How to choose a private to-do list app

A private to-do list app stores your tasks on your device by default, works without an account, and tells you plainly when anything leaves your phone. Very few apps meet all three conditions, and the App Store listing alone will not tell you which ones do.

Here is the thing most people never think about. Read your own task list back as if it belonged to a stranger. Book the specialist for Thursday. Call the solicitor about the flat. Cancel the gym before the renewal. Buy something for Dad before the sixth. Ask about the redundancy terms.

That list knows you are ill, moving, broke, and quietly leaving your job. It is one of the most revealing documents you will produce this year, and most of us hand it to a server because the first screen asked for an email address and there was no obvious way past it.

This guide covers four checks that take about ten minutes in total, and what each one actually tells you.

Why almost every app asks for an account

Requiring an account is rarely about your convenience. It solves three problems for the company at once.

It makes sync trivial, because the server is the source of truth and every device is a thin client. It produces retention metrics that investors ask for. And it converts an anonymous install into a contactable person who can be emailed later.

None of that is sinister. The problem is what the account becomes: a permanent hinge that every future decision swings on.

Once your tasks sit on a server keyed to your identity, you are exposed to decisions nobody has made yet. A new analytics vendor. A pivot into advertising. An acquisition by a company with different values. A breach at a subprocessor you have never heard of. You cannot evaluate those risks in advance, because they do not exist yet.

An app that never collected the data cannot lose it, sell it, or be compelled to hand it over.

The four checks that actually matter

Run these in order. The first eliminates most candidates in about thirty seconds, which is worth knowing before you invest an evening in migrating your lists.

Check one: can you reach the main screen without signing up?

Install the app and see how far you get. Try to add one task.

If a sign-up wall blocks you, the app is built around a server and the local experience is a cache. That is not necessarily disqualifying, but you now know the architecture, and everything else you read should be interpreted in that light.

Watch for the softer version too. Some apps let you in, then degrade steadily until signing up is the only way to stop being nagged. If the third dialog in ten minutes is asking you to create an account, the answer is the same.

Check two: does the privacy label match the marketing?

Scroll to App Privacy on any App Store listing. Apple requires developers to declare what they collect and whether it is tied to your identity, and the categories are specific enough to be useful.

What you are looking for is a mismatch: a listing that talks warmly about privacy sitting above a label that declares Identifiers or Usage Data linked to you. The label is the enforceable claim. The marketing copy is not.

One caveat worth holding onto. The label is self-declared. It is a statement the developer is accountable for rather than an audit Apple performed, so treat it as a strong signal and not as proof.

Check three: what happens with the network off?

This is the check nobody runs, and it is the most revealing of the four. Turn on Airplane Mode and use the app properly for five minutes. Add a task. Edit one. Complete one. Force quit and reopen.

If everything behaves exactly as it did online, your data genuinely lives on the device and the server is an optional extra. If you hit spinners, empty states, or an error banner, the server is the source of truth and your phone is a window onto it.

This has a practical payoff beyond privacy. Local-first apps work on the Tube, on a plane, in a lift, and in the dead zone behind your office. Server-first apps do not, and you always discover which kind you have at the worst possible moment.

Check four: is there a plain answer about AI?

Voice capture and natural language parsing are now standard, and they are the single most common route for your content to leave your phone. They are also the least examined, because they feel like a feature rather than a transfer.

A trustworthy app tells you which stages run locally, which do not, and what gets sent when they do not. A vague claim that something is powered by AI, with no mention of where it runs, almost always means a third-party API.

We wrote a longer piece on how to test this yourself, including what a single dictated sentence is actually broken into behind the scenes.

What sync really costs, and when to pay it

Local-first does not have to mean one device. The real question is who holds the keys.

The middle row is the one people underrate. Syncing through your own iCloud account gives you multiple devices and shared lists without introducing a new company into the arrangement. The developer is not a party to it and cannot read the contents.

If you need a shared shopping list with a partner or a chore rota with the household, that model gives you collaboration without handing your personal library to anyone.

The honest trade-offs of going local-first

Any guide that presents this as free is selling you something. Local-first costs you real things.

• Backups become your job. If your phone goes in a river and your backup is stale, nobody has a copy to restore.
• Web access usually disappears. There is no server, so there is no dashboard to open on a work laptop.
• Cross-platform support is narrower. Apps built on iCloud sync do not generally reach Android or Windows.
• Recovery is harder. There is no support team who can look up your account and undo something.

For a lot of people those costs are worth it, because the thing being protected is a detailed record of their private life. For someone who genuinely needs a shared web dashboard across three operating systems, they may not be. Both answers are defensible. Deciding without knowing the trade is the only bad option.

How Clarity handles this

We built Clarity around the four checks above, so it is only fair to answer them directly.

There is no account and no login screen. Your personal library is stored on your iPhone. There is no advertising, no analytics SDK, and no cross-app tracking, which is why the app has nothing to show you on a launch screen except your day.

Voice capture runs entirely on device on supported Apple Intelligence iPhones. When a stage is not available locally, Clarity says so and uses a disclosed fallback for that stage alone, only for a voice action you started, and never in the background.

Shared family spaces are opt-in and travel through your own iCloud account using CloudKit, so shared work stays inside Apple's infrastructure rather than ours. We cannot read it, which is the point.

A ten minute checklist

1. Install and try to add one task. If a wall stops you, note it and move on.
2. Read the App Privacy label and hold it against the listing copy.
3. Use the app in Airplane Mode for five minutes, including a force quit and reopen.
4. Find the app's own explanation of where its AI features run.
5. Work out whether sync uses the developer's server or your iCloud account.
6. Decide what your backup plan is before you migrate anything.

Ten minutes now is a reasonable price for something that will hold the private details of your life for the next few years.