Privacy notice

Information you choose to provide

• Account details: email address, username, display name, password hash, and optional city, biography and profile photo. Photos are resized and re-encoded in your browser and served only to members who can open your profile. Previous usernames stay reserved while your account exists so old profile links continue to work.
• Private 60-day reading path records when you choose to save them: your selected path, reading preferences (context, duration, energy, presentation), 60-day lesson order, completed days, reading position, and optional reading feedback (useful / not for me / come back later).
• Legacy introduction answers (15 questions) when you separately grant permission to save them so authorized administrators can review your answers and how your starting point was interpreted.
• Tasks, reflections, methods, preferences, 30-day experimental journey progress, and messages you choose to save. A task can have one optional return date, time and time zone. This is a private in-app marker, not a notification schedule. Task suggestions do not save a choice or change a task.
• If you opt in to the 6:00 PM evening note: that choice, your time zone and a log of which days were emailed to you, so that no day is sent twice. You can turn it off with the link in every note or from your reading path.
• Sign-in codes. The six-digit code we email you is valid for 15 minutes and is deleted about a day after it expires.
• New optional email choices are separate for a welcome note, a weekly reflection, one gentle return, and product updates. These new optional email series are not sending yet. If you save a choice, we store the choice, time zone, consent and update timestamps, and a revision number. Saving yes does not send a message. You can also save a quiet-time window, whether it is enabled, and a time zone for optional communication. These settings have their own update time and revision. Future delivery receipts would record the category, channel, event key, claim time, final status and finish time, without message content. These new email and push messages are not being sent yet. Security codes, requested reading notes and started Timer alerts remain separate.
• Focus rounds, if you start one from your cockpit: what you wrote you would do, any thoughts you parked during the round, the length you chose, when it started and ended, how you answered (Done, Partly or Not this time), how often you marked a distraction, the focus points earned and your time zone. What you wrote and the thoughts you parked are visible only to you.
• Urge Blocker and Checkpoint entries, if you log one: the category, any title or note you write, how long you waited, whether you chose to return to your step or take a conscious break, whether it started from the checkpoint or from your cockpit and, from the checkpoint, the chapter you last read. These entry details are visible only to you and you can delete any entry from your cockpit. Other members do not see your urge categories, notes or shield badges on your profile; only pause counts appear on the Checkpoint board when you leave board visibility on.
• Temporary focus-room participation and technical security information needed to operate the service.

Connected apps and shared account points

Connecting an app is optional and requires confirmation on this website. A connected Chrome, Windows or Android app uses its own sign-in session. Device point events contain your account, a random event or step identifier, the platform, the choice and timestamps. They do not contain task text, website addresses, browsing history or the names of apps you open.

A first completed small step on a connected device adds 100 account points. An explicit return choice in Urge Blocker adds 100; an explicit continue choice subtracts 100. Balances can be negative. Repeating the same event does not change the balance again. These device points do not change membership discount eligibility or remove earned badges. Existing Checkpoint reward conditions apply across devices.

An offline device keeps pending events until it can confirm them with your account. Events remain attached to the account that made them and are not transferred to a different account. Disconnecting the app stops its active connection. Point receipts remain with your account to prevent duplicate rewards; they are included in account export and removed with full account deletion. Local task notes remain on the device unless a separate feature explicitly saves them.

Shared water check-ins

When signed in, a water check-in sends its unique identifier, source platform, time and timezone to your DopaNudge account. The first recorded account timezone defines the daily water reward boundary across devices. The first eligible check-in of a day earns 10 points; further records do not add points. Pending records remain attached to the account that created them. Records more than seven days old can be stored without a new reward. Existing local water history is not imported automatically. These records are private, included in account export and removed with account deletion. Water records are not sent to Google Calendar or Drive by the completed-task export features.

Optional Google Drive completed-task archive in the Windows app

The Windows app also offers a separate, optional Google Drive connection and archive switch. When enabled, it sends newly completed task titles and actual completion dates and times directly to your Google Drive as a monthly CSV archive. The app requests access to files it creates or that you share with it, rather than access to all your Drive files. Each Windows installation keeps its own archive files so another computer does not overwrite them. Existing task history is not imported automatically. Calendar and Drive exports can be enabled separately.

The archive does not include private notes, daily plans, water records or raw Pomodoro sessions, and task duration is not inferred. Captured completion records and pending uploads stay on the device to support retries and complete monthly archives. Google credentials use Windows user-bound encryption and are excluded from local exports. Local data export and deletion include the saved archive records and pending uploads. Disconnecting stops future uploads from this device and removes its saved credentials. Disconnecting or deleting local data does not delete files already uploaded to Google Drive; you can manage those files and Google permissions in your Google account.

