Last updated: October 31, 2026
This Privacy Policy describes how "Do It" (the "App", the "Company", "we") collects, uses and protects your information when you use the Do It task-list application on Android, Windows, iOS, macOS, Linux and the web (the "Service"), and explains your privacy rights. By using the Service you agree to this policy.
Email address and name, provided when you sign in with email or with your Google or Apple account.
Tasks, sections, notes, reminders, attachments you add and your app preferences. This content is stored in your account and synced across your devices through our backend providers (Supabase and PowerSync). It is visible only to you, plus any people you explicitly invite to a shared list.
If you turn on location-based reminders, the App asks for permission to access your device's precise and approximate location, including while the App is running in the background. We use it only to detect when you arrive at or leave a place you saved, so we can show you a reminder. Your device's live location is evaluated on the device. It is not sent to our servers, not sold and not shared with third parties. Location reminders only work while the App is running; they do not work after the App is fully closed. You can turn this feature off at any time in the App or in your device's system settings, and the App works normally without it.
When you save a place (name, address, coordinates and radius) and attach it to a task or reminder, that place is stored in your account and synced like the rest of your content.
When you search for an address, the text you type is sent to the OpenStreetMap Nominatim service to return matching locations. The request does not include your account identifier.
If you use voice input, the App accesses the microphone only while you are dictating. Speech is processed by your device's speech-recognition service. If you use AI features, the text of your request may be sent to Google Gemini to interpret it.
You can connect Google Calendar in Profile > Integrations. Each device asks for access on its own, and each of the two options asks only when you turn it on:
calendar.calendarlist.readonly and calendar.events.readonly): the App lists your calendars so you can choose which ones to show. It then reads their events, from 7 days ago to about 3 months ahead, and shows them read-only next to your tasks. The App never creates, changes or deletes these events.calendar.app.created): the App creates one calendar named "do-it" in your Google account. It writes your tasks that have a due date into that calendar as events, and updates or removes them when the tasks change. It cannot access your other calendars or events.Calendar events are read directly from Google by your device. They are stored only in a local cache on that device, keeping just the title, time, calendar name and color, location and event link; attendees and descriptions are not stored. Events are never sent to our servers, never synced to your other devices, never included in backups, never shared with third parties, never used for advertising and never used to train AI models. Google access tokens also stay on your device, in your Google sign-in on Android, iOS and macOS, and in the system's secure storage on Windows and Linux. Disconnecting the integration or signing out deletes the cached events and the stored tokens from that device. The "do-it" calendar stays in your Google account until you delete it. You can revoke the App's access at any time at myaccount.google.com/permissions.
Do It's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use Firebase Analytics (Google) to collect app usage events and device identifiers such as app instance ID, device model, operating system and app version, to understand feature adoption and improve the Service. Server logs (such as IP address and access time) are used for security and troubleshooting.
We do not sell your personal data and we do not use it for advertising.
We share data only with service providers that operate the Service on our behalf (hosting and sync: Supabase, PowerSync; sign-in: Google, Apple; analytics and AI: Google Firebase and Gemini; address search: OpenStreetMap Nominatim), with people you choose to share lists with, when required by law, or with your consent. In a merger or sale of assets, data may be transferred after notice to you.
Account data and your content are kept while your account is active. Usage statistics and server logs are kept for up to 24 months. You can delete tasks and places in the App at any time, and you can request deletion of your account and all associated data by emailing us at the address below; we will act on the request within a reasonable time, except for data we must keep by law.
Our providers may process data in countries other than yours. Where required by law, we use safeguards for such transfers.
We use commercially reasonable measures, including encrypted connections and per-user access rules, to protect your data. No method of transmission or storage is completely secure.
Under applicable data protection laws, including the Brazilian LGPD and, where applicable, the GDPR, you may request access to, correction of, export of or deletion of your personal data, and withdraw consent at any time (for example by revoking the location or microphone permission in your device settings). Contact us to exercise these rights.
The Service is not directed at anyone under 16. If we learn that we collected data from a child under 16 without required consent, we will delete it.
The Service may link to third-party sites that have their own policies. We are not responsible for them.
We may update this policy from time to time. The updated version will be posted on this page with a new "Last updated" date. Please review this page periodically.
Questions or requests: rmsmaster2@gmail.com