Privacy Policy

Last updated: September 18, 2026. Short version: DoTo has no server and collects nothing itself. Your tasks stay in your browser unless you turn on Google Drive sync or Google Calendar reminders, which communicate directly between your browser and Google. This policy explains exactly which Google user data the app accesses, how it uses it, whom it shares it with, how long it keeps it, and how it protects it.

1. Data DoTo itself collects

None. There is no DoTo account, no analytics, no tracking, no crash reporting, and no advertising. The authors of DoTo cannot see your tasks because there is no DoTo server — data moves only between your browser and Google's APIs (when you enable sync/reminders), or to the weather providers for the Home weather card (see §9).

2. Google user data the app accesses

DoTo accesses Google user data only after you press "Sign in with Google" and grant consent on Google's OAuth consent screen. The app requests these five OAuth scopes, and no others:

Scope	Google user data accessed	Why it is needed (use)
`https://www.googleapis.com/auth/drive.appdata`	Hidden per-app folder in your Google Drive (`appDataFolder`); the file `doto-state.json` containing your lists, tasks, subtasks and time records.	Multi-device sync. The app reads this file to pull changes and writes it to push changes. It cannot see any other Drive file. This is the narrowest Drive scope available for app-private storage.
`https://www.googleapis.com/auth/userinfo.email`	Your Google account email address.	Display only ("Signed in as …") and to detect account switches. Never used for marketing or shared with anyone.
`https://www.googleapis.com/auth/calendar.events`	Calendar events the app itself creates/updates/deletes for your task reminders (title, notes, list name, due time, popup/email offsets).	Reminder feature (Details → Reminder). Creating, updating and deleting reminder events requires this scope. The app never reads events it did not create.
`https://www.googleapis.com/auth/calendar.calendarlist.readonly`	Read-only list of your calendars (IDs and names), to locate the dedicated "DoTo" calendar.	Finding the reminder calendar via `calendarList.list`. `calendar.events` alone cannot call this endpoint (Google answers 403 `ACCESS_TOKEN_SCOPE_INSUFFICIENT`), so this read-only scope is the minimum addition. It does not read event contents.
`https://www.googleapis.com/auth/calendar.app.created`	Secondary calendars created by this app (the dedicated "DoTo" calendar) and events on them.	Creating the dedicated "DoTo" calendar via `calendars.insert` so reminders stay separate from your personal calendar. Without it, reminders fall back to your primary calendar. This is narrower than full Calendar access.

The app does not request full Gmail, Contacts, full Drive (drive, drive.file, drive.readonly), full Calendar (calendar, calendar.readonly), or any other Google data.

3. How the app uses Google user data

Drive sync (optional): when you sign in, a copy of your lists/tasks is stored in your own Drive's hidden app folder (doto-state.json). Sync traffic goes directly between your browser and Google's Drive API; no intermediary server is involved. Data is used solely to provide the user-facing sync feature: uploading your edits, downloading edits from your other devices, and merging them.
Email address: shown in the Sync & Settings dialog ("Signed in as …") so you can confirm which account is syncing. It is not used for any other purpose.
Calendar reminders (optional): only tasks where you set Details → Reminder create events, in the "DoTo" calendar in your Google account (or your primary calendar if calendar creation is not permitted). Events contain the task title, notes, list name, due time and reminder offsets. Completing, deleting, or un-setting the reminder deletes the event. Reminder data is used solely to provide the user-facing reminder feature.
What never happens: no advertising (including retargeting, personalized, or interest-based ads), no sale or rental of data to data brokers, resellers, or ad platforms, no credit-worthiness or lending decisions, no user profiling beyond the features above, and no training of generalized AI/ML models. Google Workspace APIs are not used to develop, improve, or train generalized (non-personalized) AI and/or ML models.

Limited Use disclosure: DoTo's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Data is used only to provide or improve the user-facing features described above, as visible in the app's interface.

4. Sharing, transfer, and disclosure of Google user data

No sale or sharing: we do not sell, rent, or share Google user data with third parties such as advertising platforms, data brokers, or information resellers.
Transfers occur only: (a) between your browser and Google's own APIs to provide the sync/reminder features you requested, with your consent; (b) for security purposes (e.g. investigating abuse); (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, only with your explicit prior consent.
No human access: the app's authors never see your Google data — there is no server to send it to. No human reads the data except as strictly necessary for security, legal compliance, or with your affirmative agreement for a specific support case (e.g. diagnostics text you choose to copy from Sync → History and send).
Agents/contractors: there are none with access. Any future employee, agent, contractor, or successor will comply with this policy and the Google API Services User Data Policy.

