Choosing task software · 11 November 2026
How to choose a to-do app for sensitive client work
By Qubit
Start with what client information you need to put in the task, then check where that information is stored, synchronized, processed and shared. “Local,” “encrypted” and “AI-powered” each describe only part of that path. None replaces checking the product's actual disclosures and your permitted use of client information.
Freelancers, agency owners and teams, fractional CXOs, consultants, and client-facing roles like account managers may need a reliable reminder without copying the whole client conversation into another product. A task can contain much less information than its source.
This guide uses official disclosures checked on 11 November 2026. It is a selection worksheet, not a security audit or a determination that a product meets your client's requirements.
Begin with a task, not a privacy label
Consider this fictional draft task:
“Send Client A's revised outline by Thursday. The confidential launch is delayed because [internal explanation].” It also includes a pasted email thread and a draft attachment.
The action and agreed date may be enough to tell you what to do. The explanation, thread and attachment create additional copies of client context. Before choosing the app, decide which fields are necessary in the task and which can remain in the permitted source system.
| Field in the proposed task | Needed to take the next action? | A smaller version to consider |
|---|---|---|
| Action | Yes | “Send revised outline” |
| Client identifier | Enough to distinguish the work | A permitted project label, without unnecessary detail |
| Agreed delivery date | Yes, if there is a commitment | Thursday, with the relevant time if needed |
| Internal reason for the change | Not necessarily | Leave it in the approved source record unless needed here |
| Full email thread | Not necessarily | Refer back to the original, if a reference is permitted and useful |
| Draft attachment | Not necessarily | Keep the working file in its approved home |
Removing detail does not automatically make a task acceptable to store elsewhere. A client name, project label or link can itself be sensitive. The exercise identifies what needs checking; it does not override the boundary.
Follow four separate data paths
Storage: Where is the saved task or source context held? A primary copy on a device and a copy on a vendor's server are different arrangements.
Synchronization: What is copied so the task appears on another device? Working offline does not establish that cloud synchronization is absent.
Model processing: Does using a feature send task text, source context or audio to another provider? A local database can coexist with cloud transcription or model calls.
Sharing and access: Who can see the task, its source context, attachments or generated result? Check actual account, project and sharing controls rather than the name of a view.
Ask about retention and deletion for the paths you intend to use. If a disclosure answers storage but not processing, leave processing unresolved rather than inferring an answer.
Three documented examples of why the distinction matters
Things documents that you can use it on one device without Things Cloud if you do not need synchronization. Using it across devices requires its cloud service. It describes encryption in transit and at rest for that service. Those statements answer specific sync and storage questions; they should not be expanded into an end-to-end encryption claim. Things Cloud documentation.
Google says Tasks stores created tasks in its data centers, encrypts data in transit and at rest, and stores information on your device if you access it offline. The offline copy does not change the documented server-storage arrangement. Work or school use also has separate Workspace resources to consult. Google Tasks privacy documentation.
Qubit's policy distinguishes its Mac and web products. Mac work memory is held in an encrypted local database, while some context and audio go to service providers for model processing or transcription. The web app stores connected-account data on Qubit's servers. A Mac storage statement must not be applied to the web product, or treated as a statement that processing stays on the Mac. Qubit privacy policy.
These examples illustrate different disclosed paths. They are not a ranking of which app is safest, and they do not establish suitability for a particular client's information.
Record a decision for each field
For the fictional outline task, suppose the action and date can be kept in your chosen app, but the email thread and attachment must remain in the client's system. The resulting record could look like this:
| Field | Proposed destination | Evidence or permission still needed | Decision |
|---|---|---|---|
| “Send revised outline” and Thursday | Chosen task app | Storage, sync, processing and access for that feature are understood; permitted use is confirmed | Keep if confirmed |
| Client label | Same task | Check whether the label itself is permitted outside the source system | Verify before adding |
| Internal explanation and email thread | Client system | No need to duplicate it to remember the next action | Omit from task |
| Draft attachment | Approved file location | Confirm access there; do not upload merely for convenience | Keep in its existing home |
For an app you are considering, add a vendor-document link and check date beside each answer. If a processing path remains unknown, use a harmless example while you obtain an answer, rather than putting the sensitive material through the feature to find out.
For example, here is how far the cited Google Tasks privacy document gets the reduced task “Send revised outline Thursday.” These are different questions, so a known storage answer does not fill the remaining cells.
| Data path for the reduced task | Answer supported by that document | Consequence for this selection |
|---|---|---|
| Saved task | Stored in Google's data centers, encrypted in transit and at rest | Treat the action and date as information placed with that service. |
| Other-device or offline use | Account information supports access across devices; offline access can store information on the device | Include both service and device copies in the decision. |
| AI feature added to the workflow | This document alone does not settle the selected feature's model-processing path | Check that feature's disclosures before supplying sensitive context. |
| Access in the intended work account | The document points work and school users to Workspace resources | Verify the intended account's requirements rather than assuming the personal-account arrangement applies. |
The filled outcome is deliberately incomplete: storage and device-copy questions have evidence, while the selected feature and work-account questions still require an answer. Until those are resolved, leave the confidential explanation and attachment in their approved home. Do not turn this example into an endorsement for sensitive client data.
Choose the workflow you can explain
Before moving real client tasks, you should be able to finish these sentences:
The task needs these fields:
The information I will leave in its existing system is:
The task is stored and synchronized through:
The feature sends this information for processing:
These people or connected services can access it:
The unresolved question and source to check are:
My decision is keep, reduce, verify, or choose another workflow because:
An unanswered requirement can be a good reason to keep an existing permitted workflow. Fewer apps are convenient, but convenience does not settle where client information belongs.
Applying this to Qubit
Qubit is a to-do list that auto-updates, instead of you updating it. It updates from your calls, Gmail and Slack. For everything else, just tell it. That supported-source workflow makes the data-path check relevant before connecting or capturing work. Read the privacy policy and trust explanation for the product surface you intend to use, then decide what work belongs there.