Privacy policy for Thendoo

This policy explains how Agrima, Israel (“Thendoo”, “we”), handles personal data when you use the Thendoo apps, API and this website. We are the controller of that data. Questions or requests: [email protected].

The short version: your content is yours, it’s used only to run Thendoo for you, we don’t sell it or show ads, and you can export or delete it any time.

What we collect

Account data. Your email address, name, password hash (never the password), time zone, language and settings, and whether two-step sign-in is on. If you sign in with Google, we get your Google account’s email, name and an id.

Your content. What you put into Thendoo or sync into it: tasks, lists, habits, events, focus sessions, Docs, files and pictures, links, people and follow-ups, life-admin items, money records and imports, and meeting recordings, transcripts and notes.

Connected services. When you connect a service such as Google Calendar or ClickUp, we store an access token and the items we read to show them in Thendoo, such as your events or the tasks assigned to you. We ask for the narrowest access each feature needs, and only when you first use it.

Payments. Paddle, our reseller and merchant of record, collects your payment details and billing address. We receive only what we need to run your plan: Paddle’s subscription and customer ids, the plan, price, status, billing dates and amounts. We never receive or store your card details, and we don’t keep your name, email or address from Paddle’s messages.

Security records. Sign-ins, two-step changes, exports, deletions, restores and support actions on your account, with the time, and the devices you’re signed in on.

Usage statistics in the app. If the service is set up for it, the app counts which kinds of screens you open (by route, such as “a task”, never which one) and steps such as finishing setup. It never sends what you write, and you’re identified by an internal account number. Recordings of sessions, if switched on, hide all text, typing and images. You can turn this off in Settings → Privacy, and Do Not Track or Global Privacy Control turns it off too. The app also records on which days you were active, to count active users.

Error reports. When something breaks in the app or on our servers, a report goes to our own error tracker, which runs on our servers: what went wrong and where in our code, the kind of page (such as “a task”, never which one), your browser and operating system, the app version, and your internal account number. It never includes what you wrote, the addresses you visited, your email address, passwords or tokens. Reports are deleted after 30 days. They are needed to keep the service working, so they’re sent even if you turn off usage statistics.

The website. Visit counts come from Umami, which sets no cookies and stores no IP addresses: the page, the referring site and campaign tags, country, browser and device type, and clicks on buttons such as sign-up. If we also use PostHog on the website, it loads only after you choose Allow in the cookie banner, and its recordings hide everything you type. With Do Not Track or Global Privacy Control on, it never loads. The free tools on the website run in your browser and send nothing to us.

Support. What you write to us by email, and our replies.

Why we use it

Purpose	Data	Legal basis (GDPR)
Run Thendoo for you: store, sync and show your content, run the features you turn on	Account data, your content, connected services	Contract
Take payments and keep billing records	Payment data from Paddle	Contract; legal obligation
Keep accounts safe and stop abuse	Security records	Legitimate interests
Understand which features help, and fix confusing screens	App usage statistics, website visits	Legitimate interests (you can opt out); consent for PostHog on the website
Find and fix errors and outages	Error reports	Legitimate interests
Answer you	Support messages	Contract; legitimate interests
Send service emails: sign-in links, security notices, receipts, important changes	Email address	Contract

We don’t sell personal data, show ads, or build advertising profiles. We don’t use your content to train AI models.

AI features and recordings

Recordings and other AI features send the recording’s audio to a speech-to-text service and the transcript to an AI model, only to produce your notes. On thendoo.com these features use the AI provider and key you add yourself, under that provider’s terms; we don’t send your content to an AI service you haven’t chosen. The setting AI: local only keeps your data off cloud AI services when the server has local ones. Before every recording or upload of a conversation, Thendoo asks you to confirm that everyone in it knows it’s being recorded. Meeting audio is deleted once the notes are written, unless you choose to keep it.

Google user data

Thendoo’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you connect it for, never for advertising, and people don’t read it except with your permission, for security, or where the law requires.