5. Data retention and deletion

In your browser: app state (doto-v1), sync metadata (doto-sync: email, access token, Drive file id, last-synced snapshot), sync history (doto-sync-log, last ~50 events), calendar link (doto-cal, deletion queue), theme, and weather cache are kept in your browser's localStorage until you clear site data or sign out. Clearing site data deletes all of it.
In your Google account: the sync file (doto-state.json in Drive's hidden app folder) and any reminder events (in your "DoTo" or primary calendar) persist until you delete them. Completing/deleting a task or switching its reminder off deletes its event. Signing out of DoTo keeps your local copy but stops all network access; to erase the cloud copies, delete doto-state.json from Drive (Settings → Manage apps → DoTo → Delete hidden app data, or via Drive API) and delete the "DoTo" calendar's events. Revoking access in your Google account permissions immediately stops future access.
Access tokens: short-lived (~1 hour) OAuth access tokens are kept only in your browser and renewed silently on demand. There is no DoTo-side retention — we have no server copy to retain.
Deletion requests: because there is no DoTo server, there is nothing to request from us. Delete local data via clearing site data, and cloud data via your Google account as described above. Questions: see §11.

6. Data protection mechanisms

Encryption in transit: all communication with Google (sign-in, Drive, Calendar, userinfo) uses HTTPS/TLS. OAuth tokens are sent only in Authorization: Bearer headers over HTTPS, never in URLs or plaintext.
Encryption at rest: Google-side copies are protected by Google's infrastructure encryption. Browser-side copies rely on your device's storage protections; the app never writes tokens or task data to any third-party server.
Least privilege: the app requests only the five narrow scopes in §2 and stores OAuth tokens only in your own browser's localStorage. Tokens expire after ~1 hour, are refreshed only when needed, and are deleted from the browser on sign-out. Revoked or expired tokens are discarded and never reused.
No credential exposure: the OAuth client ID is public by design (it identifies the app); the client secret pattern is not used in this pure client-side app, and access tokens are never embedded in shared URLs, logs, or exports. The diagnostics view (Sync → History → Copy diagnostics) shows only token presence/expiry, never token values.
Access control: with no DoTo backend, there is no third party that can access your data. Sync and reminder requests originate from your browser under your own Google grant, which you can revoke at any time in your Google account security settings.
Secure development: the app is fully open source (github.com/arazgray/doto) so all data handling is auditable; dependencies are limited to Google Identity Services and Google APIs loaded over HTTPS.

7. Data stored in your browser

Key	Contents
`doto-v1`	Lists, tasks, subtasks, time records, view, filters, color labels, your name, panel sizes
`doto-sync`	Google sync metadata: your email, short-lived access token + expiry, Drive file id, last-synced snapshot
`doto-sync-log`	Recent sync history (last ~50 events, kept for diagnostics; contains no token values)
`doto-cal`, `doto-cal-queue`	Linked Google Calendar id and pending calendar deletions
`doto-theme`, `doto-loc`	Theme choice; weather location (7-day cache)

Clearing your browser's site data deletes all of this. Export a JSON backup first (Sync dialog → Export) if it matters to you.

8. Google Drive sync (optional) — details

Only if you sign in with Google. Sign-in runs in Production mode, so the grant persists. Short-lived access tokens stay in your browser only and are renewed silently on demand. Signing out (or revoking access in your Google account) stops all sync; your local copy stays on the device.
A single file (doto-state.json) in your Drive's hidden app folder holds your lists/tasks. Nothing else in your Drive is accessible to the app.

9. Google Calendar reminders (optional) — details

Only tasks where you set Details → Reminder create events. Completing, deleting, or un-setting the reminder deletes the event. Moving the due date moves the event.
The app reads only your calendar list (to find the "DoTo" calendar) and manages only events it created. It does not read your other calendar events.

10. Weather card (Home view)

The weather card fetches forecasts from Open-Meteo and resolves location via the browser geolocation API with BigDataCloud/ipapi.co fallback. This is the only non-Google network traffic the app makes, and only for that card.
Location is cached for 7 days (doto-loc) and never sent anywhere except those weather providers. No Google user data is ever sent to weather providers.

11. Your control

Work fully offline and never sign in — then nothing leaves the device at all (except the weather card if you view Home with internet).
Export or delete your data any time (Sync dialog → Export; clearing site data removes everything local).
Revoke Google access any time in your Google account security settings; already-created calendar events and the Drive sync file stay in your Google account until you delete them (see §5).
Review or revoke the app's scopes at any time on Google's consent screen; removing a scope disables the feature that needs it (e.g. removing Calendar scopes disables reminders).

12. Changes and contact

This policy may be updated when the app's data use changes; the date above will change and the app will request your consent to the updated policy before using data in any new way. Questions or deletion help: open an issue at github.com/arazgray/doto/issues. Also see the Terms of Service and the in-app Manual.