Privacy Policy

• Documents you upload. PDF, image, and CSV files you add to your corpus, plus the AI-extracted markdown rendering of each.
• Account-level financial data from financial institutions only when you explicitly authorize a connection (e.g. Plaid). This may include account balances, transactions, and liability details for the accounts you connect.
• Your email address, used solely for sign-in via magic link.
• Concerns and action threads you create inside the app, and the briefs and outcomes the AI swarm derives from your corpus.
• Standard request logs from the hosting platform (Vercel) and the database (Supabase), such as IP address, timestamp, and route hit. Used for operational monitoring and incident response; not used to profile you.

To organize your personal corpus and generate concrete, actionable briefs that reduce financial and life-admin friction. