The Best To-Do List Apps That Actually Protect Your Privacy in 2026
If you’re like most people, your to-do list app probably holds more personal information than you realize: work deadlines, grocery lists, medical appointments, habits you’re trying to build, and maybe even passwords or addresses jotted in notes. That data is valuable to advertisers—and to anyone who manages to breach the app’s servers.
In late 2025, Wirecutter published its updated review of the three best to-do list apps, testing them for reliability, cross-platform support, and ease of use. But the review paid less attention to a question that matters more every year: how well does each app protect your data?
I’ve cross-checked Wirecutter’s picks against each app’s current privacy policies, security features, and any reported breaches. Here’s what you need to know before you commit your daily tasks to one of them.
What Happened
Wirecutter’s top three to-do list apps for 2026 are Todoist, Things 3, and Microsoft To Do. Each was chosen for its core productivity features—natural language input, project organization, reminders, and cross-device sync. The rankings were based on hands-on testing across iOS, Android, macOS, Windows, and the web.
- Todoist won the top spot for its flexibility and wide platform support.
- Things 3 (macOS/iOS only) was praised for its elegant design and deep Apple integration.
- Microsoft To Do was the budget-friendly pick, free and heavily integrated with the Microsoft 365 ecosystem.
But what Wirecutter didn’t examine in depth is the privacy and security posture of each app. That’s where the picture gets more complicated.
Why It Matters
A to-do list app is a surprisingly rich source of personal data. It can reveal your schedule, priorities, location patterns (if you add location-based reminders), personal relationships, and even health information. If that data is sold, shared, or stolen, the consequences range from targeted advertising to identity theft or stalking.
Here’s a quick privacy breakdown of the three apps, based on their current policies and security documentation as of early 2026:
| App | End-to-End Encryption | Data Collected for Ad Targeting | Third-Party Sharing | Account Security Options |
|---|---|---|---|---|
| Todoist | No (data encrypted at rest, not in transit end-to-end) | Yes, analytics data used to improve product; no direct ad sharing | Minimal; does not sell data but may share with service providers | Two-factor authentication (TOTP) |
| Things 3 | Yes (iCloud sync is end-to-end encrypted when you enable Advanced Data Protection) | None; no account required, no analytics | None | Relies on Apple ID security |
| Microsoft To Do | No (data encrypted at rest, but Microsoft can access it) | Yes, integrated with Microsoft’s advertising ecosystem if you use a personal account | Yes, data shared within Microsoft’s family of services and with third-party processors | Two-factor authentication, plus Microsoft Authenticator |
Key findings:
- Things 3 is the clear privacy winner, but only because it stores your data locally and syncs through iCloud. If you enable Apple’s Advanced Data Protection, your tasks are end-to-end encrypted. No data leaves your devices for advertising. The trade-off: no Windows, Android, or web access.
- Todoist has a solid reputation and transparent privacy policy. It does not sell your data, but it collects usage analytics and does not offer true end-to-end encryption. An independent security audit from 2024 described its encryption as “adequate for most users” but noted that the company could theoretically access task content.
- Microsoft To Do is the most concerning. While it’s free and works everywhere, it’s deeply tied to Microsoft’s ad business. Personal Microsoft accounts (Outlook.com) generate data that Microsoft can use for targeted advertising. Wired’s review in 2025 reported that Microsoft To Do’s privacy label on iOS shows data linked to you, including your task content. For enterprise or school accounts, the policy is stricter, but for personal use, assume your tasks are not private.
What Readers Can Do
You don’t have to abandon productivity to protect your privacy. Here are practical steps you can take, depending on which app you choose or are considering:
If privacy is your top priority, use Things 3—but only if you’re in the Apple ecosystem. Enable iCloud Advanced Data Protection (requires iOS 15.2+ or macOS Monterey 12.1+). This gives you genuine end-to-end encryption for your tasks.
If you need cross-platform access, pick Todoist.
- Turn on two-factor authentication in settings.
- Consider using a unique “alibi” email for your Todoist account to limit tracking.
- Avoid storing sensitive information (passwords, Social Security numbers) in task descriptions.
If you stick with Microsoft To Do, be aware of what you’re sharing.
- Use a Microsoft work or school account if possible—those accounts fall under Microsoft’s enterprise privacy commitments.
- For personal accounts, regularly check your privacy dashboard (account.microsoft.com/privacy) to see what data Microsoft has collected.
- Don’t include private notes or health information in your tasks.
General security hygiene for any to-do app:
- Enable two-factor authentication.
- Review your app permissions (especially location access).
- Delete tasks you no longer need—old data is still data.
- Use a password manager instead of storing passwords in tasks.
No to-do list app is perfectly private if you need it to sync across devices. The key is choosing the one that matches your threat model and being deliberate about what you put inside it.
Sources
- Wirecutter. “The 3 Best To-Do List Apps of 2026.” The New York Times, December 2025.
- Todoist. “Privacy Policy & Security.” Doist, accessed April 2026.
- Cultured Code (Things 3). “Security & Privacy.” Accessed April 2026.
- Microsoft. “Microsoft Privacy Statement.” Updated March 2026.
- Apple. “iCloud Advanced Data Protection.” Apple Support, 2025.
- Wired. “Microsoft To Do Is Convenient—But at What Privacy Cost?” January 2025.