Privacy Policy

Last updated: 18 September 2026

Do One Thing ("D1T", "we", "us") is a focus app: one thing at a time, plus the lists, notes, events and nudges around it. This policy explains what information we hold when you use it, why we hold it, and the choices you have. We've written it to be read, not skimmed past — it's short because we genuinely don't collect much.

Who we are

Do One Thing is operated by its owner, based in the United Kingdom, who is the "data controller" for your information under UK data protection law (UK GDPR and the Data Protection Act 2018). You can contact us about anything in this policy at [email protected].

What we collect

• Your account — email address, the name you give us, and your sign-in method. If you use Sign in with Apple we receive the identifier Apple issues (and, if you share it, your name and email or Apple's private relay address). We never see your Apple password.
• Your content — the tasks, notes, quotes, events, journal entries, drops, labels and images you create in the app. This is your stuff; we store it to show it back to you.
• Your preferences — theme, time zone, app icon choice, notification and nudge settings, chosen covers and avatar.
• Optional onboarding answers — during setup we ask how your brain works (e.g. ADHD, autistic, anxious mind) and what you struggle with. These questions are optional, have a "prefer not to say" answer, and exist only to shape the app around you. See "Sensitive information" below.
• Calendar feeds you add — if you connect an external calendar we store its address and the events it publishes, and refresh them read-only. We never write to your calendar.
• Device tokens — if you allow notifications, the push token Apple issues for your device, so nudges can reach you.
• Subscription status — which plan you're on and whether it's active. Payment happens entirely through Apple: we never see your card details.
• Technical basics — server logs and error reports (which may include your account id and IP address) so we can keep the service running and fix crashes.

What we don't do

• No advertising, and no selling or renting your data to anyone — ever.
• No cross-site tracking and no third-party analytics or advertising cookies. The only cookies we set are the ones that keep you signed in and remember basics like your time zone.
• No scanning or profiling of your content. Your tasks and notes are read by the software only to show them to you and to send the reminders you asked for.

Product emails

During setup we ask — optionally, and never pre-ticked — whether you'd like emails about new features, tips for getting more out of D1T, and the occasional question about how it's working for you. Saying no changes nothing about the app; every part of it works the same either way. If you say yes we record that you consented and when, and we use your email address for nothing else: no advertising, no selling or sharing your address, no passing it to a third-party marketing platform. Every one of those emails has an unsubscribe link, and you can also turn them off any time from your profile on the web.

Sensitive information

Your optional answers about how your brain works and what you struggle with may be "special category" data under UK law. We only hold them with your consent — you choose whether to answer at all — and we use them for nothing beyond tailoring the app's experience and content to you. They're never shared for marketing and never sold. You can withdraw consent at any time: email us and we'll remove them, or delete your account, which removes everything. Please also be thoughtful about what you put in tasks, notes and images — the app doesn't stop you writing sensitive things, so treat it like a private notebook and share your account with no one.

Why we're allowed to use your data

• To provide the service you signed up for (contract) — your account, content, preferences, device tokens and subscription status.
• With your consent — the optional onboarding answers, product emails, and notifications (all of which you can switch off any time).
• Legitimate interests — keeping the service secure, working and improving: server logs, error reports and rate limiting.

Where your data lives

We use a small set of well-known providers to run Do One Thing, each processing data only on our instructions:

• Heroku (Salesforce) — application hosting and database.
• Amazon Web Services — image storage (S3) and email delivery (SES), in the United States.
• Cloudflare — content delivery and security in front of the site.
• Apple — Sign in with Apple, push notifications, and all payment processing.
• RevenueCat — subscription management (they receive your app user id and Apple's purchase receipt, not your name or content).
• Honeybadger and Skylight — error and performance monitoring, so we find out about crashes before you have to tell us.

Some of these providers store data in the United States. Where data leaves the UK we rely on the safeguards UK law provides for international transfers — the UK's adequacy decisions and the approved standard contractual terms in our providers' data processing agreements.

Security

All traffic to and from Do One Thing is encrypted in transit (HTTPS), data is encrypted at rest by our storage providers, and the content you write — the body text of your tasks, notes and quotes, event notes, and Nudge Diary entries — plus sign-in credentials for connected services are additionally encrypted at the field level in our database. Titles and names are not field-level encrypted, because search, your lists and your reminders need to read them — so put anything sensitive in the body of an item, not its title. Access to production data is restricted to the operator. No online service can promise perfect security, so we deliberately keep the data we hold to a minimum — but if we ever discover a breach that affects you, we'll tell you and the ICO as UK law requires.

How long we keep things

Your account data and content are kept while your account exists. When you delete your account, everything it contains — tasks, notes, events, journal entries, images, device tokens, the lot — is permanently deleted from the live service straight away, and ages out of our short-term backups shortly after. Server logs and error reports are retained briefly by our monitoring providers and then expire.

Your rights

UK data protection law gives you rights over your data: to see a copy of it, to correct it, to have it deleted, to restrict or object to how it's used, to take it with you in a portable format, and to withdraw consent for anything consent-based. You can export a copy of your data yourself, any time: Export my data on your profile page emails you everything in your account as a single file, and the delete-account confirmation offers the same copy before anything is erased. For anything else, email [email protected] and we'll act on any of these — usually well within the one-month legal window. If you're unhappy with how we've handled your data you can complain to the UK's Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.

Deleting your account

You can delete your account yourself, any time, from Settings in the app or from your profile on the web — no email required, no retention tricks. Cancelling a subscription is separate (that happens in your App Store settings), so remember to cancel there too if you subscribed.

Children

Do One Thing isn't directed at children under 13, and we don't knowingly hold accounts for them. If you believe a child is using the service, contact us and we'll remove the account.

Changes to this policy

If we change this policy in any meaningful way we'll update the date at the top and, for significant changes, tell you in the app before they take effect. We won't quietly start doing something this page says we don't do.