Privacy Policy

Privacy Policy · Effective September 17, 2026

This Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

1. Who we are

This Privacy Policy (“Policy”) governs the processing of personal data through the doot website at dootit.com and the doot application at app.dootit.com (together, the “Service”). The Service is operated by Hum and Spark, a sole proprietorship registered in Bengaluru, Karnataka, India (“doot,” “we,” “us”).

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), doot is the controller / data fiduciary in respect of personal data processed through the Service.

2. Scope

This Policy applies to personal data we collect from or about (i) visitors to dootit.com, (ii) registered users of the doot application, and (iii) individuals who contact us by email or other means. It does not apply to third-party services that you may access through links or integrations from the Service; those services are governed by their own privacy policies.

3. Categories of personal data we collect

3.1 Account data

When you create an account, we collect your email address and an authentication credential. If you authenticate via Google, we receive the email address, display name, and avatar associated with the Google account; we do not receive your Google password.

3.2 Profile data

You may optionally provide a display name and avatar selection within the Service. These are stored in your user metadata.

3.3 Content you create

This includes (i) tasks, lists, recurrence rules, reminders, and notes that you create within the Service, and (ii) free-form text or audio you submit through the Brain Dump feature for processing into structured tasks.

3.4 Voice input

If you use voice Brain Dump, your audio is streamed to a third-party transcription provider (see Section 7). The audio is processed in real time for transcription and is not retained by us; the resulting transcript is processed by an AI provider to extract structured tasks (see Section 7) and is then discarded.

3.5 Subscription and billing data

If you subscribe to a paid plan through dootit.com or app.dootit.com, our payment processor Paddle (see Section 7) collects and processes your name, billing address, country, payment instrument, and tax identifiers as required for tax determination. We receive only the subset of this data necessary to manage your subscription: subscription identifier, plan, status, country, and event timestamps.

If you subscribe through the Apple App Store on an iOS device, Apple Inc. processes the transaction directly under its own privacy policy. We do not receive your payment instrument, billing address, or other financial details. Apple shares only the subscription identifier, status, and renewal events with our subscription-management provider (RevenueCat, see Section 7), which forwards the same data to us via webhook for the limited purpose of unlocking Pro features in your account.

3.6 Technical data

When you use the Service, our infrastructure providers automatically log technical information including IP address, user agent, request URLs, response codes, and timestamps. Our error-monitoring tooling (Sentry) captures uncaught exceptions, stack traces, and the URL, route, and user identifier associated with the error. By default, we suppress automatic capture of cookies, IP address, and authorization headers in error events.

3.7 Communications

If you email us, we retain the email and our reply for support, audit, and dispute-resolution purposes.

3.8 Usage analytics

We collect first-party usage analytics through PostHog (see Section 7) to understand how the Service is used and to improve it: feature-usage events (for example, a task was created or a focus session completed), screen and page views, and session recordings in the mobile app and the web application in which all text you type is masked before it leaves your device. Analytics are keyed to a pseudonymous user identifier; we do not send your email address, display name, task content, or Brain Dump content to our analytics provider.

3.9 Advertising measurement

To measure the effectiveness of our advertising, the doot iOS app includes the Meta (Facebook) SDK. If, and only if, you allow tracking when the iOS App Tracking Transparency prompt is shown, the app shares your device’s advertising identifier (IDFA) and app events (app install, app launch, account registration) with Meta Platforms, Inc. so that installs and sign-ups can be attributed to our ads. Our subscription-management provider (RevenueCat, see Section 7) additionally forwards trial-start and subscription events to Meta server-side for the same attribution purpose. If you decline the prompt, no advertising identifier is shared and Meta receives no data that identifies your device for tracking purposes. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking. Meta processes this data as an independent controller under its own privacy policy.

On the web, dootit.com and app.dootit.com load the Meta Pixel, which sets first-party cookies (_fbp, and _fbc when you arrive from a Meta ad) and reports page views to Meta. When you arrive from an ad, we pass the ad’s click identifier and campaign tags from dootit.com to app.dootit.com so the visit stays linked to that ad. When you create an account, view the upgrade page, start checkout, or start a trial or subscription, we send that event to Meta from both your browser and our servers, together with your email address and account identifier in hashed (SHA-256) form, your IP address, your browser user agent, and the cookies above. The purpose is to measure which ads lead to sign-ups and subscriptions. We never send your task content or Brain Dump content to Meta. You can block these cookies in your browser settings or with a content blocker without affecting the Service.

3.10 Google Calendar data

In the doot web application you may choose to connect a Google account so that your calendar events appear next to your tasks. Connecting is optional and off by default. If you connect, you grant doot read-only access through two Google permissions:

How we use it. We use Google Calendar data only to show your own events to you inside the Service, next to your tasks. We do not use it for any other purpose.

What we store. Event details are read from Google each time you open a page that shows them and are not saved to our database. We store only what is needed to keep the connection working: your Google account email address (which is also the identifier of your primary calendar), the identifiers of the calendars you chose to show, your preferred time zone, and the access and refresh tokens Google issues to doot. The tokens are encrypted with AES-256-GCM before they are saved and can be read only by our servers.

