Regarding Todoist for Outlook
I would like to understand the security details when Todoist for Outlook is installed.
- Does Todoist have access to all my emails in Outlook?
- Does Todoist send my email to its servers when I add it as a task?
- If my Todoist account is hacked, will the person be able to view the email attached to the task?
Each time you select or open a message in Outlook, it remembers (notices) the unique ID of this message so that if you use any Outlook keyboard shortcut, the action will be performed on the message with the currently "active" ID.
The way our plugin works is that it also looks for what ID Outlook is currently memorizing and if you click on the "Add email as task" link, this ID is being added as a link that Outlook can understand.
Therefore, Todoist has no direct knowledge of the content of the message at any time. Only the message subject is known as it's used to create the linked text in your task. The message itself is never sent to any server.
There's a different Premium-only feature allowing you to send an email to a Project in which case the full email would be stored as a task note, but the feature you're referring to doesn't transfer any content of the message at all.
In case someone would have access to your Todoist account, they would see your task list just as you can which means they would see the link (subject) to the message, but clicking on it would have no effect. In fact, if you access your account through our web interface at todoist.com and try to click on a link to the particular email - nothing will happen because the task is just a link to the unique email and can be opened only in Outlook.
When you click the link in Outlook, our plugin tells Outlook to open the message (stored locally on your computer) with the particular ID from the link. If someone would try this in their Outlook most likely nothing will happen as they may not have a message with the exact same ID and even if by coincidence they would - then their own message with this ID would open.
So again - using this feature does not transfer or store any content of your email message only points a link to an ID which will only work as long as you have this message in Outlook.