Move from Todoist to a Private Task App in 2026

Moving from Todoist to a private task app is not a one-click privacy upgrade. Todoist can export useful project data, but the export is plaintext once it lands on your computer. The private destination then has to preserve the parts of the system you actually need, not just accept a CSV file.

Use this 2026 migration checklist before you move real tasks:

1. Export one active Todoist project as CSV first, not your whole system.
2. If you have a paid Todoist plan, download a backup ZIP for active projects before changing anything.
3. Decide whether completed-task history matters; Todoist backups exclude completed tasks and archived projects.
4. Keep every CSV and ZIP off email threads, shared drives, and chat attachments while you test.
5. Inspect task names, descriptions, dates, comments, attachment links, assignees, priorities, and sections locally.
6. Verify the destination's current import support before assuming it can read Todoist's columns.
7. Test 10 to 20 representative tasks, including subtasks, dated tasks, comments, and attachment links.
8. Manually re-enter sensitive current tasks if the private app has no supported Todoist importer.
9. Keep Todoist open until counts, dates, reminders, and priority work survive at least one review cycle.
10. Delete temporary exports only after the destination is verified, and remember normal deletion is not a forensic secure-erase guarantee.

Direct answer

Todoist gives you two practical export routes: project CSV export from the project menu, and paid-plan backup ZIP files containing CSV files for active projects. Those files help you migrate, but they are not automatically private. Before moving to a private task app, treat every export as readable task content, verify what the destination can import today, and avoid claiming a one-click transfer when the destination only supports manual entry or an API.

Facts checked and method

Facts were checked on October 12, 2026 against current official Todoist Help, Todoist Security, Todoist developer documentation, the Zero-Friction Tasks download page, the Zero-Friction encrypted task manager page, the Zero-Friction data protection page, and the Zero-Friction public API documentation.

The migration criteria were:

1. Can Todoist export the data the user wants to preserve?
2. Does the export include active tasks, completed tasks, archived projects, comments, attachment links, dates, and recurring dates?
3. Does the destination document a Todoist importer, a generic CSV importer, manual entry, or only an API?
4. Does the migration reduce privacy exposure, or does it create a new plaintext file leak?
5. Can the user verify counts and fields before closing Todoist?

For adjacent context, read Todoist vs Zero-Friction Tasks for Private Capture, Private Task App Data Portability, and Best Private and Local-First Task Apps in 2026.

What Todoist actually exports

Todoist's official CSV export is project-based. The Help Center says to log in at Todoist, open an existing project, open the three-dot project menu, choose Manage data, and select Export as CSV. Todoist describes the resulting CSV as an exact duplicate of the original project, including task, section, and project descriptions, dates, time, comments, attachments, and more.

That is good enough for a controlled migration test. It is not the same as a universal account export.

Todoist's paid-plan backup feature is broader because it creates ZIP files with CSV files for active projects. Todoist says backups are created on active-change days, up to 21 backups are stored, and each backup includes active projects and tasks, dates and time, descriptions, task duration, deadlines, recurring dates excluding start dates, up to 500 comments per task, and links to file attachments. The same page states the important limitation: completed tasks and archived projects are not included in backups.

If completed-task history matters, Todoist's Export to Google Sheets extension is a separate path. Todoist says that extension can export active and completed tasks, including due dates, priority, creation date, description, section, and assignee. It also has its own limitations: large projects can time out, and active recurring tasks are treated as uncompleted until completed forever.

The practical rule: export the smallest useful set first. A single active project CSV is easier to inspect than a pile of ZIP files and spreadsheets.

The privacy risk is the export file

A migration export is usually less private than either app.

Inside Todoist, your tasks are protected by Todoist's account, access controls, TLS in transit, and encryption at rest. Todoist's security page says project names, task names, comments, uploaded files, account information, and payment information are sent over TLS 1.2 and 1.3, and that projects, tasks, comments, account information, and payment information are stored encrypted at rest.

Once you download a CSV, the task text is readable by whatever can read that file. The file may include task titles, descriptions, dates, comments, attachment links, section names, assignee names, priorities, and project descriptions. If you email it to yourself, upload it to a shared drive, paste it into a chat, or hand it to an untrusted converter, the migration has expanded your privacy surface before the private task app even starts.

Treat exports like sensitive documents:

• download them on a trusted device
• store them in a local encrypted disk or another protected local location while testing
• do not share them by email or team chat
• do not use a random web converter for private tasks
• keep one untouched original export until verification is complete
• remove temporary copies after the migration, without pretending normal deletion is guaranteed secure erasure

That last point matters. Secure deletion depends on operating system, filesystem, backups, cloud sync, snapshots, and device storage behavior. The safer wording is: remove temporary copies from normal working locations after verification, and avoid creating unnecessary copies in the first place.

Field-by-field migration map

The table shows why migration should be boring and explicit. If the private destination cannot represent a Todoist field, do not hide that loss. Decide whether the field is worth preserving.

Verify the destination before you migrate

A private task app is not automatically a Todoist importer. Privacy and import compatibility are separate questions.

For Zero-Friction Tasks, I did not verify a current public Todoist CSV importer. The public API documentation covers tasks, lists, reminders, pagination, soft deletes, and sync-code authentication through the X-Sync-Code header. It does not document a bulk Todoist import endpoint. That means a careful migration should not promise one-click Todoist transfer into Zero-Friction.

