DoneThis Today is a personal project. This notice explains what personal data the app processes and why. If something is unclear, write to julien@donethis.today.

Julien Colot, an EU-based individual (Belgium). No company, no team — a one-person side project.

The app does not use any analytics, advertising, fingerprinting, or behavioural tracking.

You can use DoneThis Today without an account. In guest mode all data lives exclusively in your browser's local storage — nothing is sent to any server. If you later create an account, your local tasks are merged into it.

When you sign in, a session cookie is set so you stay signed in across page reloads. During the OAuth round-trip, a temporary value is stored in sessionStorage to remember which page you were on so you land back there after sign-in.

All of this is strictly necessary for the sign-in feature you explicitly asked for. None of it is used for tracking. Under the EU ePrivacy Directive's "strictly necessary" exception, this storage does not require a consent banner.

You can clear the session cookie at any time by signing out.

No data is intentionally transferred outside the EU. The OAuth sign-in steps are the one place where data may briefly transit third parties' global infrastructure; that is outside this app's control and governed by their policies.

Processing your account data and tasks is based on contract performance (Art. 6(1)(b)) — you signed in to use the app's features, so the app needs to handle your identity and your data to provide them. Server logs rely on legitimate interest (Art. 6(1)(f)) for debugging, abuse prevention, and operational security.

Under GDPR you can:

• Access the data the app holds about you (your account record and tasks).
• Correct incorrect data — you can edit your tasks directly; for the account record, email me.
• Delete your account and all associated data. Email julien@donethis.today with the address you signed in with and I'll remove the record promptly.
• Export your data in a portable format — same process, email me.
• Object to the processing or complain to your local data-protection authority.

Accounts and tasks are kept for as long as your account exists. On deletion both are removed from the database. Server logs roll over within a few weeks.

Sessions are managed with signed, server-side cookies; tampered tokens are rejected. All traffic between your browser and the server is encrypted (HTTPS/TLS). Todos are scoped to the authenticated user at the API layer — other signed-in users cannot read your data.

A practical note: as the site administrator I have technical access to the database. I don't read task data and I won't. I also commit to never training any AI or machine learning model on this data, and to never processing it with any third-party service for any purpose other than providing the app. The only derived data I might extract is aggregated counts (number of users, number of tasks) to inform infrastructure scaling.

If this notice changes meaningfully, the "Last updated" date at the top will move.

Anything related to your data: julien@donethis.today.