Legal

Apricot (the “Service”) is operated by Crebo Ltd, a company registered in England and Wales under company number 16512788, whose registered office is at 66 Paul Street, London, EC2A 4NA. Apricot is a trading name of Crebo Ltd.

In these terms, “Apricot”, “we”, “us” and “our” mean Crebo Ltd, and “you” and “your” mean you as a user of the Service.

These terms, together with the data protection, privacy and cookie notices on this page, are the rules for your use of Apricot. By creating an account or using the Service you agree to them. If you do not agree to them, please do not use Apricot.

We review and amend these terms from time to time. Where a change is material we will tell you by email or in the app. Continuing to use Apricot after a change takes effect means you accept it.

Apricot keeps to-do lists. You can write tasks, give them due dates, times and notes, see them as a list or on a calendar, share a list with other people, assign tasks to them, receive an email about your day on a schedule you choose, and get an email when a task's time comes.

Apricot can also be connected to an AI assistant, so that the assistant can read and change your tasks on your behalf. Section 8 covers what that means.

Apricot has no passwords. You sign in by entering your email address and the one-time code we send to it, so anyone who can read your email can sign in as you. Keeping your email account secure is your responsibility.

You must be at least 16 years old to use Apricot. You are responsible for everything done through your account, and for the accuracy of what you tell us.

Apricot is in beta. Features may change, break or be withdrawn, and we may pause or reset parts of the Service while we work on it.

The Free plan costs nothing. The paid plans, Pro and Max, are paid monthly in advance by card, at the price shown when you subscribe. Payments are taken by our payment provider; we never see or store your card details.

A paid plan renews every month until you cancel it. You can cancel, change plan or update your card at any time from your profile. If you cancel, you keep your plan until the end of the month you have paid for, then move to Free: nothing you have made is deleted, but you cannot add more than the Free plan allows. Moving up a plan takes effect straight away, and you pay the difference for the rest of that month; moving down takes effect when your plan next renews.

Files attached to tasks are the exception. If, after moving to a smaller plan, the files on your lists take more storage than that plan includes, you have 30 days to bring them under it - by deleting some, or moving up a plan again. We email you when those 30 days start and a week before they end. If your files are still over at the end, we delete the oldest of them until they fit, and email you to say so.

We do not refund part of a month, except where the law gives you a right to a refund. If we change the price of your plan, we will tell you before the new price applies to you, so that you can cancel first if you want to.

Your tasks, notes, lists and the files you attach to them are yours. We claim no ownership of them. You grant us the permission we need in order to run the Service: to store your content, to show it back to you, to show it to people you share a list with, and to include it in the reminder emails you ask for.

You are responsible for what you put into Apricot. Do not store anything you are not entitled to hold, and please think before putting anything sensitive in a to-do list.

You agree not to:

• use Apricot in any way that breaks any applicable law or regulation;
• use it to store or send anything unlawful, or anything that infringes someone else's rights;
• invite, share with or assign tasks to people who have not agreed to hear from you;
• attempt to gain access to another person's account, lists or data, or to any part of our systems you have not been given access to;
• probe, scan or test the security of the Service, or interfere with its working;
• use automated means to create accounts, send invitations or generate email through Apricot.

We may suspend or close an account that breaks these rules, and we may do so without notice where the breach is serious.

Sharing a list with someone who is not in your People yet, or inviting them to your People, sends them an email invitation. Nothing is set up for them unless they accept it; accepting creates an Apricot account for them if they do not already have one. An invitation nobody answers lapses after 30 days and is then deleted. Only invite people who would expect to hear from you.

Everyone on a shared list can see its tasks and can add, edit, complete and delete them, and can see the name and email address of the other people on it. Deleting a list deletes it for everyone on it.

You can connect an AI assistant - Claude, ChatGPT or another - to Apricot. When you do, you are asked what to allow: reading your tasks, and changing them. The assistant then acts as you, within what you allowed, and what it sends to its own provider is governed by your agreement with that provider, not by this one. That includes the files attached to tasks: an assistant can read them when you ask about them, as it can read the tasks themselves.

You can revoke an assistant at any time from your profile, which stops its access immediately. Anything it did while connected stands: a list it shared with someone stays shared until you remove that person yourself.

An automation is a prompt you keep in Apricot for your assistant to run. When it runs, we give your assistant the prompt and the open items on the list you chose for it, and keep what it sends back and email it to you - and to anyone from your People you asked to get it, once they have said yes. What it sends back is written by your assistant, not by us, and we don't check it.

We try to keep Apricot running and to keep your data safe, but we do not promise that it will be uninterrupted or error-free, and during beta you should not rely on it as your only record of anything important. We may suspend access for maintenance or for any other reason.

