Privacy Policy

Who we are

Doovio (the website at doovio.app, the API at api.doovio.app and the Doovio mobile apps) is run by Sherwin Rhey Condez (“Doovio”, “we”, “us”). We are responsible for the personal information described here. Questions or requests: [email protected].

In a shared workspace, the workspace’s owner decides who can see what. Content you add there is visible to the people in that workspace.

What we collect

• Your account: your name, email address, password (stored only as a one-way hash), profile photo if you add one, and whether your email is verified.
• Sign in with Google, Facebook or Apple: the provider’s ID for you, and the name and email it shares. We never see your password for those services. With Apple you can hide your email; we then receive a relay address.
• What you put in Doovio: tasks, projects, checklists, comments, files, goals, habits, plans, reminders, tags and the like, and who created, changed or was assigned them.
• Workspaces and invitations: the workspaces you belong to, your role, and the email addresses you invite.
• Settings: your time zone, language, theme, week start, time format and notification choices.
• Devices: a name for each phone or browser you sign in on (for example “Ada’s iPhone”), when it was last used, and, if you turn on push notifications, the push address your device or browser gives us.
• Activity history: a record of changes in a workspace (for example “Ada completed Write copy”), shown to its members.
• Billing: your plan, its status, renewal dates and invoices. Payments are handled by Paddle (see below); we never receive your full card details.
• Technical data: IP address, browser or app version and request details in our server logs, and error reports when something breaks.
• Messages to us: what you send when you email us.

We don’t use advertising or analytics trackers, and we don’t buy information about you from anyone.

How we use it, and why we’re allowed to

• To provide Doovio: keep your account, store and sync your content across devices, send the notifications and reminders you asked for, and let you work with the people you invite. Needed to perform our contract with you.
• To take payments and keep records for paid plans. Contract, and legal obligations such as tax and accounting.
• To keep Doovio secure and working: prevent abuse, limit repeated attempts, investigate errors and fix bugs. Our legitimate interest in a safe, reliable service.
• To email you about your account: verification, password resets, invitations, receipts, and important changes to the service or these terms. You can turn off email notifications and the daily digest in Settings; account and security emails always go out.
• To follow the law and answer lawful requests from authorities.

We don’t sell your personal information, share it for targeted advertising, or use your content to train AI models. Staff look at your content only when you ask us to, or when it’s needed to keep the service secure or to comply with the law.

Who helps us run Doovio

We share only what each provider needs to do its job for us, under contracts that require them to protect it:

• DigitalOcean hosts our servers, database, backups and your files, in Singapore.
• Vercel hosts the website (doovio.app).
• Paddle is our reseller and merchant of record: it sells paid plans, takes payment, handles tax and sends invoices. Paddle’s own privacy notice covers what you give it at checkout.
• Google, Facebook and Apple, only if you choose to sign in with them.
• Push services: Expo, Apple Push Notification service and Firebase Cloud Messaging for the mobile apps, and your browser maker’s push service on the web, carry a notification’s title and text to your device.
• Our email provider sends account and notification emails.
• Sentry receives error reports so we can fix problems. We don’t send IP addresses or cookies with them.

We may also disclose information if the law requires it, to protect people’s safety or our rights, or to a buyer if Doovio is sold or merged. We would tell you before your information became subject to a different privacy policy.

Where your information is stored

Our main servers are in Singapore, and some providers above process data in the United States and elsewhere. When information moves out of your country, we rely on the safeguards the law requires, such as the European Commission’s standard contractual clauses.

How long we keep it

• Your account and content are kept while your account exists.
• Deactivating your account signs you out everywhere and pauses notifications but keeps your data, so signing in again brings everything back.
• Deleting your account (Settings → Account) immediately and permanently removes your account, your personal workspace, every workspace that only you belong to, and their files. Comments and tasks you added to other people’s workspaces stay with those workspaces, no longer linked to you.
• Activity history is deleted after 365 days.
• Sign-in tokens for phones are removed when you sign out or revoke them, and expired ones daily.
• Backups of the database are kept for up to 7 days, so deleted information can remain in them until they roll over.
• Billing records are kept as long as tax and accounting law requires.
• Server logs and error reports are kept only as long as we need them to keep Doovio running and secure.

Cookies and storage on your device

Doovio uses only what it needs to work:

• A session cookie that keeps you signed in on the web, and an XSRF-TOKEN cookie that protects your account from forged requests.
• Your theme choice, saved in your browser’s local storage.
• In the mobile apps, your sign-in token, kept in the phone’s secure storage (Keychain on iOS, encrypted storage on Android).

There are no advertising or tracking cookies, so there is nothing to opt out of.

Your choices and rights

You can do most of this yourself in Settings:

• See and correct your name, email, photo and preferences.
• Turn off email, push or individual kinds of notifications.
• See the phones and browsers signed in to your account, and sign any of them out.
• Disconnect Google, Facebook or Apple sign-in.
• Deactivate or delete your account.

Depending on where you live (for example in the EU, UK or California), you may also have the right to get a copy of your information in a portable format, to object to or restrict some uses, and to withdraw consent you gave. Email [email protected] and we’ll answer within 30 days. We may need to confirm it’s really you first. We won’t treat you differently for using these rights.

If you’re unhappy with how we handle your information, please tell us. You can also complain to your local data protection authority.

Security

Everything travels over encrypted connections (HTTPS). Passwords are hashed, files are private and opened only through short-lived links, and access to production systems is limited to the people who run Doovio. No system is perfectly secure; if a breach affects your information, we’ll tell you and the authorities as the law requires.

Children

Doovio isn’t meant for children under 13, or under the age your country sets for agreeing to data processing (16 in some countries). We don’t knowingly collect their information; if you think a child has given us some, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. For significant changes, we’ll email you or show a notice in Doovio before they take effect.

Contact

Sherwin Rhey Condez. Email: [email protected]. See also our Terms of Service.