Privacy

Privacy Policy

Last updated: October 29, 2026

The legal bases, processors, retention periods and rights sections are a draft that has not yet been reviewed by a lawyer. Items marked “[To be confirmed]” or in square brackets are not yet settled. This English version is a translation; if it differs from the Korean version, the Korean version prevails.

In short: we store only what a to-do app needs to work and use your location only for ordering. We never sell or hand over your information for advertising.

Location

• The apps read your current location only when you allow location permission. It is used only to work out which place you are at and order your tasks.
• We do not record your current coordinates or build a movement history. Coordinates may be sent with an ordering request, but the server only uses them for the calculation and does not keep them. Sending precise coordinates to AI is a separate choice described below.
• The only coordinates stored on the server are the location and radius of places you registered yourself (for example home, work, a supermarket). Deleting a place deletes its coordinates.
• You can turn off location permission or location-based ordering in settings and still use every other feature.

Information we store

• Account: email, name, password (stored only as an irreversible hash).
• If you turn on two-factor authentication, the authenticator key is encrypted and recovery codes are kept only as hashes to check one-time use. Sign-in confirmation requests expire within 5 minutes, and two-factor authentication stays on when you change your password by email.
• Content you create: tasks, projects, boards, places and settings (times of day, day-part boundaries and so on).
• Personal access tokens: the token itself is not stored. We keep only an irreversible hash, a short prefix for identification, and the creation and last-used times.
• Recovery records: tasks in the trash, before/after content of changes and undo history are kept in your account. Retry de-duplication records expire after 30 days.
• On-device storage: an offline cache for viewing and changes not yet sent are kept on the device per account and server. Changes are removed from the queue once sent.
• Offline input in the desktop app is encrypted with the OS secure storage when available. If it is not, only input for which you explicitly chose “store on this device without encryption” as explained in the app is kept in a user-only local file. Such unencrypted files are protected only by the device account’s access permissions, so do not use this option on shared devices.
• Focus and feedback: timers you start and pilot feedback you submit are kept. We contact you for an interview only if you separately agreed.

AI assistant

After you agree to data sharing in the AI assistant and make a request, the conversation and the names and identifiers of the tasks, projects, boards and saved places needed to handle that request are sent to the AI model provider (Anthropic). doneix servers do not store conversations. If you do not use the AI assistant, nothing is sent. To enforce usage limits we record the number of requests, the model used, token counts and the number of tools run; individual usage records expire after 180 days.

Sending precise coordinates of your current location and saved places to AI is off at first. They are included in location calculations and AI tool results only if you choose so separately. The consent version, consent time and location-sharing choice are kept in your account and can be changed with “Withdraw AI consent” in the AI assistant. After withdrawal new requests are blocked, but information the provider has already processed cannot be recalled. Other product features remain available without consent.

Repeated tool definitions and system instructions use the provider’s 5-minute prompt cache; no cache point is set on conversation or task text. When a cost cap is configured, the same request is checked with the provider’s token counting API before generation, which also sends the request content. Amounts calculated from per-model usage and public prices are estimates, not invoices. Processing by the provider follows the Anthropic Privacy Policy.

MCP connections

AI tools connected over MCP read and change your tasks with the permissions of the token you issued. How such a tool handles the information it receives follows that tool’s policy. OAuth connections are approved after you review the requested permissions on the consent screen, and tokens and connections can be revoked in settings at any time.

Calendars

When you approve a Google Calendar or Outlook connection, we read only the busy times in the calendars you choose to calculate when you are free. The calendar list is fetched in settings for you to choose from, and event titles are not kept. Connection credentials and the chosen calendar identifiers are stored encrypted on the server and deleted when you disconnect in settings. You can also withdraw consent in your provider account’s app permissions. Fixed events you add yourself are kept until you delete them or delete your account.

Shared lists

Only the title, notes, priority, due date and completion status of items in a shared list you create, and participants’ names and roles, are visible to participants. Personal tasks, place coordinates and boards are never shared automatically. A one-time invitation created by the owner can be accepted by one person with the link within 7 days, and only a hash of the token is stored on the server. The owner can change roles or remove participants, and participants can leave. Leaving or deleting your account blocks further access but does not recall content you already wrote in someone else’s list or copies participants received. Lists you own are deleted with your account. Shared content is exported separately from the list screen, and roles and invitations are not included in backups.

