Privacy policy

This policy explains how Uneven Bits ApS handles personal data when you use dododonedone: the website dododonedone.com, the app at app.dododonedone.com, the API and the MCP server.

1. Who we are

Uneven Bits ApS, Denmark (CVR 30487842), is the data controller for accounts, billing and this website. You can reach us at [email protected].

For the content a team puts in a team workspace, the customer that owns the workspace is the controller and we are its processor. The data processing agreement covers that part.

2. What we collect

• Account: name, email address, a hash of your password or your Google sign-in id, language, time zone and preferences, which version of the terms you accepted and when, and your answer about product news by email.
• Content: projects, sections, tasks, labels, filters, reminders, comments, attachments and the activity log of what changed.
• Billing: your Stripe customer id, plan, seats and invoices. Card details go straight to Stripe and never reach us.
• Connected apps: for each AI client you approve over MCP, its name, the workspace and the scopes you granted, and its tokens, stored hashed.
• Devices: push subscription addresses for notifications and the sync state of each device.
• Technical: IP address and browser details in server logs, and error reports.
• Website: visit statistics counted with Umami, which uses no cookies and stores nothing on your device.

3. Why, and on what legal basis

• To provide the service you signed up for, including sync, reminders, the daily digest and the MCP server (contract, GDPR article 6(1)(b)).
• To bill you and keep accounts as Danish bookkeeping law requires (legal obligation, article 6(1)(c)).
• To keep the service secure, prevent abuse and fix errors (legitimate interest, article 6(1)(f)).
• To answer you when you write to support or use the chat (contract or legitimate interest).
• To email you product news and tips, only if you said yes when signing up or in Settings (consent, article 6(1)(a), and section 10 of the Danish Marketing Practices Act). You can withdraw it at any time in Settings, and every such email has a link to stop them.

We do not sell personal data, and we do not use your content to train AI models.

4. Where your data is stored

The servers run in the EU, at Contabo (Lauterbourg, France) or Hetzner (Falkenstein or Nuremberg, Germany, or Helsinki, Finland). Attachments and backups are stored in Cloudflare R2 in a private bucket, served only through signed links. Where a processor below handles data outside the EU or EEA, the transfer relies on the EU-US Data Privacy Framework or the EU standard contractual clauses.

5. Processors

• Contabo GmbH, Germany: hosting of the servers and the database, in its data centre in Lauterbourg, France.
• Hetzner Online GmbH, Germany: hosting of the servers and the database instead of or alongside Contabo, in its EU data centres only (Germany and Finland).
• Cloudflare, Inc.: DNS, network protection and R2 storage for attachments and backups.
• Stripe: payments, subscriptions and invoices.
• Brevo (Sendinblue SAS), France: delivery of emails such as sign-in links, reminders and the daily digest, and product news if you asked for it.
• Functional Software, Inc. (Sentry): error reports from the app and the servers.

Uneven Bits also runs Consentaur (the cookie banner), Asktopus (the support chat) and Umami (visit statistics) on its own servers.

6. AI clients you connect

When you connect an AI assistant over MCP, it can read and change the tasks in the workspace you approved, within the scopes you granted. What the AI provider does with that data is governed by your agreement with them. You can revoke a connection at any time in Settings, Connected apps.

7. How long we keep it

• Account and content: while your account exists. Deleted items are kept for 30 days so devices can sync the deletion, then removed.
• After you delete your account: removed from the live database, and from backups as they expire.
• Billing records: 5 years, as Danish bookkeeping law requires.
• Server logs and error reports: [period to be decided].

8. Your rights

You have the right to access, correct, delete and export your data, to restrict or object to processing, and to complain to the Danish Data Protection Agency, Datatilsynet. Export is built into the app and always works, also when a workspace is read-only.

9. Cookies

The website sets no tracking cookies. The Consentaur banner stores the choice you make in it. The app uses one necessary session cookie to keep you signed in. Use the Cookie settings link at the bottom of every page to change your choice.

10. Changes

We will publish changes here and email account holders before material changes take effect.