Privacy Policy

Last updated: March 9, 2026

Introduction

Welcome to Do. ("we", "our", or "us"). Do. is an independent, individually-operated application. We are committed to protecting your privacy and being transparent about how your data is handled. This Privacy Policy explains what information we collect, how we use it, and your rights — depending on the mode you use.

Do. works in two modes which affect what data we collect. Without an account, your task data never leaves your device. With an account (even in local-only mode), some account information is stored server-side so we can identify you and restore your account. Your tasks and notes always stay local unless you explicitly enable Cloud Sync. The sections below marked with ☁️ apply to users with an account.

Modes of Operation

No Account (fully local)

All your tasks, projects, and notes are stored exclusively on your device (IndexedDB). We have no access to this data. Only anonymous analytics are collected (can be disabled). If you uninstall the app or clear your browser data, this data is permanently deleted.

☁️ With an Account — Local-Only Sync

You can create an account but keep your tasks local. In this mode, your task data stays on your device, but your account record, profile, settings, and preferences are stored on our servers so your account can be identified and restored. Push notification tokens are also sent to our servers if you enable notifications.

☁️ With an Account — Cloud Sync enabled

When you enable Cloud Sync, your tasks, projects, notes, and tags are also synced to our cloud database, allowing access across multiple devices.

Information We Collect

From all users (including no-account users)

  • Anonymous feature usage events (e.g. task created, view changed) via PostHog — no personal content, can be disabled in Settings
  • Anonymous session replays via PostHog — typed form inputs (passwords, text fields) are masked; other visible UI content (e.g. task names) may be captured to help diagnose bugs
  • Device type and OS version (for compatibility purposes)
  • Crash reports and error logs (no personal content included)

☁️ From users with an account (even in local-only sync mode)

  • Email address (used to identify and restore your account)
  • Account status and tier (local or cloud sync)
  • App settings and preferences (e.g. theme, AI mode, view preferences)
  • Profile information you optionally provide (display name, work style, personality type)
  • Push notification tokens — if you enable notifications on a mobile device, a device token is sent to our servers to deliver notifications
  • Messages you send to our support email

☁️ Additionally from users with Cloud Sync enabled

The following is stored solely to sync it back to your own devices — we do not read, analyze, or use this content for any other purpose.

  • Tasks, projects, notes, and tags you create
  • Due dates, priorities, and completion status of tasks

We do not collect payment information, location data, contacts, or camera/microphone access.

How We Use Your Information

We use the information we collect only to:

  • Provide and maintain the app and sync your data across your devices
  • Send push notifications you have opted into
  • Respond to support requests you initiate
  • Understand how the app is used so we can improve it (analytics)
  • Diagnose and fix technical problems (crash reports)
  • Comply with legal obligations

We do not use your data for advertising, and we do not sell your data to anyone.

AI Features and Your Data

BYOK — Bring Your Own Key

When you use AI features with your own API key (OpenAI, Anthropic, or Google Gemini), your task data is sent directly from your device to that AI provider under your own account. We never see or store those requests. The AI provider's own privacy policy applies.

☁️ Cloud AI (Do.'s built-in AI)

When you use Do.'s built-in AI without your own key, your task content is sent to our server (a Supabase Edge Function), which then calls an AI provider on your behalf. This content is used solely to generate a response and is not logged, stored, or used to train any AI model.

☁️ Data Storage and Security

Cloud account data is stored in Supabase (hosted on AWS). Supabase uses row-level security so your data is only accessible to your own account. Data is encrypted in transit (TLS) and at rest.

We retain your cloud data for as long as your account is active. If you delete your account, your data is permanently deleted within 30 days. Local-only data is entirely under your control and is deleted when you clear your app/browser data.

Third-Party Services We Use

We use the following third-party services. Each has their own privacy policy:

  • Supabase — database, authentication, and edge functions (cloud accounts only)
  • PostHog — anonymous usage analytics and session replays (form inputs masked; other UI content may be visible; can be disabled in Settings; respects Do Not Track)
  • OpenAI / Anthropic / Google — AI processing (only when you use AI features)
  • Cloudflare — CAPTCHA on sign-up to prevent spam accounts
  • Apple / Google — push notification delivery (if you enable notifications)

We do not share your data with any other third parties.

Your Rights and Choices

Regardless of where you live, you can:

  • Access your data — export all your tasks from the app at any time
  • Correct your data — edit anything directly in the app
  • Delete your data — delete your account and all cloud data from Profile settings
  • Opt out of analytics — disable PostHog tracking in Settings
  • Use the app without an account — Local-Only mode requires no data sharing at all

If you are in the European Union (EU/EEA), you also have rights under GDPR including the right to data portability and to lodge a complaint with your local data protection authority. Our legal basis for processing cloud account data is the performance of our service contract with you (Art. 6(1)(b) GDPR). Analytics are based on legitimate interest (Art. 6(1)(f) GDPR) and can be opted out at any time.

If you are a California resident, you have rights under CCPA including the right to know what data we collect, the right to delete it, and the right to opt out of sale (we do not sell data).

Cookies and Tracking

We use essential cookies and local storage for authentication session management (cloud accounts). PostHog analytics uses cookies that respect Do Not Track (DNT) signals and can be disabled in Settings. We do not use advertising cookies.

Children's Privacy

Do. is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy as the app evolves. For minor changes, we will update the "Last updated" date above. For significant changes that affect how we use your data, we will notify you via email (cloud accounts) or an in-app notice before the changes take effect.

Contact Us

Do. is independently operated. If you have any questions, requests, or concerns about this Privacy Policy or your data, please contact us at:

getdoinfo@gmail.com

We aim to respond to all privacy-related requests within 30 days.