diff --git a/TODO b/TODO
deleted file mode 100644
index a743013..0000000
--- a/TODO
+++ /dev/null
@@ -1,24 +0,0 @@
-  The good news — no Google verification required for the scopes we use (openid email profile). Verification is only mandatory for sensitive scopes
-  like Gmail or Drive access. Basic OIDC login is exempt.
-
-  What you DO need for production:
-
-  1. Publish the app (remove testing restriction)
-  - Google Auth Platform → Audience → change from Testing to Production
-  - Right now only manually added test users can log in — publishing removes that limit
-
-  2. Add production URIs to the OAuth client
-  - Authorized JavaScript origins: add https://yourdomain.com and https://api.yourdomain.com
-  - Authorized redirect URIs: add https://api.yourdomain.com/api/auth/google/callback
-
-  3. Update production .env
-  GOOGLE_CALLBACK_URL=https://api.yourdomain.com/api/auth/google/callback
-  FRONTEND_URL=https://yourdomain.com
-
-  4. HTTPS is required — Google won't allow http:// redirect URIs in production (localhost is the only exception). Your production server needs SSL,
-  which you likely already have via Nginx.
-
-  5. Add Privacy Policy URL to the branding page — Google requires it when the app is published (even without verification). A simple /privacy page on
-  your frontend is enough.
-
-  That's the full checklist. The localhost dev setup stays untouched alongside the production URIs — Google allows multiple redirect URIs per client.
\ No newline at end of file