What Thendoo asks Google for, and why:

Google permission	What it lets Thendoo do
Your email address, name and profile (openid, userinfo.email, userinfo.profile)	Sign you in with Google and show which Google account is connected
See the list of your calendars (calendar.calendarlist.readonly)	Let you choose which calendars appear on Today
See events on your calendars (calendar.events.readonly)	Show your meetings on Today and work out your free time
Create a calendar and manage its events (calendar.app.created)	Only if you turn on time blocks in Google: create one separate “Thendoo” calendar and keep your blocks in it; Thendoo can’t change your other calendars
See and download your contacts (contacts.readonly)	Only when you choose Bring in contacts on People: read your contacts’ names, companies, emails, phone numbers and birthdays into People; Thendoo never changes your contacts
Change events on calendars you own (calendar.events.owned)	Only when you first change a Google event in Thendoo: create, edit, move and delete events and their Google Meet links in calendars you own, never calendars shared with you

Thendoo asks for each permission only when you first use the feature that needs it.

Who processes data for us

We use a few service providers, each bound by a data processing agreement and allowed to use the data only for the service they provide to us:

• Our own servers: Thendoo, its database, files and backups run on servers we operate.
• Cloudflare, Inc.: carries traffic between you and our servers and protects them from attacks. It sees connection data, such as IP addresses, but doesn’t store your content.
• Paddle (Paddle.com Market Ltd): payments, tax and invoices, as merchant of record. Paddle is also a controller for the payment data it collects; see Paddle’s privacy notice.
• Postmark (ActiveCampaign, LLC): sending service emails, such as sign-in links and booking confirmations.
• Google Workspace (Google LLC): our own email, including messages you send to support.
• AI and speech-to-text providers: only the one you choose and connect with your own key, for the AI features you use.
• PostHog (only if we turn it on): product analytics, as described above. It is off today.

Services you connect yourself, such as Google or ClickUp, receive what Thendoo sends them to do what you asked, under their own privacy policies.

We disclose data to authorities only when the law requires it, and we’ll tell you unless we’re not allowed to.

Who at Thendoo can see your data

Nobody at Thendoo reads your content as part of running the service. Our operator console shows only counts and account metadata, such as your email, sign-up date, plan, last active day and how many tasks or events you have. It never shows the content of what you made, money amounts, connected accounts’ details, tokens or recordings. There is no way to sign in as you, and operators can’t download your export. Every console view and action is logged, and actions on your account appear in your Recent activity.

How we protect it

• All traffic is encrypted in transit (HTTPS).
• Access tokens for connected services and meeting recordings are encrypted with a key that belongs to your account, and that key is itself encrypted with a master key kept outside the database.
• Tokens, email bodies, bank data and your content never appear in our logs.
• Two-step sign-in, signed-in device management and limits on repeated sign-in attempts protect your account.

How long we keep it

• Your content and account: while your account exists. When you delete your account, everything stays untouched for 30 days so you can change your mind by signing in, then it’s erased for good. Backups that still hold a copy expire within 14 days.
• Data exports: kept for 7 days, then removed.
• Meeting audio: deleted after the notes are written, unless you choose to keep it.
• Billing records: as long as tax and accounting law requires.
• Activity days for usage counts: up to 400 days.
• Error reports: 30 days.

Your rights

You can see, export, correct and delete your data yourself:

• Export: Settings → Your data → Export my data downloads everything you stored as JSON files. Secrets and password hashes are never included.
• Correct: edit anything in the app, and your name and email in Settings.
• Delete: delete single items, or your whole account in Settings → Your data.
• Object or opt out: turn off usage statistics in Settings → Privacy, and change your cookie choice on the website with Cookie settings in the footer.

Depending on where you live, you may also have the right to restrict or object to processing and to complain to a data protection authority. To use any right, write to [email protected]. We answer within 30 days.

International transfers

Our providers may process data outside your country. Where data leaves the EU, UK or another country with transfer rules, we rely on adequacy decisions or standard contractual clauses.

Children

Thendoo isn’t meant for children under 16, and we don’t knowingly collect their data. If you think a child has given us data, write to us and we’ll delete it.

Changes

If we change this policy in a way that matters, we’ll email you and show a notice in the app before the change takes effect. The date at the top shows the last update.