Usage statistics (Google Analytics)

• The website and web app collect visit statistics with Google Analytics 4 (page path, device and browser type, approximate region, and screen usage events such as opening checkout) only if you consent. The analytics script is not loaded before consent, and declining does not limit any feature. Your choice is stored in the browser and can be changed or withdrawn at any time from “Usage statistics settings” in this site’s footer or Settings → General in the web app.
• The mobile app collects screen, save, recommendation and recovery results with Google Analytics for Firebase only if you turn it on. It is off at first and can be changed in onboarding or settings at any time. Advertising identifiers (IDFA, advertising ID) are not collected.
• Task and place content, email, name and location coordinates are never sent. Query strings of addresses (such as password reset links) are not sent either. Ad personalization and Google signals are off. Statistics are processed on servers of Google LLC (United States); the retention setting is [To be confirmed: actual GA/Firebase retention and reset-on-activity settings].

Payments

Paid subscriptions are sold on the web only and payments are processed by Xsolla (Xsolla (USA), Inc.). Payment method details such as card numbers are received and kept by Xsolla and are not stored on doneix servers. To check entitlements, doneix keeps the subscription number, plan, payment status, amount, currency, payment time and subscription period. When you open checkout we send your account identifier, email and name to Xsolla. Deleting your account cancels an active subscription first and deletes the payment records kept by doneix; transaction records Xsolla must keep by law follow Xsolla’s policy.

Deletion

Deleted tasks move to the trash so they can be restored. Deleting a project, place or board removes that item and cleans up task links. You can export your data and restore the trash from Settings → Data & recovery. Permanently deleting your account deletes account data from the server, including tasks, trash, change history, places, calendar connections, focus sessions, feedback and authentication data. Backup files you saved yourself must be deleted by you.

Legal bases for processing

• Performance of a contract (providing the service): Account, content you create such as tasks and places, sync, notifications, shared lists, payments and subscriptions
• Consent: Sharing information with the AI assistant, sending precise coordinates to AI, usage statistics, calendar connection, device location permission, interview contact
• Legal obligation: Information the law requires us to keep, such as transaction records
• Legitimate interests: Preventing abuse and securing the service (rate limits, sign-in protection), fixing failures through error reporting

Processors and international transfers

We entrust the processing of personal information to the companies below to provide the service, and all of them process it outside the Republic of Korea. Transfers happen at the times shown in the table over encrypted connections (HTTPS). If you do not want a transfer, you can avoid the related feature (AI assistant, usage statistics, calendar connection, sign-in with an external account, notifications, payments) or delete your account. Cloudflare, however, relays every connection, so using the service requires it. doneix server location: [To be confirmed]. Database location: [To be confirmed].

Privacy contact of each recipient: [To be confirmed]

Retention by item

Information whose retention period has ended or whose purpose has been achieved is deleted without delay in a way that cannot be recovered. Account deletion removes account content and credentials. Administrator security audit records have a separate 90-day expiry for abuse investigation; they do not contain passwords, tokens or task content.

Your rights and how to exercise them

• You can request access to, correction, deletion and suspension of processing of your personal information, withdraw consent, and ask for portability (export).
• You can do this directly in the app: change your name and password in settings, export your data as JSON in Data & recovery, and permanently delete your account. Withdraw AI data-sharing consent and usage statistics in their own settings.
• Send requests you cannot handle in the app to the privacy contact email below. We will reply with the result within 10 days after verifying your identity.
• You can also make requests through a representative, who must submit a power of attorney.

Children under 14

doneix does not accept sign-ups from children under 14. If we learn that we have collected personal information of a child under 14, we delete the account and information without delay. A legal guardian can request deletion through the contact below.

Privacy officer and contact

• Privacy officer: [보호책임자 성명] ([직책])
• Privacy contact: [개인정보 문의 이메일]

Company [운영자 상호]Representative [대표자]Business registration no. [사업자등록번호]Mail-order business report no. [통신판매업 신고번호]Address [사업장 주소]Phone [대표 전화번호]Email support@021flow.comHosting [호스팅 서비스 제공자]

Remedies

If you need advice or remedies for an infringement of your personal information, you can contact the organizations below (Republic of Korea).

• Personal Information Dispute Mediation Committee: +82 1833-6972, www.kopico.go.kr
• Privacy Infringement Report Center (Korea Internet & Security Agency): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr · Korean National Police Agency: 182, ecrm.police.go.kr
• If you live in the European Economic Area or the United Kingdom, you can lodge a complaint with the data protection authority of your country.

Changes to this policy

When we change this policy we announce it on this page at least 7 days before it takes effect, or 30 days before for changes that are unfavourable to you or significant. The conditions for using the service are set out in the Terms of Service.