Privacy Policy

1. Information We Collect

When you use Doneday, we collect the following types of information:

• Account information: Your name, email address, and profile information from your Google account when you sign in via Google OAuth.
• Google Workspace data: With your explicit permission, we access your Google Calendar events and Google Tasks data to provide syncing and planning features. We only read and write the data necessary for the Service to function.
• Usage data: We collect information about how you interact with the Service, such as feature usage and session activity, to improve the product experience.
• Time tracking data: Any time entries, categories, and related notes you create within the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Sync your tasks and calendar events with Google Workspace.
• Enable time tracking and weekly planning features.
• Send you service-related emails, such as weekly summaries (if you opt in).
• Respond to your support requests and feedback.
• Monitor and analyze usage trends to improve the Service.

3. Google API Data

Doneday uses Google APIs to access your Google Calendar and Google Tasks data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only access the data types necessary to provide the Service.
• We do not use Google user data for advertising purposes.
• We do not sell or share Google user data with third parties for their own purposes.
• We do not use Google user data to develop unrelated products or features.
• Human reviewers do not read your Google Workspace data.

4. Data Sharing and Subprocessors

We do not sell your personal information. We share data only with trusted service providers (subprocessors) necessary to operate the Service:

• Lovable Cloud / Supabase: For database hosting, authentication, and backend infrastructure.
• Google: For OAuth authentication and Google Workspace API services.

All subprocessors are contractually bound to process data only on our behalf and in compliance with applicable data protection laws.

5. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide you with the Service. If you delete your account, we will delete your personal data and any stored Google Workspace data copies within a reasonable timeframe, except where retention is required by law.

6. Cookies and Analytics

Doneday uses essential cookies to maintain your session and preferences. We do not use third-party tracking cookies for advertising. We may use anonymized analytics to understand feature usage and improve the Service.

7. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

• Accessing the personal data we hold about you.
• Requesting correction or deletion of your data.
• Withdrawing consent for data processing (where applicable).
• Requesting a copy of your data in a portable format.

To exercise any of these rights, please contact us at hello@doneday.org.

8. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS), secure authentication via OAuth 2.0, and access controls. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

Doneday is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the revised Policy.

11. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at hello@doneday.org.