Nothing in these terms affects your statutory rights, and nothing limits or excludes our liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.

To the fullest extent permitted by law:

• we exclude all warranties, terms and conditions implied by law in relation to the Service, which is provided as it is;
• we are not liable for any indirect or consequential loss, or for loss of profits, business, data, goodwill or anticipated savings, however arising;
• our total liability to you for everything arising under or in connection with these terms will not exceed the greater of the amount you have paid us in the twelve months before the claim and £1,000.

If any part of these terms is held to be invalid or unenforceable, the rest remain in force.

You can delete your account at any time from your profile. Doing so deletes your lists and tasks, your memberships of other people's lists, your People, your reminders and your assistant connections, and cancels any paid plan straight away. It cannot be undone, and we cannot recover it for you afterwards.

We may close an account that has broken these terms, or stop offering the Service altogether, in which case we will give you reasonable notice and a chance to take your data with you where we can.

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any claim arising under them. If you are a consumer resident elsewhere, you keep the benefit of any mandatory provisions of your own local law.

Questions about these terms: support@apricot.so.

Crebo Ltd is the data controller for the personal data held in Apricot. Our registered office is 66 Paul Street, London, EC2A 4NA. For anything to do with data protection, email privacy@apricot.so.

We are not required to appoint a statutory Data Protection Officer and have not appointed one. Responsibility for data protection sits with the directors.

Forms are the exception. When someone runs a Form, they decide what it asks and what happens to the responses, so they are the controller of what people send through it, and we process it on their behalf and on their instructions. If you sent something through someone's form, see “If you send something through a form” under Privacy Policy below.

Contract

Processing necessary to provide the Service to you: your account, your lists, the people you share with, and the reminders you ask for.

Legitimate interests

Keeping Apricot running, secure and free of abuse, answering you when you get in touch, and telling you what's new in Apricot.

Consent

Anything we would not otherwise be entitled to send you. You can withdraw consent at any time.

Legal obligation

Processing necessary in order to comply with the law.

Under the UK GDPR you have the right to:

Access

Be told whether we hold personal data about you, and receive a copy.

Rectification

Have inaccurate or incomplete personal data corrected.

Erasure

Have your personal data deleted, where that right applies.

Restriction

Have us stop using your personal data while a question about it is resolved.

Portability

Receive the personal data you gave us in a structured, commonly used, machine-readable format.

Objection

Object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.

Withdrawing consent

Withdraw consent where we rely on it, without affecting anything done lawfully beforehand.

To exercise any of these, email privacy@apricot.so. We may ask you to confirm your identity first - that is what stops us handing your data to someone who is not you. We will respond within one month, which we may extend by up to two further months if the request is complex, and we will tell you if we do.

Much of this you can do yourself: your name and reminder schedule are editable in your profile, tasks and lists can be edited or deleted at any time, and deleting your account erases the lot.

We do not make decisions about you by automated means, and we do not profile you.

Your account and content

Until you delete your account. Deletion takes your lists, tasks, memberships, People and reminder settings with it.

Attached files

Until someone on the list removes them, or their task or list is deleted. If the list's owner moves to a smaller plan and stays over its storage for 30 days, the oldest are deleted until they fit.

Archived tasks

Deleted for good 90 days after you archive them, whether or not you delete your account first.

Billing records

If you have paid for a plan, the invoices and payment records are kept for six years after the end of the tax year they belong to, as UK tax law requires, even if you delete your account.

Automation results

Deleted 180 days after the run that made them, or sooner if you delete the automation or your account.

Form responses

Until the form's owner, or someone on its list, deletes them - or archives them, after which they are deleted 90 days later. Deleting the list, or the owner's account, deletes them too.

Form rate-limit counts

Deleted within two days. They hold a one-way keyed hash of the sender's IP address, never the address itself.

Sign-in codes

Minutes. A code expires shortly after it is sent, is single-use, and is deleted once used.

Records of reminder emails

A record that your daily email was sent, and how many tasks it held, kept while your account exists.

Product update mailing list

Your name and email address, while you have an account and haven't unsubscribed. If you unsubscribe, or delete your account, we keep only your email address on a do-not-email list, so we never send you updates again.

Server logs

Held by our hosting provider for a short period, as they are for every website.

Correspondence

Two years from our last contact with you, unless it relates to a legal or accounting record we must keep for longer.

Apricot's database is hosted in London. Our hosting, email and payment providers are based in the United States and operate infrastructure in the United States and Europe, so some personal data is transferred outside the United Kingdom.

