Privacy notice

This notice explains how Bednal Limited ("we", "us"), trading as Done City, collects and uses personal data when you use Done City on the web, in our iOS app and on your home screen. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Bednal Limited, Unit 4 Clifford Court, Cooper Way, Carlisle, CA3 0JG. Registered in England and Wales, company number 12582198. ICO registration number CONFIRM ZA000000. For anything about your data, email privacy@donecity.app.

What we collect

• Account data: your name, email address(es), phone number(s) and addresses you add, and your sign-in methods (passkeys, Google or Apple sign-in, two-factor settings). If you sign in with Google, we receive your name, email address, profile picture and Google account id; we don't ask Google for anything else at sign-in.
• Transaction data: what you buy and amounts. Card details are collected and held by our payment processor, Stripe; we never see your full card number. If you subscribe in our iOS app, Apple takes the payment: Apple tells us which subscription you bought, when it renews or ends and whether it was refunded, and we never see your Apple payment details.
• Technical data: session information, a one-way hash of your IP address, and your browser's user agent, used for security and fraud prevention.
• Communications: messages you send us and service emails we send you.
• Your city, tasks and habits: the tasks you add or tick in Done City or that arrive from a tool you connect (title, size, due date, link and which tool it came from), your habits and check-ins, your Keystone and Blueprints, Build Blocks (focus sessions), your city's name, and the log of events your city is built from (what you finished and when, and the XP it earned). We use them to build your city and show your progress. Task titles are removed 90 days after a task is finished, from the task and from your city's history, Keystones and Blueprints.
• Tools you connect (Supply Lines): when you connect Todoist, Google Calendar, Notion, Linear or GitHub, we keep an access token for it, encrypted, and the account id and name the tool gives us (never its password). We read only what your city needs:
• Todoist: your open tasks due today or overdue and the tasks you finish, with their titles, priorities, due dates, projects and labels.
• Google Calendar: your calendar list (so you can pick a focus calendar) and your events, to find focus time. See "Google user data" below.
• Notion: the rows of the database you choose, with their titles and done status.
• Linear: the issues assigned to you, with their titles, projects and labels.
• GitHub: pull requests you wrote that were merged and issues assigned to you that were closed, in the repositories where you installed our GitHub App, with their titles.

We store label names only as coded fingerprints, never their words. If you turn on "Also mark tasks done" for Todoist, Notion or Linear, ticking a task here also marks it done (or not done) in that tool; we ask the tool for permission to write only when you turn it on. GitHub and Google Calendar are read-only. When you disconnect a tool, we revoke our access with it where it allows, delete the token and remove its unfinished tasks; work you already finished, and the XP it earned, stays in your city.

• Health data (steps, sleep and workouts): if you connect Health Lines, we process your daily step count, the minutes you slept each night and how long each day's longest workout lasted, and nothing else: no heart rate, location, a workout's type or route, calories or raw readings. In our iOS app they come from Apple Health: the app asks iOS for read access to steps, sleep and workouts only, never writes to Apple Health, works out each day's figures on your phone and sends us the figures for the last 7 days. You can also send the same figures from Health Auto Export or an iPhone Shortcut through a private link we give you, which you can replace at any time; we store only a coded fingerprint of that link. We store one figure per day for each, and each time a day's figure goes up we add it to your city's history, which is what earns XP for steps and sleep and ticks the habits you link to your steps, sleep or workouts. Health data is special category data: we process it only with your explicit consent, given on the Health Lines screen before we read anything, and we record when you gave it, which wording you agreed to and what it covers. If you agreed before we added workouts, your consent covers steps and sleep only, and we don't read or store workouts unless you agree to the updated wording. On the free Settler tier we don't store health data sent to us.
• Diagnostic data: when something breaks in your browser, or when you choose to include diagnostics with feedback, we record what we need to find and fix the problem: the page and the last few pages you visited, which buttons or fields you used just before (never what you typed), the addresses of recent requests to our servers (without their contents), recent error messages, and your device's screen size, language, time zone and browser. If the problem happened on something of yours, such as an order, we link the report to it, and we keep a step-by-step log of what happened to your orders so we can investigate.
• Integration call log: when we call a tool you connected, or another service, on your behalf, we log the call: the service, what we asked for, the address we called (with any keys or tokens removed), the result and how long it took, linked to your account. If the call failed we also keep the error and the service's response, with secrets removed. We use the log to find and fix faults.
• Feedback: what you send through the feedback form: your message and its type, the page you were on, the app version and a summary of your browser, and the diagnostics above if you tick the box to include them. Signed in, you can attach up to 3 screenshots; signed out, you can leave an email address so we can reply. We keep the replies we send you with it.
• Page-view counts: when you open a public page of our website (not your account or the app), we add one to a daily count for that page. The count also records the website that linked to the page (its domain name only), any campaign tag in the link (utm_source), and whether the device is a phone or a computer. We count this for every visitor, without cookies: nothing is stored on your device for it, and the counts hold no IP address, browser details, account or other identifier, so they can't be linked to you.
• Work history: when a task is finished or reopened, in Done City or in a tool you connected, we record when it happened, which tool, its size, its due date, the project, database or repository it belongs to, references to other work items in its title (such as ENG-12), and coded fingerprints of the title's pattern and of its labels. We don't keep the title's or the labels' words in this history. From it we make suggestions for automating work you repeat, and we keep what you chose for each (not now, don't suggest this, or set up).
• Neighbours and Skyline Cards: if you invite neighbours or accept an invite, we keep who your neighbours are and the invite links you made. If you make a Skyline Card, we keep a snapshot of that week's card: your city's name, level, rank and district, and that week's numbers (XP, and any buildings finished, focus time, tasks done and habits kept).
• Invites: if you join through someone's invite link, we record who invited you and whether a purchase followed, and we keep your own invite code.

