Are there any free, private, and secure collaborative to-do list applications?

I’m looking for a to-do list application that allows for collaboration between multiple users. I prefer something cross-platform, but at the very least it has to work on Android. When searching for some options, I’ve only heard of proprietary apps like Todoist which aren’t secure as they don’t support E2EE.

Are there any free (both libre and gratis), secure, privacy-respecting to-do list applications that support collaboration and is available on Android?

I looked over all options mentioned on r/PrivacyGuides, AlternativeTo, and ProductivePrivacy, but I couldn’t find a single option which meets my criteria. (FLOSS, free to use or at least very cheap, supports collaboration, E2EE, decent privacy policy, available on Android)

I do plan on eventually buying a home server in the future because it seems necessary to self-host at least some services if you value freedom and privacy. From what I can tell, many privacy-respecting FLOSS services/applications are either not available in the cloud or are prohibitively expensive as they add up. But until I can get a server, it looks like I’m stuck using Todoist or some other proprietary or potentially privacy-invasive alternative.

I could try reading the privacy policies of the options I do have, but honestly they are so long and complicated and I don’t really have the time to read through dozens of privacy policies just to weed out the “best” application from a bunch of bad options. I did find that PrivacySpy has entries on some to-do applications such as Todoist and TickTick. But they are outdated and I’m not sure if PrivacySpy is trustworthy to begin with.

It’d be awesome if anyone else knows of an alternative I might’ve missed or has some insight on which of the seemingly bad options are best.

Privacy Spy is bad and also it has same criteria on each app/service

Would you care to elaborate?

I’m not sure if that makes it bad, but I guess it depends. If it’s mainly about data collection, storage, and sharing, I don’t see why it’d have to apply different standards for different things. Do you have any examples of why their criteria is misleading or ineffective when it comes to evaluating certain services?