Privacy Policy

Do It Now is a product of Softaleo, operated by Leonid Haimov (an individual), Israel. The controller of your personal data (under Israeli law, the owner of the database) is Leonid Haimov, trading as Softaleo. “We” and “us” mean him. Contact for anything in this policy: support@hashkit.dev.

The short version: we keep what the app needs to run your account, your family’s tasks and your reminders. We don’t sell your data, show ads, use analytics or track you.

• Your name, email address and password. The password is stored only as a bcrypt hash, never in readable form.
• Your timezone (taken from your browser when you register) and your settings: quiet hours, do not disturb, nag intervals, notification choices, escalation profile and accountability partner.
• Your family and your role in it (owner or member), when the account was made, and whether your email address is verified.
• For email verification and password reset: a hashed one-time token with its expiry (24 hours and 1 hour).

Email. We send you only account email: the verification link, password reset links, and notices about your account, such as important changes to our terms, this policy or the price of Plus. No marketing or newsletters.

• The family’s name and invite code (valid for 7 days), and its members.
• Each task: title, description, tags, urgency, due date, repeat rule, reminder and snooze settings, how often it has nagged and been snoozed, who created it, who completed it and when (with a history for repeating tasks). Tasks imported from Google also keep Google’s ID for that item, so a new import updates it.

A family shares everything: every member can see, edit and complete every task, and sees the other members’ names and email addresses and who created or completed each task. Reminders for a task go to every member who has nag notifications on; members who turn on completion notifications are told who completed what.

Accountability partner (optional). If you pick a family member as your partner and they accept, they’re told when you keep dodging a task: your name, the task’s title, how often you’ve snoozed it and for how many days it’s been open. Nothing is sent before they accept, and either of you can turn it off.

• Web push, if you turn it on for a device: the subscription your browser gives us (an address at your browser’s push service and encryption keys), your browser’s user-agent string (which browser and device it is; kept with the subscription, not used for anything) and when you subscribed; up to 10 devices. Notifications are delivered by your browser’s push service (for example Google’s for Chrome and Android, Apple’s for Safari and iPhone, Mozilla’s for Firefox, or Microsoft’s). We encrypt every notification for your browser, so the push service can’t read it.
• Telegram, if you link it: your Telegram chat ID, so our bot knows where to send reminders, and while linking, a one-time code that works for 15 minutes. Reminders sent through Telegram (task titles, due times, the first line of a description, family members’ names in completion and partner messages) pass through Telegram’s servers and are stored in your chat like any Telegram message.

Only if you connect a Google account. You sign in on Google’s site and allow read-only access to Google Calendar and Google Tasks, and your Google email address (to show which account is connected). We store a refresh token, encrypted, and that email address.

When you press “Import now”, we read your incomplete Google Tasks (title and due date) and the events of your primary calendar for the next 30 days (title and start time; events you declined are skipped), and add them to your family’s tasks, where every member sees them. We never write to your Google account. Disconnecting (or deleting your account) revokes our access with Google; tasks already imported stay.

Do It Now’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to make these tasks, never for ads, and don’t give it to anyone else.

If you create API keys (for example to let an AI assistant manage your tasks through MCP), we store each key’s name, a hash of the key (never the key itself), its first 8 characters, and when it was created and last used. An app you give a key to can read and change your family’s tasks as you; what it does with them is up to that app and its own privacy policy. Revoke a key in Settings at any time.

Do It Now Plus is sold by Paddle, which acts as our merchant of record: Paddle is the seller, takes the payment and handles tax, invoices and refunds. For your payment details and the purchase, Paddle is a separate controller under its own privacy policy. We never see or store your card details.

When the family owner starts a checkout, we give Paddle the owner’s account email address (to find or create the customer record there, so it doesn’t have to be typed at checkout) and an internal family ID (so we know whose subscription it is).

One free month per family and email address. If Paddle already has a customer record for that email address, we ask Paddle whether it ever had a subscription to Do It Now (subscriptions to other products don’t count). If it did, the checkout has no free month. This keeps the free month to one per email address, even if an account is deleted and made again.

From Paddle we receive and store, with your family: your Paddle customer and subscription IDs, the ID of the last checkout, the status of the subscription, when the paid period or free month ends and whether a cancellation is scheduled, and the ID and time of the last Paddle notification processed (so none is applied twice).

