How your data is protected

This page explains, in plain terms, what Thendoo does with the sensitive parts of your account. It describes how the software works today. It isn’t a legal privacy policy, and the full policy is still being written. TODO-verify: link to the published privacy policy once /legal/privacy has its final text.

Secrets are encrypted separately

The most sensitive things Thendoo holds are keys to other places: your Google sign-in and calendar tokens, your ClickUp token and your two-step sign-in secret. These are encrypted with AES-256-GCM using envelope encryption:

• Every account has its own data key.
• That data key is itself locked by a master key that lives in the server’s configuration, not in the database.
• Each encrypted value is tied to the record it belongs to, so it can’t be copied onto another one.
• The master key can be rotated.

Files you attach in Life admin, like passport scans, are also stored encrypted. Passwords aren’t stored at all, only a one-way Argon2id hash. For ID numbers, Life admin keeps only the last four characters.

What isn’t end-to-end encrypted

Caution

Your everyday content (tasks, Docs, habits, transactions and the rest) is not end-to-end encrypted. It sits in the database in a form the server can read, which is what lets search, reminders and Today work. Whoever runs the server can technically access it.

Meeting recordings and AI

The Meetings page is the only part of Thendoo that uses AI, and only for a recording you choose to make or upload after confirming everyone knows. The audio is encrypted with your account’s own data key and, by default, deleted once the notes are written. Transcripts and notes are stored like your Docs, not separately encrypted.

Which speech and AI services are used is set by whoever runs the server, not by you. A service can run on that server or be a cloud service; Settings → AI & meetings shows which kind your server uses. Turn on AI: local only there to make sure your meeting audio and transcripts never go to a cloud service. Prompts, transcripts and AI answers are never written to logs.

What stays out of logs

Server logs automatically strip passwords, tokens, cookies, keys and sign-in tokens, including credentials hidden inside web addresses. When a sync with Google or ClickUp fails, only the type of error is logged, not what was in your calendar or tasks.

How sign-in is guarded

• Sign-up is limited to 10 per hour from one network address.
• Sign-in is limited to 30 attempts per 10 minutes from one address, and 10 per 15 minutes for one email.
• Two-step codes are limited to 8 attempts per 15 minutes.
• Browsers are told to use HTTPS only and not to load Thendoo inside other sites’ frames. The one exception is public booking pages (/book/…), which any website may embed so you can put your booking page on your own site.

Turning on two-step sign-in is the biggest single step you can take yourself.

Running your own server

Thendoo can run entirely on a server you control, with one command, and nothing in it depends on our infrastructure. Your data then never touches a Thendoo-operated server. The exception is any outside service you or your admin choose to configure, such as a cloud speech or AI service for meeting notes or an email relay for booking emails.

On your own server, you hold the master key, so protecting it is your job. Built-in backups are not encrypted and don’t include the master key, so store them somewhere private and keep a separate copy of the key. Without it, encrypted secrets in a restored backup can’t be read, and you’d need to reconnect your services.

What we don’t claim

We don’t currently claim certification under any security or privacy standard. TODO-verify: hosted-service details (where the cloud edition is hosted, data location, retention of server backups) once the hosted service exists.