Privacy Policy

Last updated: September 19, 2026. Short version: Dotoist has no third-party cloud and collects nothing itself. Your tasks stay in your browser unless you turn on sync or reminders, which communicate only between your browser and your Dotoist account. This policy explains exactly which data the app accesses, how it uses it, whom it shares it with, how long it keeps it, and how it protects it.

1. Data Dotoist itself collects

None. There is no analytics, no tracking, no crash reporting, and no advertising. The authors of Dotoist cannot see your tasks unless you enable sync — and then only your own Dotoist account holds the copy. Data moves only between your browser and your Dotoist account (when you enable sync/reminders), or to the weather providers for the Home weather card (see §9).

2. Account data the app accesses

Dotoist accesses your account only after you connect with an emailed one-time code (Sync & Settings → email → code → Connect). The app uses a single token-scoped API, and nothing else:

Endpoint	Data accessed	Why it is needed (use)
`POST /api/dotoist/token/request`	Any email address you enter.	Sends a one-time 6-digit code to that address (a lightweight sync-only account is created on first use; it can never be used for anything else).
`POST /api/dotoist/token/verify`	The email plus the code.	Exchanges a valid unused code for a sync token (single use, 15-minute expiry).
`GET /api/dotoist/me`	Your account email and name.	Display only ("Connected as …"). Never used for marketing or shared with anyone.
`GET /api/dotoist/state`	The synced copy of your lists, tasks, subtasks, notes, time records and settings.	Multi-device sync. The app reads this to pull changes from your other devices. It cannot see anything else on the server.
`PUT /api/dotoist/state`	Uploads the same synced copy.	Pushing your edits. Revision-checked, so a concurrent push merges instead of overwriting.
`POST /api/dotoist/push/subscribe`	Browser push subscription (endpoint + keys), when supported.	Reserved for future direct push delivery. Email reminders already work without it.

The app does not access anything except your synced Dotoist data.

3. How the app uses account data

Sync (optional): when you connect, a copy of your lists/tasks is stored in your Dotoist account on the server. Sync traffic goes directly between your browser and Dotoist; no intermediary server is involved. Data is used solely to provide the user-facing sync feature: uploading your edits, downloading edits from your other devices, and merging them.
Email address: shown in the Sync & Settings dialog ("Connected as …") so you can confirm which account is syncing, and used as the recipient of reminder emails. It is not used for any other purpose.
Reminders (optional): only tasks where you set Details → Reminder notify you — as a push notification on subscribed devices, plus an email from the Dotoist scheduler. The email contains the task title, notes, list name and due time. Reminder data is used solely to provide the user-facing reminder feature.
What never happens: no advertising (including retargeting, personalized, or interest-based ads), no sale or rental of data to data brokers, resellers, or ad platforms, no credit-worthiness or lending decisions, no user profiling beyond the features above, and no training of generalized AI/ML models.

4. Sharing, transfer, and disclosure of data

No sale or sharing: we do not sell, rent, or share your data with third parties such as advertising platforms, data brokers, or information resellers.
Transfers occur only: (a) between your browser and your Dotoist account to provide the sync/reminder features you requested; (b) for security purposes (e.g. investigating abuse); (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, only with your explicit prior consent.
No human access: no human reads the data except as strictly necessary for security, legal compliance, or with your affirmative agreement for a specific support case (e.g. diagnostics text you choose to copy from Sync → History and send).
Agents/contractors: there are none with access. Any future employee, agent, contractor, or successor will comply with this policy.

5. Data retention and deletion

In your browser: app state (dotoist-v1), sync metadata (dotoist-sync: sync token, account email, last-synced snapshot + revision), sync history (dotoist-sync-log, last ~50 events), notification state (dotoist-notif-seen, dotoist-notify-last), theme, and weather cache are kept in your browser's localStorage until you clear site data or disconnect. Clearing site data deletes all of it.
On the server: the synced state and sent-reminder records persist until you delete them. Disconnecting a device keeps its local copy but stops all network access; to erase the server copy, contact support (see §12). Revoking a token immediately stops future access from that device.
Sync tokens: bearer tokens that expire a year after issue, kept only in your browser (and as a hash on the server). Disconnect revokes the token immediately.
Deletion requests: delete local data via clearing site data or Disconnect, and server data as described above. Questions: see §11.

6. Data protection mechanisms

Encryption in transit: all communication with Dotoist uses HTTPS/TLS. Sync tokens are sent only in Authorization: Bearer headers over HTTPS, never in URLs or plaintext.
Encryption at rest: server-side copies are protected by the database and hosting protections. Browser-side copies rely on your device's storage protections; the app never writes tokens or task data to any third-party server.
Least privilege: the app uses one narrow token-scoped API (sync state + account display + push subscription) stored only in your own browser's localStorage. Tokens are deleted from the browser on Disconnect and can be revoked server-side at any time.
No credential exposure: tokens are never embedded in shared URLs, logs, or exports. The diagnostics view (Sync → History → Copy diagnostics) shows only connection state and revisions, never token values.
Access control: sync requests originate from your browser under your own token grant, which you can revoke at any time (Disconnect).
Secure development: the app is fully open source (github.com/arazgray/dotoist) so all data handling is auditable; the frontend ships no third-party SDKs.

7. Data stored in your browser

Key	Contents
`dotoist-v1`	Lists, tasks, subtasks, time records, view, filters, color labels, your name, panel sizes
`dotoist-sync`	Sync metadata: sync token, account email, last-synced snapshot + revision
`dotoist-sync-log`	Recent sync history (last ~50 events, kept for diagnostics; contains no token values)
`dotoist-notif-seen`, `dotoist-notify-last`	Notifications inbox read state and last shown browser notification
`dotoist-theme`, `dotoist-loc`	Theme choice; weather location (7-day cache)

Clearing your browser's site data deletes all of this. Export a JSON backup first (Sync dialog → Export) if it matters to you.

8. Sync (optional) — details

Only if you connect with an email code. Tokens are issued automatically on verify and last a year, so the connection persists. Disconnecting stops all sync; your local copy stays on the device.
A single state record on the server holds your lists/tasks. Nothing else on the server is accessible to the app.

9. Reminders (optional) — details

Only tasks where you set Details → Reminder notify you. Completing, deleting, or un-setting the reminder cancels it. Moving the due date moves the reminder.
The app reads nothing except your own synced tasks to deliver them. Push notifications need the Notify subscription on each device; emails need the Dotoist scheduler running.

10. Weather card (Home view)

The weather card fetches forecasts from Open-Meteo and resolves location via the browser geolocation API with BigDataCloud/ipapi.co fallback. This is the only third-party network traffic the app makes, and only for that card.
Location is cached for 7 days (dotoist-loc) and never sent anywhere except those weather providers. No task or account data is ever sent to weather providers.

11. Your control

Work fully offline and never connect — then nothing leaves the device at all (except the weather card if you view Home with internet).
Export or delete your data any time (Sync dialog → Export; clearing site data removes everything local).
Revoke a sync token any time (Disconnect); already-synced data stays on the server until you delete it (see §5).
Each device holds its own token — disconnect one without affecting the others.

12. Changes and contact

This policy may be updated when the app's data use changes; the date above will change and the app will request your consent to the updated policy before using data in any new way. Questions or deletion help: email [email protected] or open an issue at github.com/arazgray/dotoist/issues. Also see the Terms of Service and the in-app Manual.