Where personal data goes to a country not covered by a UK adequacy decision, the transfer is protected by the International Data Transfer Agreement, or by the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional measures the transfer requires.

If you are unhappy with how we have handled your personal data, please tell us first at privacy@apricot.so and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. If you are in the European Economic Area, you may complain to your own supervisory authority instead.

Your identity

Your name and email address. The email address is how you sign in; the name is what other people on a shared list see.

Your content

The lists you make and the tasks in them: titles, notes, due dates, who a task is assigned to, and whether it is done or archived.

Your forms

If you run a Form: the questions it asks, its wording and its settings, and what people send through its public link - their answers, and the name and email address they chose to give if the form asked for them.

Who you share with

The people you invite or are invited by, and which of your lists they are on. For an invitation not yet accepted, the name and email address you gave, until it is accepted, declined, withdrawn or lapses after 30 days.

Your settings

Whether your "Your day" email is on, and the days, time and timezone you chose for it, and whether you're emailed when a task's time comes.

Connected assistants

Which assistants you have connected, what you allowed them to do, when, and when each last used Apricot.

Your automations

If you make automations: each one's name, prompt and the list it reads, who from your People you've asked to get its results and whether they said yes, and the results your assistant sends back - their title, summary, text and sources - with when each run started and was delivered, and which assistant ran it.

Billing

If you pay for a plan: which plan, whether it is active, when it renews or ends, and a reference to your record at our payment provider. Your card details go straight to the payment provider, and we never see them.

Technical records

Your IP address, browser and device type, and which pages you requested and when - recorded automatically in our hosting provider's logs, as they are for every website, and counted in aggregate so we can see which pages get used.

We do not collect special category data, and we never see or store your card details. We do not knowingly collect data about children.

Running your account and lists

Contract.

Sending sign-in codes

Contract: it is how you get in.

Sending reminder emails

Contract, at the schedule you set. Turn them off in your profile at any time.

Telling someone a list has been shared with them, or a task assigned to them

Contract, and our legitimate interest in the person knowing.

Running a form's public link, and emailing new responses to the people on its list

Contract with the form's owner, on whose behalf we process what is sent to it.

Limiting how often a form can be sent to

Legitimate interests: stopping a form being flooded by spam.

Keeping Apricot available and secure

Legitimate interests: keeping the Service running and protecting it from abuse.

Taking payment for a paid plan

Contract, and legal obligation for the tax records we must keep.

Answering you when you write to us

Legitimate interests.

Emailing you about what's new in Apricot

Legitimate interests, and the “soft opt-in” UK law allows for people who have an account with us. Only about Apricot itself, never anyone else's products, and not often. Say no when you sign up, switch them off under What's new in your profile, use the one-click unsubscribe link in any of them, or email us. Unsubscribing never affects your account, sign-in codes or the reminders you set up.

Meeting our legal obligations

Legal obligation.

If we ever want to use your personal data for something not on this list, we will tell you first and, where the law requires it, ask your consent.

We do not sell your personal data and we do not share it for advertising. Apricot carries no advertising technology, and the only measurement we do is a cookieless count of page views, described under Cookies below. We use a small number of providers, who process personal data on our instructions and may not use it for their own purposes:

Hosting

Runs the application, serves it to your browser, and counts page views for us without cookies. Infrastructure in the United States and Europe.

Database hosting

Stores your account, your lists and your tasks. Hosted in London.

File storage

Stores the files attached to tasks, privately: nobody can open one without being on its list. Hosted in the European Union.

Email delivery

Sends our email on our behalf: sign-in codes, invitations, assignment notices, reminders, a form's new responses to the people on its list, and our emails about what's new in Apricot - for which it keeps our mailing list of names and email addresses, and who has unsubscribed. Based in the United States.

Payments

Takes payment for paid plans, holds your card details, and sends receipts and invoices. Based in the United States, with European operations in Ireland.

Our payment provider also uses payment details for its own purposes, as a controller in its own right, to prevent fraud and meet its legal obligations. Its own privacy notice covers that use.

We will tell you who these providers are if you ask: email privacy@apricot.so.

Assistants you connect are different. If you connect Claude, ChatGPT or another assistant, the tasks it reads and writes go to that provider at your instruction, under your own agreement with them. We are not responsible for what they do with it, and you can revoke access from your profile at any time.

People you share a list with see its contents, and see your name and email address.

On a Form, everyone on the list sees every response, with any name and email address its sender gave. Nobody else sees a response: people who open the form's link see only the form. A form never says who runs it unless its owner writes that into the form themselves.