Why we use it, and our lawful basis

• To provide the service you asked for (contract): creating your account, signing you in, building your city from your tasks, habits, focus time and connected tools, sharing with the neighbours, links and apps you choose, processing payments, sending receipts.
• To process your health data (explicit consent): to add your steps and sleep to your city, and to tick the habits you link to your steps, sleep or workouts. You can withdraw consent at any time on the Health Lines screen, in one tap.
• To keep the service secure (legitimate interests): detecting abuse, rate limiting, keeping an audit log of security-relevant actions.
• To find and fix faults (legitimate interests): recording errors with the diagnostic data above, the integration call log, and the feedback you send us. Diagnostics are collected only around an error or with feedback you send, are not used for analytics or advertising, and nothing is stored on your device for them.
• To understand how people find our website (legitimate interests): the page-view counts above. To limit abuse of the counter, our rate limiter keeps a one-way hash of your IP address for about 20 minutes; it is never stored with the counts.
• To understand how the product is used (consent): only if you allow analytics cookies (see our Cookie policy). If you do, this includes whether you gave or withdrew health consent, never your step, sleep or workout figures.
• To spot repeated work (legitimate interests): to notice work you repeat and suggest ways to automate it, using the work history above. This is profiling, but it has no legal or similarly significant effect on you. It is never used for advertising, never sold, never used to train AI models, and never shown to an organisation you belong to. You can turn it off in Settings › Spot repeated work, which also deletes the history and the suggestions.
• To credit invites (legitimate interests): recording who invited whom, and checking an invite isn't someone inviting themselves.
• To meet legal obligations (legal obligation): keeping financial records for tax and accounting, for 6 years.
• Marketing (consent): only if you opt in; you can withdraw at any time.

How your health data is protected

We never use your health data for advertising or marketing, never sell it, never use it to train AI models and never store it in iCloud. Your step, sleep and workout figures are never shown to your neighbours, to an organisation or team you belong to, or to AI apps or automations you connect, and they never count towards a team's numbers. The XP your steps and sleep earn, and the XP of a habit Health ticks for you, adds to your level and your own XP totals (which AI apps you connect can see), but it never counts towards the XP your neighbours, leaderboards, visitors or a team see. A habit you link to your steps, sleep or workouts shows as done when its target is reached, like any habit, so an AI app you allow to read your habits can see that, but never the figure. When you withdraw consent, we stop accepting health data, delete the stored daily figures and the private link, and your phone stops sending them. We also take every step, sleep and workout figure out of your city's history, including totals you checked in by hand: for each day it keeps only the XP your steps and sleep earned, whether they completed that day's steps or sleep quest and which of your linked habits' targets they reached, and it keeps the number of streets your steps built, so the XP they already earned, your habits' streaks and your city stay as they are.

Google user data

Done City's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

From Google Calendar we read your calendar list, so you can pick a focus calendar, and your events, to find focus time: events on the calendar you picked, events Google marks as focus time, and events with #focus in the title. For each focus event we keep only its id, start time and length, to turn into Build Block XP; we don't keep its title, description or attendees, or any other event. We use Google user data only to provide and improve this feature you can see. We never use it for advertising, never sell it, never use it to train AI models, and never let people read it, except with your permission, where security or the law requires it, or as part of aggregated, anonymous data. Your Calendar focus time counts towards the XP totals your neighbours, a team and apps you connect can see, but the events themselves are never shared. You can disconnect Google Calendar at any time, which deletes our token, and you can also remove our access in your Google Account.

Who we share it with

We use processors who act on our instructions: hosting (Vercel), database (Neon, in London), payments (Stripe), email delivery (Resend), rate limiting (Upstash, in London), analytics with your consent (PostHog, in the EU), and Cloudflare (our domain and DNS, receiving email sent to our addresses, file storage for feedback screenshots and email attachments, and bot checks on some forms). Email you send to our addresses is received by Cloudflare and forwarded to our support mailbox at Google (Gmail), and a copy is stored in our own support inbox with any attachments; we answer from there through Resend. Apple and Google provide sign-in if you choose them, and Apple handles iOS app purchases. Some process data outside the UK; where they do, transfers are protected by UK adequacy regulations or the International Data Transfer Agreement / Addendum.

