Privacy Policy

Tasks, notes (with their edit history), shopping and wish lists, expenses, subscriptions, expense splits with the names of the people you add to them, item photos and settings are stored on your device. They reach us only when you share them with others, turn on account sync, or use the AI assistant. Backups are made by your phone's system according to your settings.

We send the text of your request, the context it needs (a part of a note, your task list, budget data, receipt text recognized on your phone), a random installation identifier and, if you are signed in, your account identifier. Purpose: carrying out the request and counting Premium usage. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). We do not store the content of requests; we keep usage counters and token statistics without content. The text is processed by Anthropic PBC (USA) as a processor, under commercial API terms that exclude training models on this data. Photos never leave your phone — the system reads the text from them on the device.

When the assistant looks something up online, the queries are composed by the model and run on Anthropic's side. You can turn this off in the app's Settings.

If you connect your Dodo account to Claude (Anthropic) or ChatGPT (OpenAI) with Dodo Premium, these services — on your instruction given in their app — read from our server and change your tasks, notes, shopping and wish lists, expenses and subscriptions: from your account sync and from the shared lists you belong to, within your permissions. In shared lists this can include content added by other people. You choose whether the connection is view-only or can also make changes; it cannot delete anything. For each request we send only the data needed to answer it. Once transferred, the data is processed by Anthropic or OpenAI as a separate controller, under the terms of your account with them and their privacy policy — not on our behalf.

When you connect and use it, we store: a hash of the one-time code from the app (valid for 10 minutes), the name and redirect address of the connecting app, the chosen scope (view or changes), the connection date and last use, your phone's time zone, currency and language at the time of connecting, hashes of access tokens, and daily call counters without content (an abuse limit). We do not store the content of requests or responses. Purpose: providing the service you ask for. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). You can remove the connection in the app (Profile → Claude and ChatGPT → Disconnect) — access ends immediately. It is also removed after 180 days without use and together with your account. When Premium expires, the connection returns no data until you renew. Whatever has already reached Claude or ChatGPT (such as conversations) can be deleted in their settings.

E-mail address, first name, sign-in method (Apple, Google or an e-mail code), hashed session tokens, the creation date, the app language at sign-up (we send e-mails in it) and your Dodo ID — a random account code you can give to friends so they can invite you to a shared list without knowing your e-mail. Purpose: passwordless sign-in, linking purchases to your account, shared lists and sync. Legal basis: performance of a contract. E-mail sign-in codes are valid for 10 minutes. You can delete your account in the app (Profile → Delete account), together with its sessions, invitations, membership in shared lists and sync data.

If you add a profile photo while signed in, we store it on our server (scaled down to 512×512 pixels) so that the people you share something with can see it next to your shared lists. No one else can download it. Purpose: showing who is in a shared list. Legal basis: performance of a contract. You can remove the photo in your profile; it is also deleted with your account.

The content of synced and shared lists, notes, budget and expense splits, as well as the first name and e-mail of the people who belong to them, is kept on our server so that your phones and the people you invite see the same changes. Shared items are visible only to the people you invite — by e-mail, Dodo ID or link. When you invite someone by Dodo ID, they see only your first name and you see only theirs, not their e-mail. The data is removed from the server when sharing ends, sync is turned off, or the account is deleted; everyone keeps a copy on their phone.

If you allow it, your phone sends us its notification token, system type, language, currency and the areas you don't want to be notified about. When someone changes a shared list, note, budget or expense split, the other members get a notification with the list name, the author's first name and a short description of the change (e.g. “Anna adds expense “Coffee” · €3.50”). We do not store notification content — it is created at the moment of sending and delivered through the Apple Push Notification service or Google Firebase Cloud Messaging. The token is removed when you sign out, when the session expires, when you delete your account or uninstall the app. You can turn notifications off in the app's or your phone's settings.

When Dodo Premium is activated we store the store's subscription identifiers (original and latest transaction), the product and the expiry date; when you buy extra AI uses, the transaction identifier, product and date. Purpose: linking the purchase to your account or installation, checking whether the subscription is active, counting the shared usage pool and handling refunds. We never see card details — only Apple or Google has them. Transaction records are kept for as long as tax law requires.

Sign-in codes, the welcome message, invitations to shared lists, notices about new members and the account deletion confirmation are sent through Resend (an e-mail provider), which receives only the address and the message content.

If you write to us through the form on dodo.n3osystem.io, we receive your e-mail address, your name (if you give it), the topic you chose and your message, plus the page language, the country derived from your IP address and your browser name. The message goes through our server on Cloudflare to the n8n automation tool, which stores it in a Supabase database; we read and answer it from there. Purpose: replying to your message. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). We keep messages for up to 12 months after the matter is closed.

Our server on Cloudflare briefly records the IP address and request metadata for security and rate limiting. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Camera and photos: scanning happens on your phone and images are not uploaded. Calendar: the app keeps its own “Dodo” calendar with task due dates and payments. Face ID: the lock is handled by the system; we have no access to biometric data. Reminders about tasks and payments are local.

If you connect Dodo to Google Calendar (Settings → Calendar), the app asks Google for access only to calendars it creates itself (the calendar.app.created scope). It creates a “Dodo” calendar in your account and adds task due dates and subscription payments to it — it cannot see your other calendars or events. The connection runs directly between your phone and Google: the access token is kept in your phone's keychain, and our server receives neither the token nor any calendar data. When you disconnect (Settings → Calendar → Disconnect), the app deletes the “Dodo” calendar and revokes access; you can also revoke it at myaccount.google.com/permissions. Dodo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.