Privacy policy

DOEN is a to-do app. Your to-dos are yours. This page explains what stays on your device, what goes where if you switch things on, and what we collect.

Last updated 4 November 2026.

The short version

• DOEN keeps your to-dos on your device. We do not have an account system and we do not see your to-dos.
• If you turn on iCloud sync, your to-dos are stored in your own iCloud account, managed by Apple. We cannot read them.
• DOEN sends anonymous usage statistics unless you turn that off in Settings. They never include your to-dos, notes, titles, tags or places.
• The API, email and webhook features are off by default. They store a copy of some data on the DOEN server only while you have them on.
• We do not sell your data, show ads or track you across other apps and websites.

On your device

Everything you create in DOEN, including to-dos, notes, checklists, tags, projects, areas, dates and reminder times, is stored in the app on your iPhone, iPad, Mac or Apple Watch. It stays there unless you choose to sync it with iCloud or turn on one of the optional features below.

The home screen widgets read the same data on your device. They do not send anything anywhere.

iCloud sync

DOEN can sync your to-dos between your own devices using Apple's iCloud (CloudKit). When this is on, your data is stored in the private database of your iCloud account. It is protected by your Apple account and governed by Apple's privacy policy. The DOEN developer cannot see, read or access it. If you are not signed in to iCloud, or you turn iCloud off for DOEN in your device settings, DOEN works on that device alone.

Permissions DOEN may ask for

Each of these is optional, and you can change them at any time in your device Settings.

• Notifications, to remind you of to-dos at the time you set. Reminders are scheduled on your device.
• Location (when in use), to set and trigger place based reminders. Your location is used on your device and is not sent to us.
• Calendars, to show your calendar events next to your to-dos. You can choose which calendars appear. If you turn on auto-import, the event title and time are copied into to-dos on your device. If you turn on Show reminders in Calendar, DOEN adds your reminders to a calendar you choose as events, and only changes or removes the events it added. Nothing else in your calendar is changed.
• Reminders, to keep your to-dos and Apple Reminders in step in both directions if you turn that on. The data stays between DOEN and Apple Reminders on your devices. If you choose to file by list, the name of each Reminders list is used on your device to create or find a project with the same name.

Usage statistics

DOEN uses Google Analytics to count installs and see which features are used, so we can improve DOEN. This is always on in the iPhone, Mac and web apps and cannot be switched off in the app. The iPhone app uses Google Analytics for Firebase. The Mac and web apps send the same kind of counts to Google Analytics directly. It collects anonymous information such as the app and its version, device model, operating system or browser version, country, how often DOEN is opened, and which screens and features are used. DOEN does not use the advertising identifier, and never sends your to-dos, titles, notes, tags, places or calendar content. Each install gets a random identifier that is not linked to your name, email address or DOEN account. If you do not want this, do not use the app. Google processes this data under Google's privacy policy.

Optional features that use the DOEN server

These are off until you switch them on in DOEN. They run on a server operated by DOEN.

API access

When on, a copy of your open to-dos, and those finished in the last 30 days, including titles, notes, dates, tags and checklists, is stored on the DOEN server so the API can read it. Changes you send through the API wait on the server until your phone collects them. Turning API access off in DOEN deletes the copy and any waiting changes straight away. Your API token is stored on the server only as a one way hash. See the API page for details.

Email and webhooks

If you set up a private email address or webhook address for adding to-dos, the server holds the items sent to it only until your phone collects them. It also keeps the technical details needed to run the feature, such as the address you were assigned and a record of recent requests to limit abuse. Removing the setup in DOEN deletes it.

Share links

When you share a project, area or note by link, DOEN stores a copy of what you shared (titles, notes, checklists and done status, but not pictures or files) on the DOEN server under a long random address. Anyone who has the link can open it without an account, so only send it to people you trust. If you allow changes, they can tick items, add items and edit a note, and DOEN copies those changes back to your devices. Stopping sharing in DOEN deletes the copy and the link stops working. You can have up to 100 links.

Habits

Habits are kept on your devices and are not sent through iCloud. If DOEN on the web is on, habits (names, schedule and the days you completed them) are also stored with your web copy so iPhone, Mac and the browser stay in step. They are deleted with that copy. A reminder time on a habit is scheduled on your device as a local notification.

Today view choices

What Today shows (to-dos, habits, projects, notes) is four on or off switches. They are saved on your device, in your iCloud key value storage on iPhone and Mac, and with your web copy if DOEN on the web is on. The day you pin a note to Today is stored with the note.

