Privacy Policy

What we store

• Your email address, used to identify your account and to sign in.
• A password hash (argon2id) — we never store your password in plain text.
• A hash of your MCP token, if you've generated one — the token itself is shown to you once and not stored in reversible form.
• The tasks, projects, comments, and activity history you (or an agent acting on your behalf) create.
• Session cookies used to keep you signed in.

What we don't do

• The Done apps — iOS, Android, and the signed-in web app — run no third-party analytics or advertising trackers at all. This marketing site does; see Analytics on this website below.
• We don't sell your data, or use your task content to train models.
• We don't share your data with other Done accounts — each account's tasks are isolated at the database layer.

Where it's stored

Your tasks, projects, comments, and activity live in a Cloudflare D1 (SQLite) database. Files attached to tasks are stored in a Cloudflare R2 bucket. Both are accessed only by Done's own Worker, and there is no second copy of either in an analytics store or a third-party database.

When a file is deleted — you empty Trash or delete a task from it, a task expires out of Trash, you remove the file, or a newer upload replaces it — it disappears from Done right away, but the stored copy is kept for 30 days before it's permanently removed. Deleting your account skips that wait: files in the workspaces you own are permanently removed immediately.

Analytics on this website

These marketing pages (trydone.app and its blog, docs, and pricing pages) load Google Tag Manager and Google Analytics so we can see which pages people visit. That measures anonymous site traffic only. It is not loaded in the iOS or Android apps, and it is not loaded behind the login — so it never sees a task, a project, a comment, or anything else in your account.

Bot check on sign-up

To keep automated sign-ups out, the “Start free” email field on these marketing pages and the sign-up form on the web use Cloudflare Turnstile. It loads only when you click into that field or open the sign-up form, not when a page loads. It usually runs without showing anything; occasionally it asks you to tick a box.

When it runs, Cloudflare receives your IP address and technical details about your browser and device, and uses them to judge whether the visitor is a person. Cloudflare handles that information under its Turnstile Privacy Addendum. What comes back to Done is a single-use token. When you create an account, Done sends that token and your IP address to Cloudflare to confirm it, and gets back a pass or a fail. Done does not store the token.

Turnstile is not part of the iOS or Android apps. It runs only on that email field and on the sign-up form.

Google Calendar

Connecting a Google account is optional. If you do, Done asks Google for the narrowest access each feature needs, and uses what it gets only for the features below.

What Done accesses

• If you sign in with Google (openid, email, profile): your Google account ID, email address, and name, to create your Done account and sign you in. Done does not store your profile photo.
• Your Google account email (openid, email), to label a calendar connection so you can tell your accounts apart.
• Read-only calendar access (calendar.calendarlist.readonly, calendar.freebusy, calendar.events.readonly): the list of your calendars, when you're busy, and — for the calendars you choose — each event's title, time, location, organizer, attendees' names and email addresses, and its link back to Google Calendar. Done cannot change anything with this access.
• Only if you turn on calendar write-back (calendar.app.created): permission to create one secondary calendar named for Done and to add, move, and remove events on that calendar only. Google enforces that Done cannot read, change, or delete anything on any other calendar with this permission.

How Done uses it

• To show your meetings alongside your tasks and schedule tasks around your busy time.
• To suggest which task a meeting is about, and to remember the links you confirm.
• With write-back on, to place focus blocks for your scheduled tasks on Done's own calendar.

That is all. Google data is never used for advertising, never sold, never used to build a profile of you, and never used to develop, improve, or train AI or machine-learning models — ours or anyone else's. No person at Done reads it except with your explicit permission to help with a support request, where needed for security, or where the law requires it.

Who it's shared with

Nobody else, with two exceptions. Cloudflare hosts Done's database and Worker and processes this data on our behalf as our infrastructure provider. And if you connect an AI agent to your account over MCP (see below), that agent can read your cached calendar events the same way it can read your tasks — because you connected it and asked it to. Done itself never sends your calendar data to any AI provider.

How it's protected

Google's access tokens and the cached calendar data are stored in Done's Cloudflare D1 database, which is encrypted at rest, and travel only over TLS. They are read only by Done's own Worker, are isolated per account, and are never exposed to the browser or to another Done account.

How long it's kept, and deleting it

• Busy times and event details are cached only for a rolling window around today and refreshed on every sync. An event that is cancelled, falls out of that window, or is on a calendar you untick is deleted at the next sync.
• Disconnecting a Google account in Done deletes its tokens, every cached busy time and event, and the task links built on them; removes Done's focus blocks from Google Calendar if write-back was on; and revokes Done's access at Google.
• Deleting your Done account deletes all of it.
• You can also remove Done's access any time at https://myaccount.google.com/permissions.

Done's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI agents and MCP

Done contains no AI assistant of its own, and Done never sends your data — including anything from Google Calendar — to any AI provider. The AI in Done is an agent you already use — Claude, ChatGPT, Cursor, or another MCP client — which you connect to your own account.

If you generate an MCP token and connect an agent, that agent can read and write your account's tasks, projects, comments, and tags, and read your cached calendar events if you've connected Google, using the same API the web app uses — nothing more. It cannot reach another account's data, and it never receives your password or your email password.

Because that agent runs on its provider's infrastructure, whatever it reads from your account is disclosed to that provider under your agreement with them, not ours. That connection only exists after you deliberately create a token and configure the agent with it, and it ends the moment you revoke the token. We don't log the content of your conversations with your own agent tooling; we only see the task data it creates or edits through the API, same as anything you type yourself.

Your controls

• Disconnect a Google account at any time from the Account panel; Done deletes its data and revokes its access.
• Revoke your MCP token at any time from the Account panel; agents using the old token immediately lose access.
• Delete individual tasks, projects, or your entire account on request.
• Contact us to request an export or deletion of your data.

Changes

Done is in early access and this policy may change as the product does. We'll update the date at the top of this page when it does.