DotaskController and contact
Dotask is an independent project for organising tasks, routines, schedules and focus sessions. The controller of the personal data described in this policy is Ana Luiza Barbosa de Castro, who runs Dotask as an independent project.
For privacy matters, requests about your data or questions about the service, write to hello@dotask.eu.
This policy applies to the application at dotask.eu and its associated hosting address, including the beta access form. The application is in beta.
What data we process
- Account and profile: authentication identifier, email, name and, when provided by your sign-in provider or you, profile photo. Dotask does not receive your Google or Apple account password.
- Country and ranking: If you have not chosen a country, we save the approximate country detected by the hosting infrastructure or your device time zone by default. We do not store your IP or use GPS for this setting. You can change or clear the country in Profile; your choice is preserved. The flag appears on the leaderboard when you participate.
- Organisation and focus: tasks, descriptions, tags, priorities, projects, dates and times, routines, completions, reminders, Pomodoro sessions and preferences you save in the app.
- Beta access requests: email, optional name, request date and authorisation status.
- Beta metrics: First and last recorded sign-in, last use and estimated active time in the app, associated with your account. Time is measured while the app is visible and there has been recent interaction; we do not store keystrokes, pointer coordinates or interaction content. Daily records of app visits, Pomodoro starts and task or routine completions help measure adoption and return, without storing the content of those actions in the metrics. They are shown in aggregate in a private dashboard. Sign-in and active-time tracking has existed since 13 October 2026; the new action metrics have their own tracking start date, shown in the dashboard, without reconstructing earlier activity. Only Dotask’s owner can access these metrics.
- Feedback and support: reports you submit, optional images, account identity and technical context, such as app screen, version, browser, theme and screen dimensions.
- Optional integrations: selected calendar data, authorisations and tokens needed for connections, private calendar URLs and identifiers for devices or voice services you choose to connect.
- Technical data: session cookies, local preferences, notification identifiers and information needed for security and operation. For sign-in and the beta form, we use an identifier derived from the IP address and request counters to limit abusive attempts. These limiters do not store the original IP address. To limit authenticated operations, such as reads, changes, exports and backups, we also use account-derived identifiers and temporary request counters. Hosting providers may also process IP addresses and technical logs.
Do not include sensitive data, passwords or third-party information you are not authorised to process in tasks, descriptions or feedback images.
How we use data
We use data to authenticate your account, manage beta authorisation, save and sync your organisation, run the features you choose, respond to support and feedback, assess usage and improve the beta through account-level aggregated metrics, prevent abuse and maintain service security.
Depending on the purpose, the legal bases are performance of the requested service and steps before access, legitimate interests in service security and improvement, consent where applicable to optional features, and compliance with legal obligations. You can withdraw consent for an optional feature without affecting the lawfulness of earlier processing.
Dotask does not sell your personal data or use it for targeted advertising.
Google, calendars and other connections
Sign in with Google: we use verified identity, email and basic profile data to create or recognise your account. Google authentication does not replace approval of your email as a beta tester.
Google Calendar: it is connected only if you choose and authorise it. The integration requests read access to your calendar list and events to show available calendars and sync those you select. We store necessary data, such as event identifiers, titles, dates, times and links, and connection tokens. The integration does not create, edit or delete events in your Google account. It does not request access to Gmail messages.
The use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the requirements of Limited Use. This data is used only to provide and improve the Dotask features you choose. It is not sold, used for advertising or used to train artificial intelligence models. Human access to Google data is limited to cases permitted by that policy, such as your explicit consent for support, security needs, legal obligations or internal operations with aggregated and anonymised data.
Outlook and calendars by URL: when connected, we use read permissions or the address you provide to import data from selected calendars. A private calendar URL may give access to the calendar; treat it as confidential information.
Notifications, Mac, Siri and Alexa: these connections are optional. Their services may receive data necessary for the feature, such as device identifiers, reminder content or task creation commands. Notifications may show a task title on your device.
The morning summary and task, routine and focus notifications start enabled in preferences and require notification permission on the device. You can turn them off and adjust the time, days and time zone in My space. The morning summary may show your first name and task counts on the lock screen.
You can manage or disconnect connections in My space and revoke permissions directly with the provider. Existing backups may contain data from earlier connections until replaced or deleted.
Who may receive your data
Hosting and storage infrastructure is provided by OpenAI/ChatGPT Sites and Cloudflare services. Google, Apple, Microsoft and notification or voice providers participate in processing when you use their features. Interface fonts are loaded through Google Fonts, which involves technical requests to Google.
The person responsible for Dotask can view beta requests and feedback to manage access and support. Your organisational content is private by default. If you share a project, the project data needed for collaboration becomes accessible to authorised members.
We may also disclose data when necessary to comply with a legal obligation or protect people’s safety and rights. External services have their own terms and privacy policies.
Providers may process data outside the European Economic Area. Transfers are subject to the applicable terms and safeguards of the respective services, including standard contractual clauses when required. You can request more information using the contact on this page.
Retention and deletion
Account data is retained for as long as necessary to provide the service and while you keep your account. In My space → Account and data, you can delete your account. To obtain a data export, contact hello@dotask.eu. For sensitive operations, you may need to authenticate again.
Deleting your account removes account-related records and files, including its backups stored by the app and account-related usage metrics. When backups exist, the app keeps up to seven of the most recent backups per account; this is a count limit and does not mean seven days.
Beta requests, feedback and submitted images are separate records: they are not automatically deleted when an account is deleted or beta access is revoked. The account reference in feedback is removed when the account is deleted, but its text and images may still contain personal data. These records are retained to manage the beta and investigate reports; you can request their deletion by email.
Rate-limit records have a 24-hour window and expired records are cleared on new requests. Other infrastructure technical logs follow providers’ retention periods. Data may be retained when necessary for legal obligations, security or defending rights, for as long as necessary for that purpose.
Drafts in this tab
Tasks that have not yet been confirmed as saved are temporarily kept in this tab’s session storage, linked to your account, so they can be recovered after refreshing the page. They may include the title, description and options you selected. They are removed when saving is confirmed, when you discard the draft or when you sign out in this tab. Drafts older than seven days are not recovered. These drafts are not synced across devices.
Your rights
Under applicable law, you can request access, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interests and withdraw consent.
Contact hello@dotask.eu using the email address for your account or beta request. We may request proportionate information to confirm your identity. We normally respond within one month, subject to extensions permitted by law.
You may lodge a complaint with the Portuguese Data Protection Authority (CNPD) or the competent data protection authority.
XP and leaderboard
We store experience points earned and collected through your app activity. Accounts automatically appear on monthly and all-time leaderboards with a first name, surname initial and the country detected or chosen in Profile. By default, the leaderboard uses the same photo or character as your profile in My space → Profile. You can choose a different emoji in Journey or opt out of the leaderboard. Your email, tasks and routines do not appear on the leaderboard. Your personal XP stays saved when you opt out. XP records are deleted when the account is deleted.
Security and updates
To detect failures, we record technical error categories, the affected app area, response codes, request durations and a random request identifier. Diagnostics sent by the app do not include error messages, task titles or descriptions, emails, tokens or field contents. Infrastructure logs follow hosting retention terms.
We use HTTPS, account-level access controls, management areas restricted to the person responsible and technical protection measures. Account backups, when available, are encrypted. No online service can guarantee absolute security.
We may update this policy when features or data processing change. The date at the beginning of the page identifies the published version. Relevant changes will be communicated in the app or through the account contact, when appropriate.