Effective: August 27, 2026
This policy explains what information DoneCrest LLC ("DoneCrest," "we," "us") collects when you use the DoneCrest app (app.donecrest.com, and our iOS/macOS apps distributed via TestFlight), our marketing site at donecrest.com, and how we use, share, and protect that information.
DoneCrest is a task management product built by DoneCrest LLC. DoneCrest is currently in private beta — access is invite-only. If you have questions about this policy, see Contact below.
Account data. When you sign up, we collect your name, email address, and password (handled securely by our authentication provider, Supabase — we never see or store your password in plain text). If you sign in with Google or Apple, we receive the identifier and email address your sign-in provider shares with us.
Your content. DoneCrest stores the content you create in the app so it can function: tasks, projects, notes and scratch-pad entries, tags, and any files or images you upload as attachments.
Invite redemptions. If you sign up with an invite code, we record which code was used and when, linked to your account.
Email-to-task capture. Every DoneCrest account gets a private inbound email address (in the form inbox-xxxx@inbound.donecrest.com). Email you forward or send to that address is processed to create a task in your account — the subject and body of that email become task content stored in your account.
Waitlist signups. If you join our waitlist on the marketing site before you have an invite, we collect the email address you provide and, if present, basic marketing attribution data (e.g., which campaign or link brought you to the site).
We use the information above to:
We do not sell your personal information, and we do not use it for advertising or ad targeting.
We rely on a small number of service providers ("processors") to run DoneCrest. We share only what each provider needs to do its job:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage for your account and content |
| Vercel | Hosting for the app and marketing site; cookieless, privacy-preserving web analytics on the marketing site (no personal data, no cookies) |
| Postmark | Delivers inbound email-to-task messages, and account email such as password resets |
| Unsplash | Powers in-app cover-photo search — your search text is sent to Unsplash to return matching photos; no account data (name, email) is sent |
| Upstash | Stores marketing-site waitlist signups |
| Google / Apple | If you choose to sign in with Google or Apple, they authenticate you and share your name/email with us for that purpose |
We do not otherwise share your personal information with third parties, except where required by law.
The DoneCrest app uses only the session cookies required to keep you signed in (set by Supabase Auth). Our marketing site uses Vercel's cookieless web analytics, which does not set any cookies or track you individually. We do not use advertising cookies or third-party tracking cookies anywhere.
We retain your account and content for as long as your account is active.
You can delete your account yourself at any time, from Settings → Account → Delete account — in the DoneCrest apps for iPhone, iPad, and Mac, or on the web at app.donecrest.com. To confirm, you type your own email address, plus your current password if you sign in with a password — if you only sign in with Continue with Google or Continue with Apple, the email address alone confirms it.
Deletion is immediate and permanent. There is no grace period and no way to undo it. Deleting your account erases your tasks, projects, sections, tags, and scratch pads; every attachment and cover image you've uploaded; your XP, level, and streaks; all of your Spaces; and your authentication record with Supabase, so that email address can no longer sign in to DoneCrest. If you signed in with Apple, we also ask Apple to withdraw that authorization, so DoneCrest stops appearing under Settings → Apple Account → Sign-In & Security → Sign in with Apple.
One record is deliberately kept, with your identity stripped from it: if you signed up with an invite code, we retain the fact that that code was redeemed and the date it was redeemed, with the reference to your account removed. That record holds only the code and the date — no email address, no name, no user identifier. We keep it because it is our only record of how many people each invite brought in.
If you'd rather not delete the account yourself, you can still email us at support@donecrest.com and ask us to delete it for you (see Contact).
DoneCrest is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
We may update this policy as DoneCrest evolves. If we make material changes, we'll update the effective date above and, where appropriate, notify you directly.
Questions, requests, or account deletion: support@donecrest.com