The checkout. Paddle’s checkout script (Paddle.js) is loaded from Paddle’s server (cdn.paddle.com) only when the family owner starts a checkout in Settings, or opens a Paddle checkout link to our Settings page; the checkout form is Paddle’s. So Paddle receives what any website gets from your browser, such as your IP address and browser details, and what you type into the checkout. Paddle.js and the checkout may use cookies or similar browser storage of their own, which Paddle says it needs to run the checkout reliably and to prevent fraud. On the live site, Paddle.js also loads a script from Paddle’s subscription tool Retain (from public.profitwell.com) by itself; we don’t use Retain’s features or give it any customer details. All of this is covered by Paddle’s privacy policy, not ours. “Manage subscription” opens Paddle’s customer portal on Paddle’s site.

We set one cookie, token, only when you sign in. It keeps you signed in, can’t be read by scripts, is sent only over HTTPS to our site, and lasts 90 days. Changing or resetting your password signs out your other sessions.

In your browser the app also keeps your light/dark theme choice (local storage), its own files and your last task list so you can view it offline (the service worker’s cache), and the push subscription if you turn on notifications. Signing out clears the cached task list and the push subscription on that device. You can clear all of it in your browser settings.

All of this is strictly needed for what you asked for, so there’s no cookie banner: there’s nothing to consent to. We set no tracking cookies, run no analytics and load no other companies’ scripts, except Paddle’s during a checkout (see “Payments”). The font is served from our own site.

The site only works over HTTPS. Passwords are stored as bcrypt hashes, and API keys and one-time links as hashes, so a copy of our database can’t be used to sign in. The Google refresh token is encrypted (AES-256). The database runs on our own server with a password and isn’t reachable from the internet; traffic reaches the app only through Cloudflare.

Only we have access to the data on our server. We don’t look at your tasks or account data except when you ask us to (for example, to help with a problem), to deal with abuse, or when the law requires it.

Abuse protection. To stop abuse, the server counts requests per IP address (for example, sign-in attempts) in memory, for at most 15 minutes. Nothing of it is written to the database.

Server logs. When something happens that we may need to fix, the server writes a short line to its log, with internal IDs (of a user, family, task, Telegram chat or Paddle subscription), never an email address, password or token. We use these only to fix problems.

No system is perfectly secure. If a breach affects your personal data, we’ll tell you and the authorities where the law requires it.

Under the GDPR and the UK GDPR, we need a legal basis for each use. We don’t rely on consent for anything.

• To provide what you asked for (performance of a contract with you): your account and family, tasks and reminders, the integrations you turn on (push, Telegram, Google import, API keys), the accountability partner you set up, Plus and its checkout, account emails, and answering your emails.
• Security and preventing abuse (our legitimate interests in keeping the service working and safe, and yours in a safe account): rate limits, hashed and encrypted secrets, logs, backups, and enforcing our terms.
• One free month per email address (our legitimate interest in not having the free month abused): the check with Paddle described under “Payments”.
• Telling you about important changes to our terms, this policy or prices (legitimate interests, and where the law requires such notice, a legal obligation).
• Complying with the law (legal obligation): for example, answering a valid legal request. Paddle keeps payment and tax records as the law requires it to, as the seller.

Where we rely on legitimate interests, you can object (see “Your rights”).

Do you have to give us data? No law requires you to. To have an account you need a name, an email address and a password; without them we can’t make one. Everything else (push, Telegram, Google, API keys, a partner, Plus) is optional and only needed for that feature. (This is also the notice required by section 11 of Israel’s Protection of Privacy Law, 5741-1981: the purposes are the ones above, and who receives data is listed below.)

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects, and we don’t profile you. (Reminders follow the rules you set, and whether a checkout includes the free month is checked automatically from your subscription history; if you think it’s wrong, email us.)

These companies process data for us, under their data processing terms, only to provide their service:

• Hetzner Online GmbH (Germany) runs our server in its data centre in Finland (EU): the app, its database and the nightly database copies are on it, and Hetzner keeps its daily backups of the server.
• Cloudflare carries all traffic to and from the site (HTTPS and protection from attacks), so it handles every request, including your IP address. It also forwards email sent to our contact address, support@hashkit.dev, to our mailbox.
• Resend delivers our email (your email address and the message).

These receive data as separate controllers, under their own privacy policies:

• Paddle, if your family subscribes: see “Payments”.
• Your browser’s push service (Google, Apple, Mozilla or Microsoft), if you turn on push: it delivers the encrypted notifications.
• Telegram, if you link it: the reminders sent to your chat.
• Google, if you connect Google import (see above). Google also hosts the Gmail mailbox that email to our contact address is forwarded to, so it holds any email you send us.
• Apps you give an API key to: your family’s tasks.
• Your family members see what’s described under “Your family and its tasks”.