We also share data where you ask us to:

• Neighbours see your account name, your city's name, level, rank and district, a 3D view of your city, and your XP this week (not counting XP from your health data). If you have neighbours, your own city also shows the Commons, a landmark that grows from your and your neighbours' combined XP each week; it shows only stages, never anyone's own numbers. They never see your task titles, habits, Keystone, Blueprints, connected tools, health figures or the days you were active. Either of you can remove the other at any time. An invite link works for 14 days and up to 25 people, and "Get a new link" turns the old one off.
• Leaderboards and visits: your neighbours' weekly leaderboard is on unless you turn it off, and shows your account name, city name and XP this week (not counting XP from your health data) to neighbours who are on it too. A colleagues' leaderboard exists only if an owner of your organisation allows it and you join it yourself; it shows your name, city name and work XP this week (tasks, focus, Keystones and Blueprints) only to colleagues who joined it too, and owners and admins see nothing more than anyone else. A weekly global league is only for people who join it: about 30 people at a similar level see your city's name and XP this week, never your account name or email. People who can see you on these, your neighbours, and colleagues you let visit can visit your city: they see a 3D view of it, its name, level, district and landmarks, never your task titles, habits, health figures or the days you were active. We keep your choices, which league you were in each week, and reports people make about city names (who reported which city, and the name). If a city name is reported, we may hide it from everyone else.
• Guest passes: if you give a guest pass, we keep who you gave it to once they use it, and you and your friend become neighbours. If you use one, the person who gave it sees your city's name.
• Skyline Cards: anyone with a card's link can see the card (your city's name, level, rank and district and that week's numbers) without signing in. It never shows your name, task titles, habits or health data, and we ask search engines not to index it. "Stop sharing" deletes the card, and the link stops working.
• AI apps you connect to Done City (through our MCP server) can, depending on the permissions you approve, read your tasks (titles, sizes, due dates, links and which tool they came from), your Keystone and plan for tomorrow, your habits and streaks, your Blueprints and your city's numbers, and add, change or finish tasks, set your Keystone, check in habits and start or stop Build Blocks. They never get your health figures, neighbours or team. What the app does with this is governed by its own terms and privacy policy. If you use an AI app to pass tasks between Done City and another app (such as Akiflow), your task titles also reach that other app through it. We keep a record of each app you connect: its details, the permissions you approved, and coded fingerprints of its access tokens. Access tokens last 15 minutes and we delete them a day after they expire; refresh tokens last 30 days, change every time they're used, and are deleted when you disconnect. You can disconnect an app at any time in Account › Security.
• Zapier and IFTTT: if you connect them, they receive the automations you turn on: tasks you finish (title, which tool, size, XP and time), tasks you add in Done City (title, size and due date), buildings you finish (your city's level, building and district) and your Keystone. They can also add, finish or log tasks for you. Zapier is told your name, email address and account id when you connect, and IFTTT your name and account id. They handle this under their own terms. We keep each trigger event for 30 days, then delete it. You can disconnect them in Account › Security.
• Tools you connect: if you turn on "Also mark tasks done", we tell that tool which tasks you ticked or unticked here.

Notifications and device tokens

If you turn on notifications, we keep what's needed to reach your device: for a browser, the push address and keys your browser gives us (with its browser name, from the user agent); for the iPhone app, the device token Apple gives the app, whether it's a test or App Store build, and when it was registered and last seen. We use them only to send the notifications you've left switched on in Settings › Notifications (contract): up to 2 a day of good news about your own city, such as a building opening or your weekly recap, plus reminders you asked for, such as before a free trial ends. On iPhone we also send silent pushes, which show nothing, so your widgets update when work arrives from your other tools. A notification's text can include your city's name, building names, a neighbour's city name and your week's numbers, never task titles or health data. To deliver it, the text and the address or token pass through your browser maker's push service (Google, Mozilla, Apple or Microsoft) or Apple Push Notification service. We delete an address or token when you turn notifications off on that device, sign out of the app, the push service tells us it no longer works, or you delete your account. You can switch each kind off, set quiet hours, or turn notifications off in your browser or iPhone settings at any time.

How long we keep it

We keep account data while your account is open. Error reports are kept for 30 days (diagnostics included) and order step logs for 90 days. The integration call log is kept for 30 days. Feedback, its screenshots and our replies are kept for 2 years from when the feedback is closed (or arrived, if it's still open); email you send to our addresses, and our replies, for 2 years. Work history is kept for 400 days, so a yearly task can be compared with the same time last year; a suggestion you declined is kept for as long, so it isn't made again. Task titles are removed 90 days after the task is finished. Health data is kept while Health Lines is connected and deleted when you withdraw consent. If your paid access ends, we keep your connected tools' tokens for 90 days so you can restart in one tap, then disconnect them. If you delete your account we remove your personal data after a 30-day grace period, including your city, tasks, work history, health data, connected tools and invites, except records we must keep by law (such as financial transactions), which we keep without your contact details for 6 years.

Your rights

You can ask to access, correct, delete, restrict or object to the use of your data, and to receive it in a portable format. You can withdraw any consent you gave, such as for health data, at any time. You can export and delete your data from your account settings or by emailing privacy@donecity.app. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to help first.

Changes

We will post changes here and, if they are significant, tell you by email.