We may also disclose personal data where we are under a duty to do so in order to comply with a legal obligation; to enforce our agreements or investigate a suspected breach; to protect the rights, property or safety of Crebo Ltd, our users or others; or in connection with a sale or reorganisation of our business, in which case the buyer is bound by this notice and we will tell you beforehand.

• data in transit is encrypted using TLS;
• data at rest is encrypted by our providers;
• there are no passwords to steal: sign-in is by one-time code, and codes are single-use and short-lived;
• every request for your data is checked against your own account, so one person cannot read another's lists;
• a form's public link is long and random, so it cannot be guessed, and its owner can switch it off or replace it at any time;
• access to our systems is limited to the people who need it.

Sending information over the internet is never completely secure. We will do our best to protect your personal data, but we cannot guarantee the security of anything you send us.

Forms on Apricot are run by our users, for their own purposes. When you send a response, it goes to whoever runs that form and the people they share it with: your answers, and your name and email address if the form asks and you give them. The form says above its Send button who sees what you send.

The person who runs the form is responsible for what they do with your response, so to see, correct or delete it, ask them first. If you can't reach them, or they don't answer, email privacy@apricot.so with the form's address and we will help.

Your response is never shown to other people who open the form. Your IP address is used only as a one-way hash, to limit how often one connection can send, and is never stored as it is.

Email privacy@apricot.so with “Subject access request” in the subject line, or write to us at Crebo Ltd, 66 Paul Street, London, EC2A 4NA. There is normally no charge. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why.

European Economic Area and Switzerland. Your rights under the EU GDPR are equivalent to those set out above, and you may complain to your own supervisory authority.

United States. We do not sell or share personal information, as those terms are used in the California Consumer Privacy Act, and we do not use it for cross-context behavioural advertising. If your state has a comprehensive privacy law, you may have the right to know what we hold, to have it deleted or corrected, and not to be treated differently for exercising those rights. Email privacy@apricot.so and we will handle your request under the law that applies to you.

Apricot sets only the cookies it needs to keep you signed in, or to let you into a list shared with a password. It keeps a few small preferences in your browser. It counts page views without cookies. It carries no advertising technology of any kind, and nothing here follows you to another site - which is why there is no cookie banner to dismiss.

Sign-in cookies

Set when you sign in, so that the next page knows it is you. While you connect an assistant, a short-lived one also remembers what the assistant asked for, until you have signed in and approved it. They are HttpOnly, so no script on the page can read them, SameSite=Lax, so they are not sent when another site links to us, and Secure. Strictly necessary: without them you cannot stay signed in. Cleared when you sign out.

apricot-link

Set when you type the password for a list someone shared with you by a read-only link, so you aren't asked again on that link for 30 days. It only works for that one link, and stops working if its password or address changes. HttpOnly, SameSite=Lax and Secure. Strictly necessary: without it you couldn't see the list.

apricot-theme

Whether you chose light, dark or your device's setting. Kept in your browser's local storage. Never leaves your device.

apricot:density

Whether you chose tight or roomy task rows. Kept in your browser's local storage. Never leaves your device.

apricot:assign-email

Whether assigning a task should email the person. Kept in your browser's local storage. Never leaves your device.

apricot:list-view

Whether you last looked at your lists as rows or on the calendar. Kept in your browser's local storage. Never leaves your device.

apricot:calendar-range

Whether the calendar shows a week or a month. Kept in your browser's local storage. Never leaves your device.

apricot:all-tasks-hidden

Which lists you left out of Recurring. Kept in your browser's local storage. Never leaves your device.

apricot:all-tasks-folded

Which sections of All tasks, such as Upcoming, you folded away. Kept in your browser's local storage. Never leaves your device.

apricot:lists-panel

Whether you put away the lists panel on a wide screen. Kept in your browser's local storage. Never leaves your device.

apricot:lists-panel-width

Whether the lists panel is standard or wide on this device. Kept in your browser's local storage. Never leaves your device.

apricot:lists-collapsed

Which groups in the lists panel, such as Tasks or Notes, you folded away. Kept in your browser's local storage. Never leaves your device.

apricot:getting-started

Whether you put away the Get started steps on All tasks. Kept in your browser's local storage. Never leaves your device.

Our typefaces are served from Apricot itself rather than from a font provider, so viewing a page makes no request to any third party.

We count which pages are opened and how often. Our hosting provider does the counting on our behalf: it sets no cookies and stores nothing on your device, it does not follow you to any other site, and it does not build a profile of you.

Your browser lets you see stored cookies and site data, delete them, and block them for particular sites. Those settings are usually under privacy or site settings. Blocking them for Apricot will stop you signing in or opening a list shared with a password, and will make the preferences above forget themselves. Nothing else depends on them.

Questions about any of this: privacy@apricot.so.