Legal

Apricot (the “Service”) is operated by Crebo Ltd, a company registered in England and Wales under company number 16512788, whose registered office is at 66 Paul Street, London, EC2A 4NA. Apricot is a trading name of Crebo Ltd.

In these terms, “Apricot”, “we”, “us” and “our” mean Crebo Ltd, and “you” and “your” mean you as a user of the Service.

These terms, together with the data protection, privacy and cookie notices on this page, are the rules for your use of Apricot. By creating an account or using the Service you agree to them. If you do not agree to them, please do not use Apricot.

We review and amend these terms from time to time. Where a change is material we will tell you by email or in the app. Continuing to use Apricot after a change takes effect means you accept it.

Apricot keeps to-do lists. You can write tasks, give them due dates and notes, share a list with other people, assign tasks to them, and receive a reminder email on a schedule you choose.

Apricot can also be connected to an AI assistant, so that the assistant can read and change your tasks on your behalf. Section 8 covers what that means.

Apricot has no passwords. You sign in by entering your email address and the one-time code we send to it, so anyone who can read your email can sign in as you. Keeping your email account secure is your responsibility.

You must be at least 16 years old to use Apricot. You are responsible for everything done through your account, and for the accuracy of what you tell us.

Apricot is in beta. It is free to use, and there is nothing to pay. Features may change, break or be withdrawn, and we may pause or reset parts of the Service while we work on it.

We intend to offer paid plans later. We will not charge you anything without telling you first and giving you the choice to decline.

Your tasks, notes and lists are yours. We claim no ownership of them. You grant us the permission we need in order to run the Service: to store your content, to show it back to you, to show it to people you share a list with, and to include it in the reminder emails you ask for.

You are responsible for what you put into Apricot. Do not store anything you are not entitled to hold, and please think before putting anything sensitive in a to-do list.

You agree not to:

• use Apricot in any way that breaks any applicable law or regulation;
• use it to store or send anything unlawful, or anything that infringes someone else's rights;
• invite, share with or assign tasks to people who have not agreed to hear from you;
• attempt to gain access to another person's account, lists or data, or to any part of our systems you have not been given access to;
• probe, scan or test the security of the Service, or interfere with its working;
• use automated means to create accounts, send invitations or generate email through Apricot.

We may suspend or close an account that breaks these rules, and we may do so without notice where the breach is serious.

Sharing a list, or adding someone to your People, sends them an email and creates an Apricot account for them if they do not already have one. Only invite people who would expect to hear from you.

Everyone on a shared list can see its tasks and can add, edit, complete and delete them, and can see the name and email address of the other people on it. Deleting a list deletes it for everyone on it.

You can connect an AI assistant - Claude, ChatGPT or another - to Apricot. When you do, you are asked what to allow: reading your tasks, and changing them. The assistant then acts as you, within what you allowed, and what it sends to its own provider is governed by your agreement with that provider, not by this one.

You can revoke an assistant at any time from your profile, which stops its access immediately. Anything it did while connected stands: a list it shared with someone stays shared until you remove that person yourself.

We try to keep Apricot running and to keep your data safe, but we do not promise that it will be uninterrupted or error-free, and during beta you should not rely on it as your only record of anything important. We may suspend access for maintenance or for any other reason.

Nothing in these terms affects your statutory rights, and nothing limits or excludes our liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.

To the fullest extent permitted by law:

• we exclude all warranties, terms and conditions implied by law in relation to the Service, which is provided as it is;
• we are not liable for any indirect or consequential loss, or for loss of profits, business, data, goodwill or anticipated savings, however arising;
• our total liability to you for everything arising under or in connection with these terms will not exceed the greater of the amount you have paid us in the twelve months before the claim and £1,000.

If any part of these terms is held to be invalid or unenforceable, the rest remain in force.

You can delete your account at any time from your profile. Doing so deletes your lists and tasks, your memberships of other people's lists, your People, your reminders and your assistant connections. It cannot be undone, and we cannot recover it for you afterwards.