Optional Google Calendar export in the Windows app

The Windows app may offer a separate Google Calendar connection. This requires its own Google permission and a visible export switch. When you turn it on, newly completed task titles and their completion dates and times are sent directly from the Windows app to a separate calendar in your Google account. These task titles are not sent to DopaNudge servers by the Calendar feature. Your existing calendar events are not read by this feature. Daily plans, private notes, water records and raw focus-session records are not exported to Google Calendar.

Task duration is not inferred from the time between adding and completing a task. Completion records are shown on their completion date and include the recorded completion time. Existing completed tasks are not imported automatically. Pending exports and authorization credentials stay on the device; credentials are protected with Windows user-bound encryption and are not included in exports. Disconnecting on this device stops future exports and removes its saved Calendar credentials. Events already saved in Google Calendar remain there until you remove them in Google Calendar. You can also manage or revoke the Google permission in your Google account. Deleting local DopaNudge records does not delete events already exported to Google Calendar.

Visibility and separate permissions

Saving a private 60-day reading plan keeps your reading list, reading position, and feedback private to your account. It does not by itself grant administrators access to your 15 introduction answers or personal need interpretation.

Only when you separately tick permission to save your introduction answers can authorized administrators view your 15 answers, the evidence-based starting-point interpretation, and (if you also saved a reading plan with that permission) the ordering basis of your plan. Private reading positions, notes and lesson feedback are not shown to administrators.

Your basic profile contains your display name, username, avatar color and optional city and biography. People finding you through a code you enabled, connection requests and accepted connections can see this preview. Member discovery is off until you enable it. Opening another member’s basic profile page requires full access and either an accepted connection or the profile owner’s discovery permission. Your own private profile stays accessible to you with a free account. Reading progress, urge totals and private tool records do not appear on another member’s view. Do not put information you want to keep private in your biography. We do not sell your personal information.

The Focus board and Checkpoint board are separate from Together discovery. The Focus board lists usernames, focus points and scored-round counts for signed-in members, never task content. The Checkpoint board lists usernames and pause counts (Today, This week, This month and All time, counting pauses spaced at least a minute apart), never which urge category you chose, any title or note, or individual timestamps. You are listed unless you switch off Show me on the focus board in your cockpit or Show my counts on board on the Checkpoint board; you can still see your own points and counts after opting out, and deleting urge entries lowers your Checkpoint board count. Members who have blocked each other are hidden from one another on both boards. Your private profile totals are not automatically published to other members.

Together connections, cards and reports

Connection requests and member discovery start off. If you enable requests, you can create or replace an invitation code. A code lets someone preview your basic profile and ask to connect; both people must accept the connection before sharing cards or sending new messages. Replacing a code invalidates the old code without removing existing connections. Registered accounts can use codes, support cards and messages with accepted connections; member discovery and other member profile pages require full access.

A support card shares only its previewed fixed text, selected earned badge or selected Grove view with the recipients you choose, for 24 hours, 3 days or 7 days. A Grove card contains the unlocked plant names and chosen layout, not your tasks or point total. You choose which fixed responses, if any, recipients may send. Responses are shown to the card owner; other recipients do not see who received or replied to the card. Publishing, responding and connecting do not earn points or membership rewards. Together sends no email or push notifications.

You can stop sharing a card. Expiry, disconnection or blocking closes access; unblocking does not restore the old connection or shares. Muting hides incoming cards without notifying the sender. A recipient may already have seen or saved a copy, which we cannot recall. The recent-card view shows up to 50 cards from the last 30 days; this display limit is not a deletion schedule. Your stored sharing and connection history remains while the account exists.

Reports store the category, your optional note and the relevant member, card or message reference for authorized site moderation. The report does not automatically copy the message text into its note. Moderators can record a review, revoke a card or pause social actions; review notes are not disclosed to reported members. No response time or live human supervision is promised. Your account export includes your own social records and reports, but not reports made about you or private moderation notes. Full account deletion removes your social records and relationships; references identifying a deleted recipient are removed from retained shared-card metadata.

Activity and reward receipts

For eligible point-awarding activities we keep a minimal receipt: your account ID, activity type and source identifier, server time, awarded amount, and the applicable membership term and month. These receipts determine your activity counters, badge progress and, for the new annual policy, renewal qualification. They do not include task text, private notes or introduction answers.

