Privacy

Last updated October 20, 2026

Doneso is a to-do list made by Vahdat Web. This page explains, in plain words, what it keeps about you and why. The short version: only what it needs to work, no ads, no tracking, and you can delete everything yourself at any time.

What we store

• Your account: your name, your email address, and your password. The password is stored only as a one-way hash, so nobody, including us, can read it.
• What you put in: your tasks, notes, dates and categories.
• Settings: your timezone (taken from your device, so dates are right) and whether you chose light or dark.
• Email confirmations: when your address was confirmed, and short-lived links for confirming an email or resetting a password. Only a scrambled form of each link is stored, and they stop working after 48 hours (confirmations) or one hour (password resets).

Cookies

One cookie keeps you signed in. It lasts until you close your browser, or 30 days if you tick "Keep me signed in". There are no advertising or tracking cookies, and no analytics. Cloudflare, which protects the site (see below), may set a cookie of its own to tell people from bots.

Your connection

To stop people guessing passwords, we count failed sign-ins and similar attempts. For that we keep a scrambled form of your IP address, never the address itself, for up to two days. Like most websites, the server also keeps a standard log of requests, including IP addresses, for a short time to help fix problems.

Who helps run Doneso

We don't sell or share your data with anyone. A few services are needed to run the site:

• Vultr rents us the server where Doneso and its database live.
• Cloudflare sits in front of the site to keep it fast and secure, so your visits pass through it.
• Brevo sends our emails (confirming your address, resetting your password). It gets your email address and the email itself, nothing else.
• Apple, Google and Mozilla deliver notifications to your devices, if you turn them on. They only see an encrypted message they can't read.

Notifications

If you turn on notifications for reminders, your browser gives us an address at its push service (Apple, Google or Mozilla, depending on your device), which we keep so we can send your reminders there. Each reminder is encrypted for your device before it leaves our server, so the push service carries it without being able to read it. You can remove a device in Settings at any time, and signing out on a device stops its notifications.

Recently deleted

When you delete a task or a category, it goes to Recently deleted first, so you can bring it back if you change your mind. After 30 days it's removed for good, or straight away if you choose "Delete now" or "Empty".

Backups

The database is backed up every night, and each backup is kept for 30 days, so we can recover from a mistake or a broken server.

Deleting your account

Go to your account page (the round badge with your initial) and choose "Delete my account". Your account and every task and category in it are deleted straight away. Copies in the nightly backups disappear as those backups expire, within 30 days.

Your questions and requests

If you'd like a copy of your data, want something corrected, or have any question about this page, email [email protected].

Children

Doneso isn't meant for children under 13, and we don't knowingly keep accounts for them.

Changes

If this page changes, the date at the top changes with it. If a change matters, for example a new service that handles your data, we'll email you before it takes effect.