Privacy Policy

Effective date: 9 November 2026 · Last updated: 9 November 2026

This policy explains how Done at done.myeviv.com handles information when you organize tasks or sign in. Done is operated by HS Ong. Contact: hsong@myeviv.com.

Information used by Done

• Google account information: signing in provides your Google account identifier, email address and basic profile information, such as your name and profile picture, through Google and Supabase Authentication. Done uses this information to identify your account and enable syncing. Done does not receive your Google password.
• Task data: task names, descriptions, tags, dates, completion status, priorities, repeat settings, tag colors and dictation-language preferences are stored to provide the task organizer.
• Technical information: hosting and authentication providers may process IP addresses, browser information, request timestamps and security or error logs to deliver and protect the service.

Where information is stored

Without signing in, tasks and preferences are saved in your browser’s local storage. After you sign in, account data is synced to Supabase and cached in your browser so the app can retain local changes. Authentication session information is also stored in the browser to keep you signed in. A separate browser backup of guest tasks may remain available for import. Signing out does not erase these local copies.

Google permissions and Calendar

Google sign-in uses only basic identity permissions: OpenID, email and profile. Done does not request access to Gmail, Drive, contacts or your existing Calendar events. The task editor can open a Google Calendar event form with task details in its URL. Google receives those details when you choose that action; you decide whether to save the event in Google Calendar. Signing in to Done does not connect Calendar syncing.

Optional notifications

If you enable notifications on a device, Done stores its push subscription endpoint, delivery keys, time zone and delivery status in Supabase. The time zone is refreshed when you open the app. Supabase schedules the morning digest and sends encrypted notification content through your browser’s push provider, such as Apple, Google or Mozilla. Task names may be displayed on your lock screen according to your device settings. Push providers process delivery metadata under their own policies. You can turn notifications off per device in Done Settings or revoke notification permission in your device settings. Signing out through Done also disables that device’s subscription.

Voice input

Dictation starts only when you activate the microphone and your browser permits it. Your browser’s speech recognition service may send audio to its provider for transcription under that provider’s policy. Done uses the returned text in the task field; the app does not upload or store audio recordings in its task database.

How information is used and shared

Information is used to authenticate you, store and sync your tasks, provide requested features, respond to support requests and protect the service. Cloudflare hosts the site; Supabase provides authentication and cloud storage; Google provides sign-in and any Calendar action you choose. These providers process information as needed to provide their services and may process it outside your country.

Done does not sell personal information, use Google account data for advertising, or use task content to train AI models. The current app includes no advertising or third-party analytics scripts. Information may also be disclosed where required by law or necessary to investigate abuse or protect the service.

Retention, deletion and your choices

Cloud account information and task data remain stored until you remove them or request deletion. Delete individual tasks in the app and allow syncing to complete to remove them from the active cloud task list. Account deletion is available by emailing hsong@myeviv.com from your account email; ownership may need to be verified. You can also request access, correction or an export of your information through that address.

Use Export backup in Settings for a copy of your tasks. Clear this site’s browser storage on each device to remove local task copies and cached sessions. Browser backups you exported remain under your control. You can revoke Done’s Google connection in your Google Account settings; revocation does not itself delete data already stored by Done. Deleted information may remain temporarily in provider backups or security logs under their retention processes, or where legally required.

Security and availability

Done uses HTTPS and account-based access controls for cloud data. No online service or device storage can be guaranteed secure or continuously available. Keep your device and Google account protected, and retain backups of important tasks.

Children and policy changes

Done is intended for a general adult audience and is not directed to children under 13. Contact us if you believe a child has provided personal information. Updates will be posted on this page with a revised date. If a change introduces a new use of Google data, Done will seek any additional consent required before that use begins.