We don’t sell or rent your personal information, and we don’t share it for advertising. We don’t give it to anyone else unless the law requires it, or to a successor if Do It Now is ever transferred, who would have to keep this policy’s promises (we’d tell you first).

We are in Israel, which the European Commission and the UK recognise as giving adequate protection to personal data. Our server, its database and its backups are in the EU: in Hetzner’s data centre in Finland (Hetzner Online GmbH is a German company), and Hetzner’s server backups stay with Hetzner. Cloudflare and Resend may process data for us in other countries, including the United States. Where data from the EU, the UK or Israel goes to a country without such recognition, it’s protected by the safeguards in their data processing terms, such as the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework. Paddle, Google, Telegram and the push services handle international transfers of the data they control under their own privacy policies.

• Your account and settings: until you delete your account.
• Tasks: until a family member deletes them, or the family is deleted (when its last member deletes their account). Completed tasks stay in the history until deleted.
• The family, with its invite code and billing details: until it is deleted.
• Verification and reset links: they stop working after 24 hours and 1 hour, and are cleared once used.
• Push subscriptions: until you sign out or turn push off on that device, the push service tells us the subscription is gone, or you delete your account.
• Telegram chat ID: until you unlink Telegram, block the bot, or delete your account.
• Google token and email: until you disconnect Google or delete your account. Imported tasks stay as tasks.
• API keys: until you revoke them or delete your account.
• Abuse-protection counts: at most 15 minutes, in memory only.
• Server logs: until the app is next updated on the server (that replaces its log), and in backups as below.
• Emails you send us: as long as needed to deal with your request and any follow-up (such as a refund).
• Nightly database copies: we copy the database every night onto the same server and keep each copy for 14 days.
• Hetzner’s server backups: Hetzner backs up the whole server (including those copies and the server log) daily and keeps the last 7, for 7 days.

So data you delete can remain in backups for up to about three weeks (14 days of nightly copies, plus 7 days of server backups that contain them). We use backups only to recover from a failure.

If Plus ends, nothing is deleted. Paddle keeps its own records of purchases (for tax and accounting) for as long as the law requires it to, even after you delete your account with us.

Wherever you live, you can:

• See your data and take it with you. Settings → Your data → “Export my data” downloads your profile and settings, your family’s name and members, and every task in your family as a JSON file. Ask us for anything else we hold about you.
• Correct it. Change your name and settings in Settings; ask us to fix anything else, such as your email address.
• Delete it. Settings → Your data → “Delete account” deletes your account immediately, with your settings, devices, Telegram link, API keys and Google connection (revoked with Google). If you are the family’s only member, the family and all its tasks are deleted too. Otherwise the family and its tasks stay with the other members (your name no longer shows on tasks you created or completed), and if you were the owner, the longest-standing member becomes owner.

If you are the family owner and the family has Plus, deleting your account also cancels the subscription immediately through Paddle, so you aren’t charged again. During the free month nothing has been charged. Otherwise the rest of the paid period isn’t refunded, but within 14 days of a payment you can still ask for a full refund of it (see the refund policy). If Paddle can’t cancel the subscription, nothing is deleted and you can try again.

Leaving a family (or being removed by its owner) doesn’t delete your account: you get a new family of your own. Tasks you made stay with the old family, and your name still shows on them there.

If the GDPR or the UK GDPR applies to you, you also have the right to restrict our use of your data, to object to uses based on legitimate interests, and to receive the data you gave us in a machine-readable format. Under Israel’s Protection of Privacy Law, you have the right to inspect the data we hold about you and to ask us to correct or delete it.

To use any of these rights, or if you can’t sign in, email support@hashkit.dev, if you can from the address of your account (so we know it’s you). We’ll answer within 30 days. It’s free.

You can also complain to a data protection authority: the one where you live or work (in the EU/EEA), the Information Commissioner’s Office (in the UK), or Israel’s Privacy Protection Authority. We’d appreciate the chance to fix the problem first, but you don’t have to ask us before complaining.

Do It Now isn’t directed at children. You must be at least 16 to create an account, and we don’t knowingly keep accounts of younger children. If we learn that someone under 16 has an account, we’ll delete it (cancelling any subscription first). If you believe a child has given us data, email us.

Families often keep tasks about their children (“pick up Noa at 4”). Those are part of the family’s tasks, visible to every member and sent in reminders like any other task. Please keep what you write about a child to what your family needs.

If we change this policy, we’ll post the new version here with a new date. If a change is important, for example if it changes how we use data you’ve already given us, we’ll email account holders before it takes effect.

Questions about privacy: support@hashkit.dev.