Deleting a source entry, reading plan or focus round removes that source content but retains its minimal activity receipt while your account exists. This prevents the same activity being rewarded again and preserves earned badge and reward history. Full account deletion removes these activity receipts, badges derived from them and membership records. Your complete account export includes them.

Private practices and progress views

The Tools practice library stores only exercises you choose to save: your chosen situation, first action, planning items, boundary draft, optional notes, and recorded trial times. Account practices are private. They are not sent to other members, message recipients or AI providers. Guest practices use this tab’s session storage for 24 hours after a practice change. Changing the Plain or Grove view does not extend that period; view preferences can remain after the guest practices expire.

An unfinished time trial is kept in this tab for up to 24 hours so it can be resumed. Its timer measures elapsed time and running time with pauses excluded; it does not measure attention. A step explicitly brought from Tools to Today is a separate owner-bound draft for up to 24 hours. You must choose to use it, then add a task. Other practice notes are not transferred.

You can export, remove or clear saved practices in Tools. Clearing Today does not clear your separate practice library. Full account export includes saved practices and view preferences; account deletion removes them. Deleted individual records retain a blank revision marker while the account exists to prevent an older request from restoring their text. Clearing the practice library removes those records and keeps only its generation and view settings.

Saving, reopening or deleting a practice does not earn or remove points or membership rewards. Plain and Grove display the same existing activity receipts and badges. Grove has no hunger, death or missed-day penalty, and it does not publish your progress to others.

Private weekly look-back

Weekly look-back shows your saved day notes and the current outcomes of tasks you still keep. Day counts describe the time you saved that day note; they are separate from current task outcomes. A deleted task is not displayed, but deleting a task does not erase an independently written day note or its saved counts. We do not infer health, personality or which reading caused an outcome.

If you choose Save reflection, your two week notes, week dates, time zone, revision and update time are stored privately in your account. Your first saved reflection fixes that week’s time zone. Deleting the week reflection erases its text and retains a blank revision marker to prevent an older tab restoring it. Clearing Today removes week reflections too. Full account export includes these records, and account deletion removes them. Saving a reflection awards no points and sends no email.

Small steps and quiet company

You write your own small tasks and mark them done. Signed-in task lists, next steps, return notes and optional day reflections are private account records. Guest task lists and day reflections stay in this tab’s session storage for 24 hours after their respective last change. Unfinished input and the selected task stay in this tab for up to 24 hours. A reading practice you choose to bring to Today is a separate account-bound draft in this tab for up to 24 hours; it is not a task until you add it. Guest completions do not award account points. Rewarded account completions count towards activity badges and, during an active membership year, the monthly activity target.

If you choose to keep a reading link when adding a task, we save the source reading title, path and day with that task. The link is private and appears in Today and your weekly look-back. Removing the link keeps your task and notes. Removing the task, clearing Today, deleting the source reading data or deleting your account removes the link. Today and complete account exports include these links. Small tasks do not use AI or send task text to a model provider. Removing a task erases its text, next step and return note. Clearing Today also removes all task workflow records, day reflections and weekly reflections. A day reflection is separate from an individual task and is retained when only that task is removed. Day reflections use your browser time zone, store a count snapshot and your optional note, and do not award points. Your Today export includes tasks and day reflections. Removing tasks or clearing Today retains a minimal completion receipt and a member-specific text fingerprint to prevent duplicate rewards. These records contain no readable task text, are included in your account export, and are removed when you delete your account. Earned points are not removed when a task is reopened or deleted.

Quiet company shares only anonymous counts after you choose to share your presence during an active focus round. Presence expires within 90 seconds without a refresh; your task, notes and identity are not shown. You can stop sharing at any time. If you choose to share a fixed supportive note after an eligible round, others see its text and actual completion time for up to one hour. You can remove it; deleting the round or account also removes it. Expired presence and notes older than 24 hours are cleaned up when someone next joins.

Storage and service providers

Guest tools and unfinished introduction drafts use browser storage for up to 24 hours. The new path finder keeps versioned direction, situation and display choices in this tab; it does not save a new set of administrator-visible questionnaire answers. When you start a private account path, its selected direction and reading preferences are stored with the plan. Text in the immediate-help worksheet stays on the page until you explicitly use a step in your task draft or list. Signed-in records are stored in our Cloudflare D1 database. Cloudflare also hosts the website and provides security and email delivery. Web fonts are hosted with the application; no Google Fonts request is needed.

Optional device break reminders store their enabled setting, interval, last reminder time, snooze and mute times, and update time in this device’s local storage only. They do not store task content or browsing history. You can turn them off or reset break settings on this device; clearing browser storage also removes them. They are not part of your account export.

