicestamps.com addresses and are triggered only by account actions you initiate.
Pro subscription: SMS reminders and voice call alerts
Pro subscribers who opt in to SMS or voice call notifications provide a phone number. This number is passed to Twilio for delivery of notification messages. This is entirely optional — most notifications are push-only and require no phone number.
We are happy to answer any privacy or security questions. Response time is typically within one business day.
Email us with any questions about how we handle your data, to request a data export, or to initiate account deletion.
Last updated: May 2026 · This page reflects the current build of 10 to Win as of May 10, 2026.