Security and reliability Product overview
Careful changes and explicit boundaries.
TextTodo is designed so conversational convenience does not become silent authority. Requests are validated, external changes stay narrow, and ambiguous deliveries are not intentionally repeated.
In plain language
Five boundaries worth knowing.
- Changes need a request in your current message.
- Ambiguous Calendar edits stop and ask.
- Duplicate prevention is intentional, even when that means an uncertain delivery is not retried.
- Google Calendar access is optional and limited to one account’s primary Calendar.
- You can reset context, disconnect Calendar, or request deletion.
Authorization
The current message has to support the change.
Recent conversation can explain what “that” refers to, but old history alone cannot authorize a mutation. Tool arguments, ownership, state, and action identity are checked before a write.
Every state-changing tool carries evidence copied from the current user message.
Task, reminder, and Calendar operations are limited to the connected user.
Ambiguous Calendar edits stop and ask for a clarifying date or time.
Duplicate resistance
Retries should converge on one result.
Stable action keys suppress duplicate task, reminder, and Calendar creation. Day-plan sessions and individual blocks are claimed durably, and bot-created event identifiers remain deterministic.
When one request contains multiple independent actions, TextTodo keeps successful changes, reports failures separately, and does not replace the outcome with a generic message.
iMessage delivery
Avoiding duplicates takes priority over automatic retries.
Incoming BlueBubbles messages are stored as durable jobs. Recovery considers only a rolling 15-minute window, and every reply or reminder records a delivery-attempt marker before dispatch.
Freshness controls
- Webhook and worker checks prevent historical command replay.
- Only recent incoming messages are eligible for recovery.
- Outgoing messages and system events are ignored as commands.
At-most-once delivery
- Once an attempt exists, TextTodo does not intentionally send it again.
- An ambiguous result may be confirmed from recent outgoing Messages.
- Otherwise it is finalized as assumed sent rather than duplicated.
Google Calendar
Optional access with a narrow purpose.
TextTodo requests an opaque Google account subject and permission to work with events owned by the user on the primary calendar. Refresh tokens are encrypted with AES-256-GCM.
Calendar sync updates only TextTodo links and reminders associated with events.
A notification only requests a later authenticated sync after its channel metadata matches.
The Calendar connection does not request or store the user’s Google email address.
User controls
Clear context, disconnect, or request deletion.
Use /reset to clear conversation context without deleting tasks. Ask to disconnect Google Calendar to remove the stored connection and linked metadata. Send /delete_my_data to request deletion of TextTodo data.
Questions?