Privacy Policy

Last updated: 22 July 2026

dooo list ("dooo", "we", "us") is a personal productivity suite — capture, to-dos, notes, reminders, and shopping lists — that you can use on the web or as an installed app. This policy explains what we collect, why, and the choices you have. We keep it short because our approach is simple: we collect only what the app needs to work, and we don't sell your data or track you for advertising.

The short version

We store your email (to sign you in) and the content you create in the app.
When you use an AI feature, the relevant text is sent to an AI provider to generate the result.
No advertising, no third-party analytics or tracking, and we never sell your data.
You can delete your content in the app, and request full account deletion any time.

Who we are

dooo list is operated by The One Level. If you have any questions about this policy or your data, contact us at [email protected].

What we collect

Your email address — used to sign you in with a one-time link/code (we don't use passwords) and to identify your household.
The content you create — tasks, notes, reminders, research items, shopping-list items, and anything you capture into your inbox, along with their metadata (due dates, tags, status, timestamps).
Notification subscriptions — if you turn on reminders, your browser's push subscription (an endpoint and keys) so we can send a reminder to your device. You can turn this off any time.
Household & sharing settings — if you share a household with others, who is a member and each member's visibility settings.
Approximate location — if you allow your device's location, we may attach a coarse location (such as your area, city, or postal code) to something you capture, so it's easier to place later. It's optional — deny the permission and capture still works without it.
Optional integration credentials — only if you choose to connect an integration (for example an email account for drafting, or your own AI API key). These are stored encrypted and used only to perform the actions you request.
Basic technical data — standard server logs (such as IP address and request information) that our infrastructure provider processes to run the service securely, and a session token stored in your browser to keep you signed in.

How we use your data

We use the above only to provide the service: to sign you in, store and sync your content across your devices, run the features you use (including the AI features below), deliver reminders you've asked for, and keep the service secure and working. We do not use your content to build advertising profiles.

AI features

Some features use AI — for example "Look into this" and "Summarise" on a note, classifying a captured thought, or drafting a message. These run only when you trigger them. The relevant text — such as the note or capture you acted on — is sent to the AI provider to produce a result we store on the item. We send only what a feature needs.

Two arrangements are possible, and your household admin page shows which one applies:

Your own API key. If you configure a key, it belongs to your household, is stored encrypted, and is never shared with anyone else. You are billed by the provider directly.
An included allowance. We may instead provide an AI provider key that The One Level owns and pays for. That key is ours, not yours, and it is shared infrastructure used to serve multiple households. Where it is used, we record usage metering for your household: the date, which feature ran, the model, the number of tokens consumed, and an estimated cost. This metering records volume, not content — we do not keep a copy of what was sent in it. We use it to understand and bill the cost of the service.

By default we use Anthropic (Claude), which does not use content sent through its API to train its models. If you choose to configure DeepSeek instead, note that DeepSeek's terms permit it to use submitted content to improve its models. If no key is available to your household by either route, these features either fall back to a simple non-AI method or are unavailable, and nothing is sent to an AI provider.

Who we share it with

We don't sell or rent your personal data. We share it only with the service providers that make dooo list run, acting on our behalf:

Cloudflare — hosting, application compute, database, and delivery of push notifications. Your account and content are stored in Cloudflare's database.
Anthropic and/or DeepSeek — AI processing, as described above, only for the text you send through an AI feature.
Resend — sends your sign-in emails.
Optional providers you connect — for example Google, only if you link an account for a specific feature.

We may also disclose data if required by law, or to protect the rights, safety, and security of our users and the service.

What we don't do

No advertising and no ad trackers.
No third-party analytics or behavioural tracking.
We never sell or rent your personal information.

Storage & security

Everything is served over encrypted connections (HTTPS). Access to your content is scoped to your account and household. Integration credentials are stored encrypted. No method of storage or transmission is perfectly secure, but we take reasonable steps to protect your data.

Keeping & deleting your data

We keep your data while your account is active so the app works across your devices. You can:

Delete individual items (tasks, notes, reminders, etc.) directly in the app at any time.
Delete your whole account and its data — email [email protected] and we'll remove your account and associated content. We may retain limited records where the law requires.

Your rights

You may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. In South Africa these are set out in the Protection of Personal Information Act (POPIA); if you're in the EU/UK, equivalent rights apply under the GDPR. To exercise any of them, contact [email protected] and we'll respond within a reasonable time.

Children

dooo list isn't directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their data. If you believe a child has provided us personal data, contact us and we'll delete it.

Changes to this policy

If we make material changes, we'll update the date above and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.

Governing law

This policy is governed by the laws of the Republic of South Africa, and we handle personal information in line with POPIA. This doesn't take away any protection you have under the mandatory laws of the country you live in.

Contact

Questions, requests, or concerns: [email protected].