Privacy Policy

1. Who we are

DOIN' ("we", "us") is operated by an individual developer based in the Republic of Latvia, who is the controller of your personal data. Contact us at hey@startdoin.com.

2. Data we collect

• Account data: email address, display name, username, avatar/profile photo, timezone.
• Auth provider data: Google Sign-In and (on our mobile app) Apple Sign-In. We receive only your name and email from OAuth providers.
• Proof photos and captions: images and text you upload as daily challenge proof. Stored in a private bucket and shown through signed links that expire after 15 minutes. Who can see them is explained in section 4a.
• Device info: push notification token (OneSignal player ID) if you opt in to notifications on mobile.
• Reports and blocks: when you report a photo or block another user, we store which photo or user it concerns, the reason you chose (for reports) and when. The other person is never told who reported or blocked them.
• Record of your agreement: which version of the Terms of Service and the Privacy Policy you accepted, when, on which platform (web or mobile) and in which language. We do not store your IP address.

We do not currently run analytics or third-party crash reporting. If we add either, we will update this policy before doing so.

3. How we use your data

• Authenticate you and manage your account.
• Display your profile, challenge history, and leaderboard position to other participants.
• Send push notifications — only with your opt-in consent, logged with consent verification in our database.
• Generate challenge scorecards.
• Keep the community safe: reports about photos and information about blocks are emailed to our team. We review reports within 24 hours. These emails name the reported or blocked person and the challenge, never the person who reported or blocked.

3a. Legal bases

We process your data on these bases (GDPR Art. 6):

• Contract (Art. 6(1)(b)): creating and running your account, taking part in challenges, storing and showing your proof photos, results and streaks, prize draws in challenges you take part in, and sending you the service messages you need.
• Consent (Art. 6(1)(a)): push notifications; allowing your proofs to be made public outside the app (which the organisation running the challenge and DOIN' may then do, including in advertising, on social media and on websites), which also affects eligibility for a prize; and marketing messages. You can withdraw consent at any time (see section 6); this does not affect what happened before.
• Legitimate interests (Art. 6(1)(f)): keeping DOIN' safe and fair, namely preventing abuse and fake proofs, handling reports and blocks, and rate-limiting; and keeping a record of which version of our documents you accepted, so that we can show what you agreed to and defend our rights. You can object (see section 6).

Invitations. If an organisation gives us your email address to invite you to a closed challenge, we send the invitation on its behalf. The address is supplied by the organisation, which needs its own legal basis to invite you. We use the address for that invitation and any retry of it, and each invitation contains a link to opt out of further invitations.

4. Third-party services (subprocessors)

Subprocessors we use:

• Supabase (EU-West Ireland) — database, authentication, file storage.
• Cloudflare — CDN, DDoS protection, hosting for our web app (Cloudflare Workers), and storage of generated result images (Cloudflare R2).
• OneSignal — push notifications on mobile (opt-in only).
• Resend — transactional email (challenge invitations, team safety alerts).

The full authoritative list — including regions, purposes, and what we do NOT use — lives at /subprocessors. We enter into a Data Processing Agreement with each subprocessor where one is required under GDPR Art. 28. Contact us for specifics of any given subprocessor.

4a. Who else sees your data

• Other participants. In a challenge you join, other participants always see your display name, avatar, your proof photos and captions in that challenge, and your streak and result, because that is how DOIN' works. Your profile page, with your results, can be opened by anyone who has its link while your profile is public; you can switch this off in your profile settings.
• The organisation that created the challenge (for example a brand or a team). In its dashboard the organisation sees who took part: your display name, email address, progress and results, and the proof photos of all participants, each marked with whether the participant allowed it to be used outside the app. The organisation may download data, but may publish and reuse only the photos that carry this permission, and it is told which ones may not be used. Organisations access this only through our dashboard and under an agreement with us. We cannot recall or delete data an organisation has already downloaded; what happens to it after that is governed by the organisation's own privacy notice.
• The public, if you allow it. When you join a challenge you can allow your proofs to be made public outside the app. The organisation and DOIN' may then publish them, including in advertising, on social media and on websites, and each such photo has a public page, which anyone with its link can open, showing your display name, caption, streak and the challenge name. This is separate from your public profile. If the challenge has a prize, only participants who allow this can win it; you can take part in the challenge either way. You can switch the permission off at any time in the challenge settings; this stops further use, but files already downloaded cannot be recalled.
• Our subprocessors, listed in section 4.