We may close an account that has broken these terms, or stop offering the Service altogether, in which case we will give you reasonable notice and a chance to take your data with you where we can.

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any claim arising under them. If you are a consumer resident elsewhere, you keep the benefit of any mandatory provisions of your own local law.

Questions about these terms: support@apricot.so.

Crebo Ltd is the data controller for the personal data held in Apricot. Our registered office is 66 Paul Street, London, EC2A 4NA. For anything to do with data protection, email privacy@apricot.so.

We are not required to appoint a statutory Data Protection Officer and have not appointed one. Responsibility for data protection sits with the directors.

Contract

Processing necessary to provide the Service to you: your account, your lists, the people you share with, and the reminders you ask for.

Legitimate interests

Keeping Apricot running, secure and free of abuse, and answering you when you get in touch.

Consent

Anything we would not otherwise be entitled to send you. You can withdraw consent at any time.

Legal obligation

Processing necessary in order to comply with the law.

Under the UK GDPR you have the right to:

Access

Be told whether we hold personal data about you, and receive a copy.

Rectification

Have inaccurate or incomplete personal data corrected.

Erasure

Have your personal data deleted, where that right applies.

Restriction

Have us stop using your personal data while a question about it is resolved.

Portability

Receive the personal data you gave us in a structured, commonly used, machine-readable format.

Objection

Object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.

Withdrawing consent

Withdraw consent where we rely on it, without affecting anything done lawfully beforehand.

To exercise any of these, email privacy@apricot.so. We may ask you to confirm your identity first - that is what stops us handing your data to someone who is not you. We will respond within one month, which we may extend by up to two further months if the request is complex, and we will tell you if we do.

Much of this you can do yourself: your name and reminder schedule are editable in your profile, tasks and lists can be edited or deleted at any time, and deleting your account erases the lot.

We do not make decisions about you by automated means, and we do not profile you.

Your account and content

Until you delete your account. Deletion takes your lists, tasks, memberships, People and reminder settings with it.

Archived tasks

Deleted for good 30 days after you archive them, whether or not you delete your account first.

Sign-in codes

Minutes. A code expires shortly after it is sent, is single-use, and is deleted once used.

Records of reminder emails

A record that a digest was sent, and how many tasks it held, kept while your account exists.

Server logs

Held by our hosting provider for a short period, as they are for every website.

Correspondence

Two years from our last contact with you, unless it relates to a legal or accounting record we must keep for longer.

Apricot's database is hosted in London. Our hosting and email providers are based in the United States and operate infrastructure in the United States and Europe, so some personal data is transferred outside the United Kingdom.

Where personal data goes to a country not covered by a UK adequacy decision, the transfer is protected by the International Data Transfer Agreement, or by the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional measures the transfer requires.

If you are unhappy with how we have handled your personal data, please tell us first at privacy@apricot.so and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. If you are in the European Economic Area, you may complain to your own supervisory authority instead.

Your identity

Your name and email address. The email address is how you sign in; the name is what other people on a shared list see.

Your content

The lists you make and the tasks in them: titles, notes, due dates, who a task is assigned to, and whether it is done or archived.

Who you share with

The people you invite or are invited by, and which of your lists they are on.

Your settings

Whether reminder emails are on, and the time, day and timezone you chose for them.

Connected assistants

Which assistants you have connected, what you allowed them to do, and when.

Technical records

Your IP address, browser and device type, and which pages you requested and when - recorded automatically in our hosting provider's logs, as they are for every website, and counted in aggregate so we can see which pages get used.

We do not collect special category data, and we do not ask for payment details: there is nothing to pay during beta. We do not knowingly collect data about children.

Running your account and lists

Contract.

Sending sign-in codes

Contract: it is how you get in.

Sending reminder emails

Contract, at the schedule you set. Turn them off in your profile at any time.

