PrivacyPolicy
Get It Done is operated by Devino Solutions (14930398 Canada Inc.). This page says exactly what we collect, who else touches it, how long we keep it and what you can make us do about it — in the plain language we would want to read ourselves.
Last updated: October 9, 2026
What We Collect
Account information
Your name, email address, password (stored only as a salted hash), profile picture and the workspaces you belong to. If you sign in with Google, Apple or GitHub we receive your name, email address and profile picture from that provider instead of a password.
The work you put in
Tasks, projects, notes, comments, attachments, recordings and the workspaces they live in. This is your content: we store and process it to run the product for you, and we do not sell it, rent it, or use it to build advertising profiles.
Technical and usage data
Your IP address, browser and operating system, and the pages and features you use. Error reports include the page you were on and a stack trace. Analytics beyond that only happens if you accept analytics cookies — see the cookies section below.
Billing information
Your plan, subscription status and payment history. Card numbers are collected by Stripe directly and never reach our servers.
Support conversations
What you write to us through the support form or by email, plus a reference to the error that prompted it if you came from an error message.
How We Use It, and Why We Are Allowed To
Under the GDPR every use of personal data needs a lawful basis. Here is ours, use by use.
To run the product — performance of a contract
Creating and securing your account, storing and syncing your tasks, delivering notifications you asked for, and billing you for a paid plan.
To keep it working and safe — legitimate interests
Error monitoring, rate limiting and abuse prevention, backups, and understanding aggregate usage so we can fix what is broken. We limit this to what a user would reasonably expect from a product they are using.
Analytics and marketing email — consent
Product analytics runs only if you accept analytics cookies. Marketing email is opt-in and every message carries an unsubscribe link. Withdrawing either is one click and has no effect on your account.
Records we are required to keep — legal obligation
Invoices and tax records, kept for as long as the applicable law requires even after an account is deleted.
AI Features
What is sent, and when
AI features are something you invoke, not something running over your workspace in the background. When you use one — the assistant, Plan My Day, screenshot or voice capture, or a suggestion — the relevant content is sent to a language-model provider to produce that response: task titles and notes, the messages in that conversation, the image you captured, or the audio you recorded.
Who receives it
Requests are routed through OpenRouter to the model provider we have configured. Voice capture, where it is enabled, sends your audio to our own speech-to-text service at aishorty.com.
What we do not do
We do not train models on your content, and we do not use it to improve anyone else’s model. AI output is generated text: it can be wrong, and nothing an AI feature proposes is saved to your workspace until you approve it.
If you connect an AI assistant of your own
Our developer API and MCP server let a tool you choose — Claude, ChatGPT, an editor — read and change your tasks using a key you create. What that tool then does with the data is governed by its own privacy policy, not this one. You can revoke a key at any time from your workspace settings.
Who Else Processes Your Data
These are our sub-processors. Each one only receives what it needs for the job named beside it, and each is bound by a data-processing agreement. The table below is generated from the same list the product is built against, so it cannot silently fall behind.
| Who | What they do for us | What they receive | Where |
|---|---|---|---|
| Cloudflare | DNS, TLS, CDN and bot protection for our domains, and the anti-abuse challenge on our support form. | Your IP address and request metadata, plus the challenge token when you submit the support form. | Global edge network |
| PostHog (self-hosted by Devino) | Product analytics — which pages and features get used. Runs only after you accept analytics cookies. | Pages viewed, clicks and form interactions, custom product events, and — once you sign in — your user ID, whether you are a guest, and your email address. PostHog derives an approximate location and device from your IP address and user agent. | posthog.devino.ca — Devino-operated infrastructure, not PostHog Cloud |
| Sentry (self-hosted by Devino) | Error monitoring, so we find out when something breaks. | Error messages and stack traces, the page URL, your browser and operating system, and your user ID when you are signed in. | sentry.devino.ca — Devino-operated infrastructure, not Sentry Cloud |
| Sendly | Sending transactional and account email — verification, password resets, invitations and billing notices. | Your email address and name, and the contents of the message we send you. | United States / European Union |
| RevenueCat | Managing subscriptions, entitlements and trials. | Your user ID, your plan, and purchase, renewal and cancellation events. | United States |
| Stripe | Processing card payments for paid plans. | Your name, billing address and payment history. Your card details are collected by Stripe directly and never reach our servers. | United States / global |
| Backblaze B2 | Object storage for the files, images and recordings you upload. | The file itself and its metadata. Your browser uploads to Backblaze directly using a short-lived signed URL we issue. | United States |
| OpenRouter | Routing our AI requests to the language-model provider we have configured. | The text, images or transcripts you send to an AI feature — task titles and notes, chat messages, screenshots you capture. | United States |
| aishorty.com (operated by Devino) | Speech-to-text for voice capture, where that feature is enabled. | The audio you record. | Devino-operated infrastructure |
| Notifly | Delivering in-app and push notifications. | Your user ID and the content of the notification. | United States |
