1. Who we are & scope

DoneIt is a productivity and collaboration app offering task and list management, project/version collaboration, team/company organization, instant messaging (text/images/files/voice messages and voice calls), office space features, smart notes and AI assistance, language learning, notifications, and related services.

This Policy explains how we collect, use, store, share, and protect personal information, and the rights you may have. It applies to access via web, desktop, iOS, Android, and other clients we provide.

It does not cover third-party websites or services you may open from the App.

2. Information we collect

We follow data minimization and collect only what is needed to provide the service, keep it secure, and comply with law.

2.1 Account & identity

• Username, password (hashed/encrypted; we cannot see your plaintext password), access/refresh tokens, and device identifiers for session persistence;
• Profile data you provide (nickname, avatar, DoneIt ID, security code if set, work/presence status);
• Company application materials you voluntarily submit (e.g., company name and supporting documents).

2.2 User content

• Tasks, lists, notes, stickies, projects/versions, team/company data, diagrams, and related collaboration records;
• IM content (text, emoji, images, files, voice), read receipts, pins, favorites, mentions, call records/summaries when used;
• Files you upload (name, type, size, timestamps, and content).

2.3 Communications & AI

• Microphone audio when you record voice messages or place/receive voice calls;
• Speech-to-text / call transcripts only when you explicitly request transcription or summary features;
• Prompts and necessary context you submit to AI features (assistant, release notes, learning TTS, summaries, etc.);
• Push tokens (APNs/FCM) for notifications.

2.4 Device, network & diagnostics

• Device model, OS/app version, language/timezone, client type;
• IP address, request logs, crash/error diagnostics;
• Local preferences, drafts, and caches stored on your device.

2.5 What we do not collect by default

• Precise GPS for advertising/profiling;
• Address book contacts (unless a future feature obtains consent and this Policy is updated);
• Advertising identifiers (e.g., IDFA) for cross-app ad tracking;
• Your entire photo library (we only access items you choose).

3. How we use information

• Provide core product features and multi-device sync;
• Authenticate users and manage sessions/security;
• Deliver in-app and push notifications you enable;
• Enable voice messaging/calls and optional ASR/AI features you trigger;
• Prevent abuse, debug issues, and meet legal obligations;
• Improve reliability and UX using aggregated or de-identified insights where appropriate;
• Respond to support and privacy requests.

4. Legal bases

Depending on applicable law (including China’s PIPL and, where relevant, GDPR-like regimes), we rely on consent, performance of a contract/service necessity, legitimate interests (e.g., security), and legal obligations.

5. Device permissions (including iOS)

You may revoke permissions in system settings. We do not use these permissions for unrelated advertising tracking.

6. Third-party services & SDKs

• Apple APNs — iOS push delivery (push token & notification payload);
• Firebase Cloud Messaging (FCM) — mobile push where configured;
• MiniMax — AI text generation / TTS for features you use;
• ASR (e.g., SenseVoice-based pipeline) — speech-to-text when you request it;
• Hosting / storage / CDN providers — infrastructure for the service.

Third parties process data only as needed for these functions and under their own policies and our contractual controls. We do not sell personal information to advertisers.

7. Sharing, transfer & disclosure

We do not sell your personal information. We may share information:

• With teammates/group members as required for collaboration features you join;
• With processors (hosting, push, AI, ASR) under confidentiality and purpose limits;
• When required by law or to protect vital rights and security;
• In connection with a merger, acquisition, or similar corporate transaction, subject to continued protections or fresh consent where required.

8. International transfers

Primary storage and processing are in the People’s Republic of China. If data is transferred abroad (e.g., certain AI or push infrastructure), we will take measures required by applicable law (contracts, security controls, and consent where mandated). If you access DoneIt from outside China, your data may be transferred to and stored on servers in China.

9. Storage, retention & security

Data is hosted in connection with https://doit.chufeng.me. We retain data while your account is active and as needed to provide the service; after account deletion we generally delete or anonymize personal data within about 30 days, except where law or unresolved disputes require longer retention. We use HTTPS/WSS, hashed passwords, token auth, access controls, backups, and ongoing hardening. No method of transmission or storage is 100% secure.

10. Your rights

Subject to applicable law, you may access, correct, delete, withdraw consent (e.g., revoke OS permissions), request export, and delete your account. We may verify your identity before fulfilling requests and will respond within statutory timelines.

11. Account deletion

You may request account deletion via in-app settings (where available) or by contacting us. After deletion, login will be disabled and personal data will be deleted or anonymized per Section 9, except collaboration records that must remain meaningful for other users (possibly de-identified) or data we must retain by law.

12. Cookies, local storage & tracking

We use cookies/local storage (web/desktop) and on-device secure storage (mobile) for login state, preferences, drafts, and cache. We do not use this for cross-app advertising tracking. If we introduce tracking that requires Apple’s App Tracking Transparency prompt, we will disclose it and request permission.

13. Children’s privacy

The App is not directed to children under 13 (or a higher age required in your jurisdiction). We do not knowingly collect children’s data. Contact us to request deletion if you believe a child has provided information.

14. Apple App Store / App Privacy

For App Store privacy labels, data collected for app functionality may include contact info (account identifiers), user content (messages, photos, audio, other content), identifiers (user/device IDs), and diagnostics, often linked to your account. We currently do not use data for cross-company tracking ads. Third parties (push/AI/ASR) receive data only as described in Section 6 when you use those features. The App Store label is a summary; this Policy is the full disclosure.

15. Changes to this policy

We may update this Policy by posting a revised version with a new “Last Updated” date. Material changes will be communicated via in-app notice or other prominent means, and we will obtain consent again when legally required.

16. Contact us

17. Governing law

This Policy is governed by the laws of the People’s Republic of China (excluding conflict-of-law rules). Disputes should first be resolved amicably; otherwise, courts with jurisdiction over our place of operation may hear the matter.

If there is any conflict between the Chinese and English versions, the Chinese version prevails.