Telling someone a list has been shared with them, or a task assigned to them

Contract, and our legitimate interest in the person knowing.

Keeping Apricot available and secure

Legitimate interests: keeping the Service running and protecting it from abuse.

Answering you when you write to us

Legitimate interests.

Meeting our legal obligations

Legal obligation.

If we ever want to use your personal data for something not on this list, we will tell you first and, where the law requires it, ask your consent.

We do not sell your personal data and we do not share it for advertising. Apricot carries no advertising technology, and the only measurement we do is a cookieless count of page views, described under Cookies below. We use a small number of providers, who process personal data on our instructions and may not use it for their own purposes:

Hosting

Runs the application, serves it to your browser, and counts page views for us without cookies. Infrastructure in the United States and Europe.

Database hosting

Stores your account, your lists and your tasks. Hosted in London.

Email delivery

Sends our email on our behalf: sign-in codes, invitations, assignment notices and reminders. Based in the United States.

We will tell you who these providers are if you ask: email privacy@apricot.so.

Assistants you connect are different. If you connect Claude, ChatGPT or another assistant, the tasks it reads and writes go to that provider at your instruction, under your own agreement with them. We are not responsible for what they do with it, and you can revoke access from your profile at any time.

People you share a list with see its contents, and see your name and email address.

We may also disclose personal data where we are under a duty to do so in order to comply with a legal obligation; to enforce our agreements or investigate a suspected breach; to protect the rights, property or safety of Crebo Ltd, our users or others; or in connection with a sale or reorganisation of our business, in which case the buyer is bound by this notice and we will tell you beforehand.

• data in transit is encrypted using TLS;
• data at rest is encrypted by our providers;
• there are no passwords to steal: sign-in is by one-time code, and codes are single-use and short-lived;
• every request for your data is checked against your own account, so one person cannot read another's lists;
• access to our systems is limited to the people who need it.

Sending information over the internet is never completely secure. We will do our best to protect your personal data, but we cannot guarantee the security of anything you send us.

Email privacy@apricot.so with “Subject access request” in the subject line, or write to us at Crebo Ltd, 66 Paul Street, London, EC2A 4NA. There is normally no charge. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why.

European Economic Area and Switzerland. Your rights under the EU GDPR are equivalent to those set out above, and you may complain to your own supervisory authority.

United States. We do not sell or share personal information, as those terms are used in the California Consumer Privacy Act, and we do not use it for cross-context behavioural advertising. If your state has a comprehensive privacy law, you may have the right to know what we hold, to have it deleted or corrected, and not to be treated differently for exercising those rights. Email privacy@apricot.so and we will handle your request under the law that applies to you.

Apricot sets one cookie, and only once you sign in. It keeps two small preferences in your browser. It counts page views without cookies. It carries no advertising technology of any kind, and nothing here follows you to another site - which is why there is no cookie banner to dismiss.

Session cookie

Set when you sign in, so that the next page knows it is you. It is HttpOnly, so no script on the page can read it, SameSite=Lax, so it is not sent when another site links to us, and Secure. Strictly necessary: without it you cannot stay signed in. Cleared when you sign out.

apricot:density

Whether you chose tight or roomy task rows. Kept in your browser's local storage. Never leaves your device.

apricot:assign-email

Whether assigning a task should email the person. Kept in your browser's local storage. Never leaves your device.

Our typefaces are served from Apricot itself rather than from a font provider, so viewing a page makes no request to any third party.

We count which pages are opened and how often. Our hosting provider does the counting on our behalf: it sets no cookies and stores nothing on your device, it does not follow you to any other site, and it does not build a profile of you.

Your browser lets you see stored cookies and site data, delete them, and block them for particular sites. Those settings are usually under privacy or site settings. Blocking them for Apricot will stop you signing in, and will make the two preferences above forget themselves. Nothing else depends on them.

Questions about any of this: privacy@apricot.so.