Privacy Policy

What we store

• Your email address, used to identify your account and to sign in.
• A salted password hash (PBKDF2-SHA256) — we never store your password in plain text.
• A hash of your MCP token, if you've generated one — the token itself is shown to you once and not stored in reversible form.
• The tasks, projects, comments, and activity history you (or an agent acting on your behalf) create.
• Session cookies used to keep you signed in.

What we don't do

• We don't run third-party analytics or advertising trackers on Done.
• We don't sell your data, or use your task content to train models.
• We don't share your data with other Done accounts — each account's tasks are isolated at the database layer.

Where it's stored

All data lives in a single Cloudflare D1 (SQLite) database, accessed only by Done's own Worker. There is no separate analytics store or third-party database.

AI agents and MCP

If you generate an MCP token and connect an agent, that agent can read and write your account's tasks using the same API the web app uses — nothing more. We don't log the content of your conversations with your own agent tooling; we only see the task data it creates or edits through the API, same as anything you type yourself.

Your controls

• Revoke your MCP token at any time from the Account panel; agents using the old token immediately lose access.
• Delete individual tasks, projects, or your entire account on request.
• Contact us to request an export or deletion of your data.

Changes

Done is in early access and this policy may change as the product does. We'll update the date at the top of this page when it does.