5. Data storage & security

Our database, user accounts and photos are stored in the EU (Supabase, EU-West Ireland). Photos are stored in a private Supabase Storage bucket and cannot be opened by a public link; they are shown only through signed links that expire after 15 minutes, or on a public page if you allowed sharing (see section 4a). All connections are encrypted via TLS. Server timestamps are enforced server-side and cannot be manipulated by clients.

Some of our subprocessors process limited data outside the EU/EEA, and each transfer has a legal basis:

• Cloudflare (USA): network data such as IP addresses, through its global network. Basis: the EU–US Data Privacy Framework; if it ceased to apply, standard contractual clauses.
• Resend (USA): the email addresses of people we email. Basis: the EU–US Data Privacy Framework and standard contractual clauses.
• OneSignal (USA): the push-notification identifier of your device. Basis: standard contractual clauses.

Supabase stores your database, accounts and photos in the EU (Ireland); its data processing agreement includes standard contractual clauses in case data were ever transferred outside the EU. Details are on /subprocessors.

6. Your rights (GDPR)

• Access: request a copy of the data we hold about you.
• Rectification: update your profile information at any time.
• Erasure: request account deletion. Your display name and avatar are anonymised. Challenge records you took part in are retained in anonymised form so other participants' history remains intact. Photos you uploaded are removed within 72 hours of the deletion request.
• Restriction: ask us to limit how we use your data in the cases the GDPR allows (Art. 18).
• Portability: request your data in a machine-readable format.
• Object: object at any time to processing based on our legitimate interests, and opt out of marketing communications.
• Withdraw consent: at any time, for push notifications, photo sharing or marketing; this does not affect processing before you withdrew.

You can exercise your right to erasure by deleting your account directly within the DOIN' mobile or web app via the "Profile" settings. For data export requests, email hey@startdoin.com. We respond within 30 days.

If you believe we process your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv); you may also contact the authority of your own EU country.

Your data export includes the blocks you made. When you delete your account, your blocks and any blocks of you are deleted.

6a. Providing your data, and automated decisions

You are not legally required to give us any data, but we need an email address (or a Google or Apple sign-in) and a display name to create your account, and a photo to prove a challenge day. Without them you cannot use the app. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Where a challenge awards a prize by a draw, the winner is picked at random among the eligible participants.

7. Push notifications

Push notifications are opt-in. We never send them without your explicit consent, and every notification we send is logged in our database with a consent-verified flag. You can change your push notification preferences in the settings.

8. Cookies & local storage

We do not use advertising or third-party tracking cookies, and nothing on our site needs your consent to store information on your device. Our web app stores your sign-in session in your browser's local storage so you stay signed in between visits, and keeps your language and look choices in first-party cookies. If Cloudflare asks your browser to complete a security check, it sets a security cookie (cf_clearance). The complete list, with what each entry is for and how long it is kept, is in our Cookie Policy.

9. Children

DOIN' is not intended for users under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it immediately.

10. Data retention

We keep active account data while the account exists. Challenge results and participation records are a core feature of the app and are shown on your profile while the account exists.

If you delete your account:

• your avatar, proof photos (no later than 72 hours), proof captions, in-app inbox and result cards are removed; your display name becomes "Deleted User", and your email and sign-in details are deleted;
• we keep the participation record (dates, streak, result and reactions) under the name "Deleted User", without your name, email, photo or caption, so that other participants' history stays intact;
• the record that a notification was sent to you is kept for 90 days after you delete your account, as proof that you had agreed to it, and is then deleted;
• the record of which versions of our documents you accepted is kept so that we can show what you agreed to, and is linked only to this anonymised account;
• reports about content are kept for up to 12 months after we have handled them; the blocks you made are deleted.

Regardless of your account: all proof photos are automatically deleted 90 days after a challenge ends.

Not in our control: copies an organisation has already downloaded (for example a participant list with names and emails, or downloaded photos). To have those deleted, contact the organisation.

Backups: our database backups are kept for about 7 days and then deleted automatically. Photos are not included in the backups.

11. Changes to this policy

We may update this policy. We will announce material changes in the app and on startdoin.com, and you will be asked to confirm that you have read the new version.

12. Contact

Email: hey@startdoin.com