What we do not do. We do not sell Google user data. We do not share it with third parties, except with the infrastructure providers in Section 7 that host and run the Service, to the extent needed to provide this feature. We do not use it for advertising, and we do not send it to Meta, PostHog, or any analytics provider. We do not send it to our AI providers, and we do not use it to develop, improve, or train artificial intelligence or machine learning models. No person at doot reads your calendar data unless you ask us to for support, it is necessary for security or to comply with the law, or it has been aggregated and anonymised for internal operations.

Disconnecting and deletion. You can disconnect Google Calendar at any time in Settings → Calendar. Disconnecting revokes doot’s access at Google and deletes the stored connection, including the tokens, immediately. Deleting your doot account does the same. You can also remove doot’s access from your Google Account at myaccount.google.com/permissions, after which doot can no longer read your calendar.

Limited Use. doot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Separately, the doot iOS app can show events from the calendars on your device and add your tasks to a calendar named “Doot” that the app creates for itself, if you allow calendar access when iOS asks. That data is read and written on your device through iOS and is not sent to our servers.

4. What we do not collect

5. Purposes and legal bases for processing

We process personal data for the following purposes and on the following legal bases (Article 6 GDPR):

We do not engage in profiling or solely-automated decisions that produce legal or similarly significant effects for you. The AI-assisted task extraction in Brain Dump is intended to assist your decisions, not replace them; you review and accept extracted tasks before they are saved.

6. Use of AI providers in the Brain Dump feature

When you use Brain Dump, doot relies on two third-party AI services that act as our sub-processors (see Section 7). Both are bound by contract to process content only on doot’s behalf, and not to retain it, use it to train or improve models, or share it with any further third party.

Before any data flows to either provider, you are shown an in-app consent screen during your initial onboarding of the doot mobile app — immediately before the Brain Dump feature becomes available — that names both providers explicitly and describes this data flow. You must accept that consent before any Brain Dump call can be made.

7. Sub-processors

We rely on the following sub-processors to provide the Service. Each is bound by a contract that imposes data-protection obligations consistent with GDPR Article 28 and equivalent provisions of the DPDP Act and other applicable laws.

This list is current as of the effective date above. We may add or replace sub-processors from time to time; material changes will be communicated by email to active users at least thirty (30) days in advance, save where a change is required for security or legal reasons.

8. International transfers

Some of the sub-processors listed above are established outside India and outside the European Economic Area (“EEA”). Where personal data is transferred from the EEA or the United Kingdom to a country that is not the subject of an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) or equivalent UK International Data Transfer Agreement, supplemented where appropriate by additional technical and organisational measures.

Where personal data is transferred from India to a country outside India, the transfer is made in accordance with the requirements of the DPDP Act and any rules issued thereunder. By using the Service, you acknowledge and consent to such transfers.

9. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

10. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, or destruction, including: encryption in transit (TLS) and at rest (AES-256 on the underlying infrastructure), one-way hashing of authentication credentials, role-based access controls limiting administrative access to a need-to-know basis, server-side row-level security on the database, secure secrets management, and regular review of access and audit logs.

No system can be guaranteed to be secure. In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the competent supervisory authority within the timeframes required by applicable law.

11. Your rights

Subject to applicable law, you have the following rights in respect of your personal data:

To exercise any of these rights, email aditya@humandspark.com. We will respond within thirty (30) days. We may need to verify your identity before fulfilling certain requests.

You may also delete your account directly in the application at Settings → Delete account. Account deletion immediately removes your tasks, lists, profile, and other application data, and revokes and deletes any Google Calendar connection; data may persist in encrypted backups for up to seven (7) days as set out in Section 9.

12. Cookies and similar technologies

We use cookies and similar browser storage in three groups:

You can block or delete cookies in your browser settings, or block the analytics and advertising cookies with a content blocker. Blocking strictly necessary cookies will sign you out and may stop checkout or calendar connection from working; blocking the others does not affect the Service.

13. Children

The Service is not directed to, and we do not knowingly collect personal data from, children under the age of thirteen (13). In the European Economic Area, we do not knowingly collect personal data from children below the age of digital consent established by the relevant Member State (between 13 and 16). If we learn that we have inadvertently collected personal data from a child without verifiable parental or guardian consent, we will delete that data without undue delay.

14. Grievance Officer (India)

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, we have appointed a Grievance Officer to address concerns related to the Service:

The Grievance Officer will acknowledge complaints within twenty-four (24) hours and resolve them within fifteen (15) days. If you are not satisfied with the resolution, you may escalate to the Data Protection Board of India.

15. Changes to this Policy

We may amend this Policy from time to time. The version in force is identified by the effective date at the top of the page. Where amendments are material, we will notify active users by email at least thirty (30) days before the new version takes effect, save where a change is required by law to take immediate effect.

16. Contact

For questions about this Policy or the processing of your personal data, contact us at aditya@humandspark.com. For general support, contact aditya@humandspark.com.