Privacy
This page says what we keep about you when you use Donna, what we use it for, and where it goes.
When you sign in
You sign in with Google. At sign-in we ask Google for these permissions:
openid- Gives us the identifier Google uses for your account, so we know which account is yours.
email- Gives us your email address. We match it to your invitation and keep it on your account.
profile- Gives us your name. We keep it so items and actions show who made them.
We keep Google’s identifier for your account, your email address and your name. We never see your Google password.
What you add to Donna
Donna keeps what you capture, typed or spoken, and the tasks, projects and comments you make from it. It keeps your settings, and a record of what was done in your account and when.
We use this to show your work back to you and to work out how much you are carrying.
The record of actions names each action, who took it and when. We keep it so every action can be traced, and we do not delete it.
When you speak a capture
We send the recording to Google Cloud Speech-to-Text, which turns it into text. We keep the recording with the capture it made.
If you connect a calendar
The owner of a Donna account can connect a Google Calendar. We ask Google for one more permission, separately from sign-in, and only when the owner chooses to connect:
https://www.googleapis.com/auth/calendar.readonly- Lets Donna read the events on your calendar. Donna never changes your calendar.
We use it for two things: to work out how much of the focus time you have marked on your calendar your meetings take up, and to list the day’s events on your page.
We keep the minutes we worked out and the calendar’s address. We read event titles when your page is shown, and we do not store them.
Google gives us keys to read your calendar. We store them encrypted, and we delete them when you disconnect. To also withdraw Donna’s access in Google, use your Google Account’s security settings.
If you connect Google Drive
The owner of a Donna account can connect Google Drive so we keep a copy of the account’s notes there. We ask Google for one more permission, separately from sign-in, and only when the owner chooses to connect:
https://www.googleapis.com/auth/drive.file- Lets Donna create and update the folder and files it makes in your Drive. Donna cannot see or change anything else in your Drive.
Each night we copy the account’s notes that are not marked Private into that folder, one file for each note. We never delete anything from your Drive. If a note leaves the copy, we move its file into a subfolder.
Google gives us keys to write to your Drive. We store them encrypted, and we delete them when you disconnect. To also withdraw Donna’s access in Google, use your Google Account’s security settings.
If you turn on notifications
Your browser gives us an address for sending notifications to your device, and keys that let us encrypt each message for it. Notifications travel through your browser’s own push service. We stop using the address when you turn notifications off.
Where it is kept
Donna runs on a server we rent from Hetzner, and your data is kept in a Postgres database on it. Each account’s data is kept apart from every other account’s, in the application and again in the database.
Only we, and those we directly authorize, can open that server and database.
Besides Hetzner, data goes to Google for sign-in, for your calendar and your Drive if you connect them, and for speech-to-text if you speak a capture. Notifications go to your browser’s push service.
Asking us about your data
We keep your items until they are removed. Two records stay even then: the record of actions, and the record of your place in an account, which holds your name and email address.
To ask for a copy of what we hold about you, or to ask for it to be removed, write to hello@consmaniacollective.com.