Privacy Policy

Who we are and how to contact us

All Done? is a task management app for teams, available on the web and as native apps for iPhone, iPad and Android (all use the same account and the same data): workspaces, boards, groups, and tasks. This page explains what information we collect, how we use it, and the choices you have. For any privacy question or request, use the App Support form.

Information we collect

• Account information: your name, email address, a securely hashed password if you sign up with one (we never store your password in plain text), your time zone preference (if you set one), and the time of your most recent sign-in.
• Sign in with Google or Apple: if you choose to sign in with Google or Apple, the provider tells us your name (if you share it), your email address, whether that email is verified, and a unique identifier for your account with that provider. We use these only to find or create your All Done? account and to keep you signed in. We never receive your Google or Apple password, and we do not access your Google contacts, calendar, files, or any other data from either provider. If you choose Apple's "Hide My Email", we only know the private relay address Apple gives us.
• Organization information: your organization's name and its member list.
• Content you create: workspace, board, and group names and colors; tasks, including their names, descriptions, status, priority, type, owner, due date, and any nested subtasks; the status, priority, and type labels you set up on each board; the boards and workspaces you mark as favorites; and any board templates you save.
• Feedback: if you submit feedback or an idea from the sidebar or the About page, we store the message text along with your name, email, and organization.

How we use it

• To provide the service — storing and syncing your organization's workspaces, boards, and tasks.
• To authenticate you and keep your session secure, and to let the All Done? team see when an organization was last active.
• To let you save board templates and duplicate boards within your organization.
• To review feedback and ideas you choose to submit.
• To respond to support requests.

We do not run advertising or analytics SDKs, we do not track you across other companies' apps or websites, and we do not use your data for advertising.

Who can see your data

Data is scoped to your organization. Anyone who is a member of your organization can see and edit the workspaces, boards, and tasks they have access to — admins can grant a member access to every workspace or restrict them to specific ones. Feedback and ideas you submit are visible only to the All Done? team, not to other members of your organization.

Who we share data with

All Done? is hosted on Google Cloud (Firestore for data storage, Cloud Run for hosting), in the United States. If you use Sign in with Google or Apple, your sign-in request is handled by Google or Apple under their own privacy policies, and we check the sign-in token they send us against their public keys. We don't share your data with any other third party, and we don't sell it.

Data retention

We keep your data until you delete it. Workspaces, boards, groups, and tasks can each be deleted individually inside the app. When you delete one, we keep a copy in Recently deleted (in Profile & settings) for 30 days so you can restore it if you change your mind, and then remove it permanently. Boards you archive are kept, and hidden from your sidebar, until you unarchive or delete them. Deleting your account or organization removes everything immediately, including anything in Recently deleted. See Delete Your Account for how account and organization deletion work.

Your choices and rights

• Correction: everything you've entered is editable in the app.
• Deletion: delete individual items yourself at any time (you can restore them from Recently deleted for 30 days, or delete them forever from there), or see our Delete Your Account page for account and organization deletion.
• Other requests: contact App Support for anything else, including a copy of your data.

The iPhone, iPad and Android apps

The native apps connect to the same service as the website. They keep a sign-in session on your device so you stay signed in, and they do not collect your location, contacts, photos, advertising identifier, or any device analytics. Signing out, or deleting your account, ends the session. Because every app uses the same account, you can delete your account from inside any of them: open Settings and choose Delete my account in the Danger zone.

• Due-date reminders: if you turn them on, the app asks for permission to show notifications. Reminders are scheduled on your device from your own tasks that have a due date; they do not send any additional information to us or to anyone else.
• Permissions on Android: the Android app asks for internet access (to reach the service), permission to show notifications (for reminders), and permission to run at startup (only so that reminders you turned on keep working after the phone restarts). To offer "Continue with Google", the Android app uses Google's sign-in component on the device (Google Play services); it is used only for that button and the app has no advertising or analytics SDKs.

Security

Passwords are hashed with bcrypt and never stored in plain text. Sessions are authenticated with a signed session cookie that scripts cannot read, and traffic is encrypted in transit over HTTPS. That said, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Children

All Done? is not directed at children under 13, and we do not knowingly collect information from them.

Changes to this policy

We may update this policy from time to time. We'll post the updated version on this page with a new "Last updated" date.