Privacy Policy

Last updated: September 19, 2026. Short version: Dotoist has no third-party cloud and collects nothing itself. Your tasks stay in your browser unless you turn on blog sync or reminders, which communicate only between your browser and your own blog. This policy explains exactly which data the app accesses, how it uses it, whom it shares it with, how long it keeps it, and how it protects it.

1. Data Dotoist itself collects

None. There is no Dotoist account, no analytics, no tracking, no crash reporting, and no advertising. The authors of Dotoist cannot see your tasks unless you enable blog sync — and then only your own blog account holds the copy. Data moves only between your browser and your blog (when you enable sync/reminders), or to the weather providers for the Home weather card (see §9).

2. Blog data the app accesses

Dotoist accesses your blog only after you connect with an emailed one-time code (Sync & Settings → email → code → Connect). The app uses a single token-scoped API, and nothing else:

Endpoint	Data accessed	Why it is needed (use)
`POST /api/dotoist/token/request`	Any email address you enter.	Sends a one-time 6-digit code to that address (a lightweight sync-only account is created on first use; it can never log into the blog itself).
`POST /api/dotoist/token/verify`	The email plus the code.	Exchanges a valid unused code for a sync token (single use, 15-minute expiry).
`GET /api/dotoist/me`	Your blog account email and name.	Display only ("Connected as …"). Never used for marketing or shared with anyone.
`GET /api/dotoist/state`	The synced copy of your lists, tasks, subtasks, notes, time records and settings.	Multi-device sync. The app reads this to pull changes from your other devices. It cannot see anything else on the blog.
`PUT /api/dotoist/state`	Uploads the same synced copy.	Pushing your edits. Revision-checked, so a concurrent push merges instead of overwriting.
`POST /api/dotoist/push/subscribe`	Browser push subscription (endpoint + keys), when supported.	Reserved for future direct push delivery. Email reminders already work without it.

The app does not access your blog posts, comments, subscribers, or any other blog data.

3. How the app uses blog data

Blog sync (optional): when you connect, a copy of your lists/tasks is stored in your own blog's database. Sync traffic goes directly between your browser and your blog; no intermediary server is involved. Data is used solely to provide the user-facing sync feature: uploading your edits, downloading edits from your other devices, and merging them.
Email address: shown in the Sync & Settings dialog ("Connected as …") so you can confirm which account is syncing, and used as the recipient of reminder emails. It is not used for any other purpose.
Reminders (optional): only tasks where you set Details → Reminder notify you — as a browser pop-up on devices where you tapped Notify, plus an email from the blog scheduler. The email contains the task title, notes, list name and due time. Reminder data is used solely to provide the user-facing reminder feature.
What never happens: no advertising (including retargeting, personalized, or interest-based ads), no sale or rental of data to data brokers, resellers, or ad platforms, no credit-worthiness or lending decisions, no user profiling beyond the features above, and no training of generalized AI/ML models.

4. Sharing, transfer, and disclosure of data

No sale or sharing: we do not sell, rent, or share your data with third parties such as advertising platforms, data brokers, or information resellers.
Transfers occur only: (a) between your browser and your own blog to provide the sync/reminder features you requested; (b) for security purposes (e.g. investigating abuse); (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, only with your explicit prior consent.
No human access: no human reads the data except as strictly necessary for security, legal compliance, or with your affirmative agreement for a specific support case (e.g. diagnostics text you choose to copy from Sync → History and send).
Agents/contractors: there are none with access. Any future employee, agent, contractor, or successor will comply with this policy.

5. Data retention and deletion

In your browser: app state (dotoist-v1), sync metadata (dotoist-sync: sync token, account email, last-synced snapshot + revision), sync history (dotoist-sync-log, last ~50 events), notification state (dotoist-notif-seen, dotoist-notify-last), theme, and weather cache are kept in your browser's localStorage until you clear site data or disconnect. Clearing site data deletes all of it.
On your blog: the synced state and sent-reminder records persist until you delete them. Disconnecting a device keeps its local copy but stops all network access; to erase the server copy, delete the row or revoke the token on the blog. Revoking a token immediately stops future access from that device.
Sync tokens: long-lived bearer tokens kept only in your browser (and as a hash on the blog). There is no expiry loop — revoke on the blog to kill one.
Deletion requests: delete local data via clearing site data or Disconnect, and server data via your blog as described above. Questions: see §11.

6. Data protection mechanisms

Encryption in transit: all communication with the blog uses HTTPS/TLS. Sync tokens are sent only in Authorization: Bearer headers over HTTPS, never in URLs or plaintext.
Encryption at rest: blog-side copies are protected by the blog's database and hosting protections. Browser-side copies rely on your device's storage protections; the app never writes tokens or task data to any third-party server.
Least privilege: the app uses one narrow token-scoped API (sync state + account display + push subscription) stored only in your own browser's localStorage. Tokens are deleted from the browser on Disconnect and can be revoked server-side at any time.
No credential exposure: tokens are never embedded in shared URLs, logs, or exports. The diagnostics view (Sync → History → Copy diagnostics) shows only connection state and revisions, never token values.
Access control: sync requests originate from your browser under your own token grant, which you can revoke at any time on the blog.
Secure development: the app is fully open source (github.com/arazgray/dotoist) so all data handling is auditable; the frontend ships no third-party SDKs.

7. Data stored in your browser

Key	Contents
`dotoist-v1`	Lists, tasks, subtasks, time records, view, filters, color labels, your name, panel sizes
`dotoist-sync`	Blog sync metadata: sync token, account email, last-synced snapshot + revision
`dotoist-sync-log`	Recent sync history (last ~50 events, kept for diagnostics; contains no token values)
`dotoist-notif-seen`, `dotoist-notify-last`	Notifications inbox read state and last shown browser notification
`dotoist-theme`, `dotoist-loc`	Theme choice; weather location (7-day cache)

Clearing your browser's site data deletes all of this. Export a JSON backup first (Sync dialog → Export) if it matters to you.

8. Blog sync (optional) — details

Only if you connect with an email code. Tokens are issued automatically on verify and are long-lived by design, so the connection persists. Disconnecting (or revoking the token on the blog) stops all sync; your local copy stays on the device.
A single state record on the blog holds your lists/tasks. Nothing else on the blog is accessible to the app.

9. Blog reminders (optional) — details

Only tasks where you set Details → Reminder notify you. Completing, deleting, or un-setting the reminder cancels it. Moving the due date moves the reminder.
The app reads nothing except your own synced tasks to deliver them. Browser pop-ups need the Notify permission on each device; emails need the blog scheduler running.

10. Weather card (Home view)

The weather card fetches forecasts from Open-Meteo and resolves location via the browser geolocation API with BigDataCloud/ipapi.co fallback. This is the only third-party network traffic the app makes, and only for that card.
Location is cached for 7 days (dotoist-loc) and never sent anywhere except those weather providers. No task or account data is ever sent to weather providers.

11. Your control

Work fully offline and never connect — then nothing leaves the device at all (except the weather card if you view Home with internet).
Export or delete your data any time (Sync dialog → Export; clearing site data removes everything local).
Revoke a sync token any time on the blog; already-synced data stays on the blog until you delete it (see §5).
Each device holds its own token — disconnect one without affecting the others.

12. Changes and contact

This policy may be updated when the app's data use changes; the date above will change and the app will request your consent to the updated policy before using data in any new way. Questions or deletion help: open an issue at github.com/arazgray/dotoist/issues. Also see the Terms of Service and the in-app Manual.