Data may be processed outside your country by our infrastructure providers. Since 7 November 2026 we also use Meta’s advertising measurement tools, and since 9 November 2026 PostHog product analytics; see “Advertising measurement (Meta)” and “Product analytics (PostHog)” below.

Feedback you choose to send

The Feedback button sends your bug report or suggestion and, if you select one, a resized raster screenshot to yours@dopanudge.com. Review the preview and remove private details before sending. We do not automatically attach your page URL, query strings, cookies, account details or logs. Delivery receipts contain a message fingerprint and random submission ID for up to 24 hours to limit duplicate sends; the feedback itself is delivered to the support mailbox. You can contact that address about removal of a support message.

Anonymous funnel counts

To see where the introduction loses people, we count steps as anonymous events on our own servers (Cloudflare D1): visits to the home page, the introduction and its questions, the 60-second experiment, the email and Google sign-in steps, and a few reading-path steps (a day opened or marked as read, the paid-access choice, and “tell me when I can pay”), focus rounds started or finished (only the length you chose, in minutes: never what you wrote or how the round went), the checkpoint opened or finished and a one-minute digest read (only that it happened: never which option you chose or how it ended), small tasks added or marked done (never the task text), which situation page was viewed, which path landing page was viewed, and the starting-point steps (the page opened, the first reading shown, and a path started as a guest or with an account). When you arrive from one of our ads, those three starting-point counts also store the audience group the ad was shown to, taken from the ad’s link: women or men, and an age band (18–29, 30s, 40s, 50s, 60 and over). You do not enter it, it is never stored with an account, and it is used only to see which ads lead to a useful start. On that starting page, the ad’s direction and audience group also frame the everyday examples in the starting questions and preselect the setting for your reading examples (which you can change); any extra everyday patterns you tick stay in this browser tab only and are never saved to our servers. Each count stores the step name, the time rounded down to the hour and, at most, a step number. Only the result screen, the situation pages, the path landing pages and the payment counts below also record the path or situation they showed; the email and sign-in steps record no path or situation. No cookie, session, IP address, member ID or other identifier is written with it, whether you are signed in or not.

Choosing “Reject optional” in the cookie banner turns these counts off in this browser. The counts themselves are not shared with anyone. Separately, a few of the same steps can also be reported to Meta for advertising measurement, as described in the next section; the audience group, path and situation are never sent to Meta. Because a count identifies no one, we cannot find or delete “your” counts on request; they are deleted automatically after 180 days. How far people get after they sign up, and how many plans start with each situation, are worked out from the reading plans saved in accounts, as totals only.

To prevent abuse and overload, the counting service limits how often one visitor can send events, using a short-lived key derived from the network address that is held only in the rate-limiting service and never stored with the counts. Cloudflare, our hosting provider, also keeps standard server logs, which may include network addresses, for a few days.

Advertising measurement (Meta)

We advertise DopaNudge on Instagram and use Meta Pixel and the Meta Conversions API, provided by Meta Platforms, to measure which ads lead to sign-ups. When this measurement is on, your browser loads Meta’s script from connect.facebook.net, first-party cookies named _fbp and _fbc may be set on dopanudge.com, and Meta may set its own cookies.

What is sent to Meta: the name of a few steps (the starting page opened, a first-reading preview shown, an email or Google sign-in started, an account confirmed or a path started with an account), the address of the page you are on, a random event identifier, your IP address, browser user agent and country, and the _fbp and _fbc values. When you sign in with Google for the first time we also send a hashed (SHA-256) form of your email address and of your internal member ID so that Meta can match the sign-up to an ad. We never send Meta which path, situation or answers you chose, the ad audience group, your readings, tasks, notes or anything you write.

Meta processes this information under its own terms and privacy policy, including to measure and improve ad delivery, and may combine it with information it already holds about you. We do not sell your personal information. Under some US state laws, sending this information to Meta for advertising may count as “sharing”; you can opt out as described below.

Your choice: “Reject optional” in Cookie preferences turns Meta measurement off in this browser, deletes the _fbp and _fbc cookies we set, and our server stops sending sign-in events for this browser. A Global Privacy Control signal from your browser has the same effect for Meta measurement. If you are in the European Economic Area, the United Kingdom, Switzerland or Türkiye (judged from your device time zone and connection country), Meta measurement stays off unless you choose “Accept optional”. Elsewhere it is on until you reject it. Meta keeps this information under its own retention rules; we keep no separate copy beyond the anonymous counts above.

