Privacy policy

1 Overview

Plain-language summary: Dozy stores the data you give us to run the app. We use Google Analytics to improve the product. We share limited data with Stripe (payments), Supabase (database and storage), Google and Microsoft (optional calendar integrations), and Email Octopus (transactional and notification emails only). We do not sell your data, ever.

Dozy is a task and project management web application operated by David Kelen (10 Place Sully, 78600 France). This Privacy Policy explains what personal data we collect, why we collect it, and how we handle it when you use dozy.site.

By using Dozy you agree to the practices described here. If you disagree, please discontinue use of the service.

2 Data We Collect

We collect data in two ways: information you actively provide, and information collected automatically as you use the app.

2.1 Data you provide

• Account information includes your email address, display name, and optional nickname when you register.

• Tasks and projects include titles, descriptions, due dates, labels, links, and all content you create inside Dozy.

• Working preferences include the working hours, working days, and timezone you configure in Settings.

• Uploaded files are the files you attach to projects, stored under your account.

• Collaboration data includes the email addresses of people you invite to projects, and messages sent within those invitations or notifications.

• Subscription information includes your plan type and billing records, which are processed through Stripe. We do not store raw card numbers; Stripe handles all payment card data directly.

2.2 Data collected automatically

• Usage analytics include page views, session duration, and feature interactions collected via Google Analytics, as described in Section 5.

• Calendar event metadata is collected if you connect Google Calendar or Microsoft Outlook. We sync event titles and times to enable scheduling, but we do not read the body or attachments of your calendar events.

• Authentication tokens are short-lived OAuth access tokens from Google or Microsoft, stored only for the duration of your calendar session.

• Log data consists of standard server logs that may contain your IP address, browser type, and request timestamps. These are not linked to your Dozy account.

3 How We Use It

• We use your data only for the purposes listed in this section. We do not use it to build advertising profiles or sell it to any third party.

• We use your data to provide the service, including creating and syncing your tasks, projects, calendar events, scheduled sessions, and reminders.

• We use it for account management, including authentication, password resets, and subscription management.

• We use it for calendar integration, connecting your Google or Microsoft calendar so that scheduled tasks appear and stay in sync.

• We use it to provide reminders and notifications, including in-app notifications about task reminders, collaboration invites, invite responses, and permission changes.

• We send transactional and notification emails via Email Octopus only when operationally necessary, such as for account confirmation, password reset, task reminders, and collaboration invitations. We do not send marketing or promotional emails.

• We use anonymised analytics data to understand how features are used so that we can improve Dozy.

• We use data for security purposes, including detecting and preventing abuse, fraud, and unauthorised access to accounts.

4 Third-Party Services

Dozy works with a small number of trusted providers. Each provider receives only the minimum data necessary for its specific function. We do not share your data with any other third parties.

• Supabase provides database, file storage, and authentication services. For this purpose, Supabase processes all user-generated app data.

• Stripe provides payment processing and subscription management. For this purpose, Stripe receives your email address and subscription status, and Stripe handles all card data directly.

• Google provides optional Google Calendar integration. For this purpose, Google receives an OAuth token and calendar event titles and times.

• Microsoft provides optional Outlook Calendar integration. For this purpose, Microsoft receives an OAuth token and calendar event titles and times.

• Email Octopus provides transactional and notification email delivery. For this purpose, it receives your email address only.

• Google Analytics provides usage analytics. For this purpose, it receives anonymised usage events as described in Section 5.

5 Google Analytics

We use Google Analytics to collect anonymised information about how visitors use Dozy, including pages visited, features used, and session duration, to help us understand what works and what to improve.

• Google Analytics uses cookies and similar technologies to identify returning visitors.

• We have enabled IP anonymisation so that your full IP address is never stored by Google.

• The data collected through Google Analytics is aggregated and does not identify you personally.

• You can opt out of Google Analytics at any time by installing the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

6 Data Storage and Security

Your data is stored in Supabase infrastructure, which provides encryption at rest and in transit using TLS. Authentication is managed via Supabase Auth with industry-standard password hashing.

OAuth tokens from Google and Microsoft are short-lived, and we do not store permanent tokens beyond what is needed to maintain your active calendar connection.

While we take reasonable precautions to protect your data, no system is completely secure. If we become aware of a breach affecting your account, we will notify you promptly.

7 Data Retention

Details about how long we keep your data, including what happens to archived tasks, deleted projects, and task history, are covered on the Database and Information Storage page.

You can request full deletion of your account and all associated personal data at any time by emailing privacy@dozy.site.

8 Your Rights

Regardless of where you are located, you have rights over your personal data. To exercise any of these rights, contact privacy@dozy.site. We will respond within 30 days.

• You have the right of access, which allows you to request a copy of the personal data we hold about you.

• You have the right of correction, which allows you to ask us to correct inaccurate or incomplete data about you.

• You have the right of deletion, which allows you to request deletion of your account and all associated personal data.

• You have the right to object to our processing of your data for analytics purposes.

• You have the right to data portability, which allows you to receive your data in a machine-readable format to transfer elsewhere.

• You have the right to withdraw consent, which allows you to disconnect calendar integrations at any time from Settings or unsubscribe from notification emails via the link in any email we send.

9 Children

Dozy is available to users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us at privacy@dozy.site and we will delete it promptly.

If you are aged 13 to 16 and located in the European Economic Area, you may need parental consent to use certain features depending on your local law.

10 Policy Changes

We may update this Privacy Policy from time to time. When we do, we will update the Last Updated date at the top of this document. For significant changes, registered users will be notified by email or via an in-app notice.

Continued use of Dozy after a change takes effect constitutes acceptance of the updated policy.

11 Contact Us

For questions about this policy, to exercise your rights, or to report a privacy concern, please contact us.

Name: David Kelen
Email: privacy@dozy.site
Response time: Within 30 days