Privacy policy

Information we collect

• Google account information. When you sign in with Google, AllDone requests only the openid, email, and profile scopes. It stores your name, email address, profile picture URL, and Google account identifier. AllDone does not access your Gmail, Drive, Calendar, or contacts. The sign-in provider also supplies an access token, ID token, scope and expiry information, and a refresh token if Google returns one. These credentials are stored with your linked account in the service database; they are not the hashed connected-app tokens described below.
• Content you create. Projects, tasks, statuses, and planner settings you enter.
• Session and authorization data. Sign-in session records, and for connected apps such as ChatGPT, the OAuth grants and tokens you approve. Connected-app tokens are stored as hashes.
• Operational information. The application and hosting services may record errors and diagnostic information needed to investigate failures. Do not include passwords or tokens in support messages.

How we use information

Information is used only to sign you in, confirm your email is on the approved access list, show and save your projects and tasks, and keep the service secure. AllDone has no advertising, does not sell data, and does not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models. Google credentials are used for account authentication, not to fetch other Google services.

Profile information, account credentials, sessions, planner content, and authorization records are stored in AllDone's PostgreSQL database hosted on Microsoft Azure. Database backups are stored in a private Azure Storage container.

Connected apps

Connecting an assistant such as ChatGPT is optional and separate from Google sign-in. After you approve tasks:read access, the connected service can receive project and task records, including their titles, identifiers, statuses, timestamps, and archive information. With tasks:write access, it can also create and change projects and tasks. AllDone does not send your Google sign-in tokens to connected assistants.

This user-directed sharing is subject to the connected provider's own privacy policy and settings, including its handling of conversations and any AI processing. To revoke an AllDone connected-app grant, email hello@saba.codes from your account email and identify the connection. You can also disconnect AllDone in the assistant's settings. Disconnecting or revoking a grant does not delete information the assistant has already received; contact that provider for its deletion options.

Google user data

AllDone's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the sign-in and account features described here. It is not sold or transferred to data brokers, information resellers, or for advertising, credit, or lending decisions. Google Workspace APIs are not used to develop, improve, or train non-personalized AI or machine-learning models.

Human access to Google user data is limited to circumstances permitted by that policy: your affirmative consent to specific information, a security investigation, legal obligations, or aggregated and anonymized information for internal operations as permitted by the Limited Use requirements.

Sharing

Microsoft Azure processes information to host AllDone's servers, database, and backups. Google processes sign-in requests under its own privacy policy. Connected assistants receive the planner data you authorize, as described above. Information may also be disclosed when required by law or necessary to investigate a security incident, subject to Google's Limited Use requirements for Google user data. AllDone does not share information for advertising or sell it to third parties.

Cookies

AllDone uses essential cookies only, to keep you signed in and protect against request forgery. It does not use analytics or advertising cookies. Your light/dark theme preference is saved in your browser's local storage.

Retention and deletion

Account and planner data is kept while your account is active and needed to provide the service. Archiving a task hides it from active views; it does not delete its stored data. To request deletion of your account, Google profile and credentials, sessions, planner content, and connected-app authorizations, email hello@saba.codes from your account email. The operator confirms your identity, removes those records from the live database, revokes connected-app access, and confirms completion.

Database backups are configured for lifecycle deletion after 30 days without modification. Azure processes this rule asynchronously, so deletion is not guaranteed at an exact hour. Deleted backups remain recoverable through Azure soft delete for an additional 30 days before permanent removal. Backup copies are not individually edited for account deletion. If a backup is restored, completed deletion requests are reapplied before normal service resumes.

You can revoke AllDone's Google access at any time from your Google account settings. Revoking Google access does not itself delete your AllDone account or planner data and is separate from revoking access for an assistant.

Security

Traffic is encrypted with HTTPS, access is limited to approved accounts, and connected-app tokens are stored hashed. Google provider credentials and sign-in session tokens are separate database records and are not protected by that hashing mechanism. The database is not exposed as a public service, and backups use a private storage container. No system is perfectly secure.

Children

AllDone is not intended for children under 13 and does not knowingly collect their data.

Changes

The date at the top shows the latest revision. Before materially changing how Google user data is accessed, used, stored, or shared, the operator will notify affected users by email and obtain additional consent where required.

Contact

Questions or requests: hello@saba.codes