1. Summary
- We collect information you provide for your account, profile, groups, and tasks.
- Collaboration content (tasks, comments, activity) is stored so your groups can work together.
- If you verify a phone number or use contact-based discovery, we process that information to help you connect with people you already know.
- We use infrastructure, authentication, messaging, and AI providers to run the Service securely.
- Optional DY Assist and related AI features process limited inputs on our servers.
- We do not sell your personal information and do not share it for cross-context behavioral advertising.
- You can delete your account; some data may be retained or de-identified where required for safety, law, or to keep groups usable.
2. Information we collect
Information you provide
- Account: email and authentication identifiers (Sign in with Apple, Google, or email verification).
- Profile: display name, optional photo, interests or skills, and other fields you add.
- Phone number (optional): if you choose to verify a phone number, we collect the number and confirm it via a one-time SMS code so people you know can find you and so we can reduce abuse. You can use the app without verifying a phone number.
- Contacts (optional): if you grant permission, we read phone numbers from your device address book to check which of your contacts already use DoneYet. We match these against verified users and do not store the contacts of people who are not DoneYet users.
- Groups & tasks: names, descriptions, cover images, task details (titles, notes, due dates, recurrence, assignments, completion), and metadata.
- Collaboration: comments, reactions, and activity visible to group members.
- DY Assist: messages you send to receive a response.
- Support: messages via Contact Support, including optional diagnostics you choose to include.
- Rewards (where enabled): payout preferences (such as a Venmo or PayPal handle) and related details you provide for task rewards.
Information collected automatically
- Device & app: device type, OS version, app version, locale, and time zone.
- Logs: server and application logs for operation, debugging, and security.
- Push: device tokens for notifications (Apple Push Notification service, Firebase Cloud Messaging, coordinated via Expo where applicable).
- Usage: interactions needed for entitlements, feature limits, and product improvement.
3. How we use information
- Provide accounts, groups, tasks, invites, notifications, and collaboration;
- Help you find and invite people you already know (phone verification and contact-based discovery), which you can turn off in Account → Settings;
- Operate DY Assist, Insights, distribution helpers, and moderation on eligible plans;
- Maintain security, prevent abuse, and improve reliability; and
- Respond to support requests.
4. How we share information
With other users
Content you add to a group may be visible to members according to product design and permissions.
Service providers
We use providers under contractual safeguards, including:
- Supabase: authentication, database, storage, and serverless functions;
- Apple and Google: sign-in and in-app subscription billing;
- Firebase (Google): phone-number verification by SMS when you choose to verify a number;
- RevenueCat: subscription and entitlement management;
- OpenAI: DY Assist, moderation, and certain classification or suggestion features;
- Resend: delivery of invitation and support emails;
- Expo and push services: notification delivery.
Contacts and friend discovery
If you allow access to your device contacts, phone numbers from your address book are sent to our servers and matched against verified DoneYet users so we can show which contacts are already here. We use these numbers only for matching, do not retain contacts that do not match a DoneYet user, and do not share your contacts with other users or sell them. You can stop being discoverable this way from Account → Settings (“Find me on DoneYet”), and you can revoke contacts permission in your device settings.
Legal and safety
We may disclose information to comply with law, enforce our Terms, investigate abuse, or protect users and the Service.
No sale of personal information
We do not sell your personal information. If that changes, we will update this policy and provide required notices.
5. AI and automated processing
DY Assist and related features may send your inputs and relevant context (such as a structured summary of your tasks) to model providers. Automated moderation may analyze text or images (for example, profile or cover photos). AI output can be imperfect. Do not treat it as professional advice.
6. Data retention
We retain information as long as needed to provide the Service and for legitimate purposes such as safety, fraud prevention, and legal compliance.
When you delete your account in the app, we delete or anonymize personal data tied to your account per our implementation, subject to backup, legal, and safety retention described on our delete account page. Content you contributed to a group (such as tasks and comments) may remain with that group in de-identified form so the group stays usable after you leave.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, export, or object to certain processing. Manage much of your data in the app (profile, phone verification, contact discoverability, notifications, and account deletion); for other requests, contact us below.
California (CCPA/CPRA): We do not sell your personal information and do not share it for cross-context behavioral advertising. California residents may request access or deletion and will not be discriminated against for exercising these rights.
EEA/UK (GDPR): We process personal data to perform our contract with you (providing the Service), based on your consent (for example, contacts access and optional features), and for legitimate interests such as security and abuse prevention. You may have rights to access, rectification, erasure, restriction, portability, and objection, and to lodge a complaint with your supervisory authority.
Do Not Track: We do not respond to browser “Do Not Track” signals.
8. Security
We use reasonable safeguards; no method of transmission or storage is completely secure.
9. Children’s privacy
The Service is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe we have done so.
10. International transfers
Information may be processed in the United States (including Texas) or where our providers operate, which may have different data protection laws than your country.
11. Changes
We may update this policy. Continued use after the “Last updated” date means acceptance unless law requires otherwise.
12. Contact
Privacy: [email protected]
Legal: [email protected]
Support: [email protected]