Product analytics (PostHog)

To understand where people get stuck or leave, we use PostHog, a product analytics service provided by PostHog, Inc. (data stored in the United States). It runs under the same optional-measurement choice as Meta measurement. Its script and events go through our own address (dopanudge.com/rl); we do not pass your IP address or our cookies to PostHog, so it cannot see where you are beyond the country of our hosting network.

What is recorded: the pages you view (the address without anything after “?” or “#”), when you arrive and leave a page, the same step names as our anonymous counts (with at most a step number), and which buttons or links you press, with all their text and labels masked. When you arrive from one of our ads, the visit also records which direction the ad was about and whether it was a Meta or YouTube ad; the ad’s audience group (gender and age band) and click identifiers are not sent. A random identifier links the events of one visit. We never send PostHog your email address, member ID, the answers you choose, your readings, tasks, notes or anything you write, and we do not create a profile of you.

Unless you choose “Accept optional”, nothing from PostHog is stored on your device: the random identifier lives only in the open page and is gone when you leave. If you choose “Accept optional”, PostHog may keep that identifier in this browser (local storage and first-party cookies whose names start with ph_) so that visits can be linked, and it may make a session recording: a replay of page layout, scrolling and clicks in which every piece of text and every input is masked, and reading pages and text boxes are blocked entirely.

Your choice: “Reject optional” turns PostHog off in this browser and deletes the ph_ storage it set, keeping only PostHog’s own note that you opted out; a Global Privacy Control signal or a Do Not Track setting has the same effect. In the European Economic Area, the United Kingdom, Switzerland and Türkiye it stays off unless you choose “Accept optional”. Elsewhere it runs, without storing anything on your device, until you reject it. PostHog processes this data for us as a service provider; we keep it for up to 12 months.

Payments

Full access is sold through Polar (Polar Software, Inc.), our payment partner and merchant of record. When you continue to checkout we send Polar your account email and internal member and reading-plan identifiers so the purchase can be matched to your account. You enter card details only on Polar’s checkout page, never on ours, and we never receive them.

After a purchase we keep an order record on your account: the order ID, amount, currency, purchase date and refund status. We use it to open and close your access and to answer refund questions. It is removed if your account is deleted. We keep only hashes of opaque account and payment identifiers to stop delayed payment events from restoring deleted data. These contain no email, name, amount or payment payload. Polar keeps its own payment and invoice records under its own privacy policy.

Payment counts are written by our server. When checkout opens, when a payment succeeds and when one is refunded, our server adds an anonymous count to the funnel counts described above: the step name, the time rounded down to the hour and the path or situation chosen, with no member ID, email or order details. Because your browser does not send them, “Reject optional” does not stop these payment counts.

Your choices, export and deletion

From Your data (/delete-data), you can export your saved 60-day reading plan, progress, consents, introduction answers and focus rounds as JSON at any time. Your complete account export also includes new email choices, the saved quiet-time schedule and any delivery receipts; full account deletion removes these records. Device break settings remain only in local storage, outside account export.

You can withdraw permission and immediately delete your saved introduction answers without losing your private 60-day reading plan, or delete your reading plan and progress, or delete both. You can delete your focus rounds on their own: that removes the rounds, what you wrote in them and your focus points, including from the Focus board. Minimal eligible-activity receipts remain as described above. You can delete your full account from your profile or Your data after confirming a code sent to your email and the permanent deletion confirmation. This removes your profile, photo, messages, tasks, focus rounds, reading records and sessions. Export your account JSON first if you want a copy. Deleting browser storage does not delete server-side account records.

Optional task reminders and email choices

A return time and its notification choice are private account records. If you enable browser reminders, we store the browser push subscription and an account-bound device identifier so we can send a general reminder. Task titles and notes are not included in the notification. The latest enabled device is used for your account.

We check the current task, permission, quiet time and account before sending, and check the current signed-in account again before the browser displays a message. Optional email and task reminder attempts share delivery limits. A provider accepting a message does not establish that it appeared on a device or reached an inbox.

Optional email uses category choices and a recorded email confirmation from an email-code or Google sign-in. If you choose the gentle-return email, a throttled record of authenticated account use supports that feature. Turning that choice off removes its last-use record. Unsubscribe links first show confirmation and then turn off the selected category.

You can disable reminders in account settings or browser permissions. Account deletion removes these account-bound records. Your data export includes your reminder choices and delivery history, but omits browser subscription keys and account security credentials. The notification service worker does not cache private pages for offline use.