We follow Microsoft's privacy statement found here: https://privacy.microsoft.com/en-us/privacystatement
The data that tdi accesses is stored in the main Microsoft Graph database that underpins the Microsoft-maintained clients - e.g., To Dos app.
However, this command line application includes no telemetry, and does not track any usage. The application does store locally on your machine a couple cache files - for the purpose of mapping the very long hash ID, to a numeric value used to interact with your data as input.