AI assistants (MCP)

If you connect an AI assistant, it reaches your to-dos through the same token as the API. The assistant provider receives whatever you ask it to read, under that provider's own terms. DOEN does not send your data to any assistant by itself. Get a new token in DOEN to cut off access at once.

DOEN for Gmail

DOEN for Gmail is an optional add-on that adds an email to your DOEN to-dos from Gmail's side panel. It runs as a Google Workspace add-on and asks for permission to see the subject and sender of the email you have open, to show the add-on in Gmail, and to send data to DOEN. It reads only the email you have open and only when you open the add-on. It does not read the body of your emails, your other mail, your contacts or your attachments, and it does not send or change any email.

When you tap Add to DOEN, the add-on sends the to-do you are creating (the title, notes, date and project you chose, which can include the email's subject, the sender and a link to the email) to your DOEN copy on the DOEN server. To connect it, you type a one time code from DOEN on the web, and the add-on signs in like another browser. Google stores the resulting sign in key in the add-on's private storage for your Google account, and the add-on keeps a short list of your project and area names for a few minutes so the menus open quickly. Disconnect in the add-on, or sign it out in DOEN, to stop it at once. DOEN's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. The data is used only to create the to-dos you ask for, is not shared with anyone else, is not used for advertising and is not read by people.

How the add-on's data is protected. Everything the add-on sends travels to the DOEN server over HTTPS (TLS), and the add-on can only talk to doen.software. The sign in key is limited to your own DOEN copy, so it cannot reach anyone else's data, and it is shown only to the add-on, never in the email or the to-do. You can revoke it at any time by disconnecting in the add-on or signing it out in DOEN, and a revoked key stops working at once. The add-on does not store the email's subject, sender or link anywhere except in the to-do you chose to create, and it keeps nothing about emails you did not add. Staff do not read your to-dos or the emails behind them; the server holds them only so DOEN can show them back to you, and you can delete them yourself in the app or by writing to [email protected]. If you remove the add-on, its stored sign in key is deleted by Google with it.

DOEN on the web

If you switch on DOEN on the web in the app, a full copy of your to-dos, projects, areas, headings, tags, checklists and note pictures is stored on the DOEN server so that the browser version at app.doen.software, your iPhone and your Mac can stay in step. Pictures are not stored in iCloud. Calendar events and Reminders links stay on your iPhone. The browser keeps its own copy in that browser while you are signed in. Browsers sign in with a one time code from the app and stay signed in for 30 days, renewed whenever you use them. You can sign out any browser in the app. Turning DOEN on the web off in the app deletes the server copy, including pictures, and signs out every browser straight away, and signing out in a browser removes its local copy.

Each time DOEN syncs with the web, it also tells the server which app it is (iPhone, Mac or web) and its build number, so an out of date app can be asked to update before it syncs. Nothing else about your device is sent. Tag colours are stored with your tags.

You can download a backup file from the web app at any time, or fetch one with the API if you have it on. The file is created on request and is not stored by DOEN. Restoring a file adds its contents back to the same copy.

None of this data is shared with anyone else or used for any other purpose.

This website

The doen.software website uses Google Analytics to count visits. This collects anonymous information such as pages viewed, approximate location and device type. If you use the contact form, we receive the name, email address and message you type, and use them only to reply to you.

Sharing

We do not sell or rent personal data. The only outside services involved are Apple (iCloud and the App Store), Google (anonymous analytics), and the hosting and email providers that run the DOEN website and optional server features. We may disclose information if the law requires it.

Your choices

• To erase everything in one step, open Settings in the app and choose Erase all my data. This deletes every to-do, project, area and tag from your device and from iCloud, and deletes your email address, webhook link, API token, web sync copy and signed in browsers from the DOEN server. It cannot be undone, and your other devices follow through iCloud.
• Or delete to-dos in the app, or delete the app, to remove the data stored on your device.
• To remove data synced with iCloud, delete it in DOEN, or manage and delete app data in your device Settings under your name, iCloud, Manage Account Storage. Choosing Delete Data there clears the empty iCloud container after you have erased your data.
• Turn off usage statistics in Settings.
• Turn off API access or DOEN on the web, or remove your email and webhook setup, to delete the copies held on the DOEN server. In a browser, Settings has a Delete my data button that deletes the server copy, signs out every browser and clears what that browser stored.
• To ask what we hold about you, or to ask us to delete it, write to [email protected].

Children

DOEN is a general purpose app and is not aimed at children under 13. We do not knowingly collect personal data from children.

Changes to this policy

If this policy changes, we will update this page and the date at the top. If a change affects how your data is used, we will say so in the app.

Contact

Questions about privacy: [email protected], or use the contact form.