What Zero-Friction does document is a smaller private workflow. The download page lists iPhone, iPad, Android, Windows 10/11, macOS Apple Silicon, and Web. It says the Web App needs no download, install, or signup. It also says all apps sync via a single sync code, and that the free tier includes sync, encryption, iOS widgets, Windows hotkey capture, and API access.

The encryption pages state the more important privacy boundary: the sync code is generated on the device, a key is derived locally, task content is encrypted before upload, and the server stores ciphertext without the key. They also state the recovery trade-off: if the sync code and every trusted device are lost, the encrypted server copy cannot be recovered.

So the honest migration claim is narrow: Zero-Friction can be a private destination for current personal tasks, especially first-mile capture. It is not currently documented as a drop-in Todoist archive importer.

A practical Todoist-to-private workflow

Start with one active project, not the whole account.

1. Pick a project that represents your real task mix: a few plain tasks, a few dated tasks, one or two subtasks, a comment, and an attachment link.
2. Export that project as CSV from Todoist's Manage data menu.
3. Save an untouched original copy locally.
4. Open a working copy in a spreadsheet or text editor while offline or on a trusted device.
5. Count active tasks, sections, dated tasks, comments, and attachment links.
6. Decide what belongs in the private destination: current tasks, not necessarily every historical comment.
7. Re-enter the first 10 to 20 tasks manually, or use the destination's documented importer if it has one.
8. If using an API script, create only the fields the API officially supports and keep the script local.
9. Compare counts and examples against the original CSV.
10. Run one normal review before deleting the Todoist project or closing the account.

This sounds slow because it removes fantasy from the process. The expensive mistake is not spending 20 minutes on a test. The expensive mistake is moving 800 tasks, discovering that recurring dates or comments changed meaning, and then no longer trusting either system.

What to move, what to leave behind

Most Todoist accounts contain three different kinds of data.

The first is current commitments: active next actions, deadlines, reminders, and waiting-for items. Move these carefully. They are the reason the task system exists.

The second is reference clutter: old comments, stale links, abandoned project sections, duplicated labels, and tasks that survived because deleting them felt uncomfortable. Do not give this clutter a private encrypted home just because it exists.

The third is history: completed tasks, archived projects, reporting, and proof that something happened. If that history matters for client work, compliance, tax, or personal records, archive it deliberately outside the task app. Todoist backups are not a complete history because completed tasks and archived projects are excluded. The Google Sheets export path can include completed tasks, but it creates another spreadsheet surface and depends on Google access.

A private migration is a good time to reduce the system. Move the active commitments. Archive evidence separately. Delete or ignore the museum.

When manual re-entry is better than import

Manual re-entry sounds primitive. For privacy migration, it can be the safer option.

If a task is sensitive, current, and short, typing it again into a private app may be better than feeding a full CSV through an importer. Manual entry limits the amount of historical data copied forward. It also forces review: do you still need this task, or is it just old Todoist sediment?

Use manual re-entry when:

• the destination has no documented Todoist importer
• the task text is sensitive and current
• comments and attachments are not needed
• the project contains stale labels or sections
• recurring dates need human judgment
• the task belongs in a private inbox, not a project archive

Use import only when the destination supports it, the fields are mapped, and a small test proves the result is useful.

Who Zero-Friction is for, and who it is not for

Zero-Friction Tasks is for Todoist users whose main privacy problem is first-mile capture. It fits the person who wants to save a private task quickly, use it before creating an email account, sync across personal devices with a private code, and keep task content encrypted before it reaches the server.

It is also for users who want to leave Todoist's planning surface without rebuilding Todoist. The product is strongest when the task is still a private sentence: call the doctor, follow up with a client, rotate a key, check an invoice, pick up a family errand, or capture a thought from Windows, iPhone, Android, macOS, iPad, or the web.

Zero-Friction is not for teams that need assignments, comments, shared boards, workspace roles, manager reporting, SSO, SCIM, legal hold, mailbox retention, or Todoist Business-style collaboration. It is also not the best place to preserve a complete Todoist archive with every comment, completed task, attachment trail, and historical project structure. If the goal is archive fidelity, build an archive. If the goal is private current capture, move only what still matters.

The 2026 migration rule

Do not ask, "Can I export Todoist?" Yes, for useful parts of the system. Ask the better sequence:

1. Which tasks are still active?
2. Which historical records need to be kept outside the task app?
3. Which fields does the destination officially support?
4. Where will the plaintext export live during the test?
5. How will I verify counts, dates, comments, and attachment links?
6. What will I do if the importer does not exist or loses meaning?
7. When is it safe to stop using Todoist?

Privacy migration is not a race away from one vendor. It is a controlled handoff from a broad cloud planner into a smaller system that fits the job. Move the current work. Protect the export. Test the destination. Keep the old account until the new list is boring enough to trust.

Download Zero-Friction Tasks if you want private no-account capture with optional encrypted sync across iPhone, Android, Windows, macOS, iPad, and Web.

Official sources checked

• Todoist Help: Import or export a project as a CSV file in Todoist, Download or restore backups in Todoist, Use Todoist while offline, and Export to Google Sheets extension.
• Todoist: Security Policy and developer API documentation.
• Zero-Friction Tasks: download page, encrypted task manager, data protection, and public API documentation.