| Dub (self-hosted by Devino) | Running the Refer & Earn partner programme — attributing a sign-up or purchase to the partner whose referral link brought you, and paying them for it. | The referral link you arrived through and the click it created, which Dub stores with your IP-derived country, device and referring page. If you then sign up, your user ID, email address and name are sent so the partner is credited; if you subscribe, the amount, currency and transaction ID of that payment. Nothing is sent when you arrive without a referral link. | partners-api.devino.ca — Devino-operated infrastructure, not Dub Cloud. The click script itself is served from Dub’s CDN (www.dubcdn.com). |
| Google Analytics | Counting visits to our marketing website (nowgetitdone.com) and where they come from. Runs only after you accept analytics cookies, and never inside the app. | The marketing pages you view (URL, page title and referring site), your browser, device and screen size, and a random Google Analytics identifier stored in a cookie. Google derives an approximate location from your IP address. We send no name, email address or user ID, and advertising features and Google signals are switched off. | United States / global |
| Signing in with Google, and attaching files from Google Drive if you choose to connect it. | Your name, email address and profile picture when you sign in with Google; the file you pick, if you attach one from Drive. | Global | |
| Microsoft | Attaching files from OneDrive, if you choose to connect it. | The OAuth grant you give, and the file you pick. | Global |
| Apple | Signing in with Apple, if you choose that option. | The identifier and email address Apple releases to us — which is a relay address if you chose to hide yours. | Global |
| GitHub, Slack, ClickUp and monday.com | Two-way sync with the tools you explicitly connect to a workspace. | Only the repositories, channels, boards or lists you authorise, and the task data you sync to them. | Global |
How Long We Keep It
While your account is open
We keep your account and your content for as long as your account exists, because that is the product.
After you delete your account
Deletion is completed within 30 days, and residual copies in encrypted backups are purged within a further 90 days. Invoices and tax records are kept for the period the law requires.
Files you uploaded but never used
A screenshot or recording you captured and then did not turn into a task is deleted from storage automatically after 30 days.
Error reports and analytics
Error reports are retained only as long as they are useful for diagnosing the problem. Analytics events, if you accepted them, are retained no longer than needed for the product analysis they were collected for; you can withdraw consent at any time and ask us to delete what was already collected.
Where Your Data Is Processed
Our own infrastructure
The application, its database and our analytics and error-monitoring systems run on infrastructure Devino operates. Backups are encrypted and stored with a European provider.
Transfers outside your country
Some sub-processors named above operate in the United States. Where personal data of people in the EEA or the UK is transferred there, the transfer relies on the European Commission’s Standard Contractual Clauses or the provider’s own approved transfer mechanism.
Your Rights
If you are in the EEA or the UK these are rights under the GDPR; if you are in California they are rights under the CCPA/CPRA; in Canada, under PIPEDA. We apply them to everyone, wherever you are.
Access and portability
Ask for a copy of the personal data we hold about you, in a machine-readable format. Your task data is also available through our public API at any time.
Correction
Fix your name, email address and profile from your account settings, or ask us to correct anything you cannot reach yourself.
Deletion
Ask us to delete your account and everything in it. The process, what it removes, and how long it takes are set out on our account-deletion page, linked below.
Restriction and objection
Ask us to pause a particular use of your data, or object to processing we do on the basis of legitimate interests.
Withdrawing consent
Decline analytics cookies, or unsubscribe from marketing email, at any time. Withdrawal does not affect processing that already happened lawfully.
No sale of personal information
We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing for you to opt out of.
Complaining to a regulator
If you think we have got this wrong, you can complain to your local data-protection authority — in Canada, the Office of the Privacy Commissioner. We would rather you told us first so we can fix it.
How We Protect It
In transit and at rest
Every connection uses TLS, and our sites are served with HTTP Strict Transport Security. Passwords are stored only as salted hashes. Database backups are encrypted.
Access
Access to production systems is limited to the people who need it to operate the service, over authenticated connections. Workspace data is scoped to workspace membership on every request.
In the browser
We serve a Content Security Policy that restricts which third parties your browser may talk to at all, and the session cookie is HttpOnly, Secure and SameSite=Lax so it cannot be read by scripts or ridden by another site.
If something goes wrong
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority within the timeframes the law requires.
Children
Age 16 and over
Get It Done is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle personal data in a way that affects you, we will update the date at the top of this page and, for material changes, tell you in the product or by email before the change takes effect.
Exercising Your Rights, and Reaching a Human
Devino Solutions (14930398 Canada Inc.) is the data controller for Get It Done. We answer privacy requests within 30 days, and we will not ask you why.
- To delete your account and data: follow the steps on our account deletion page, which names the address to write from and exactly what gets removed.
- For access, correction, portability, restriction or objection: email amin@devino.ca from the address on your account.
- For anything else: our Terms of Service cover the contract side, and the support form in the app reaches the same people.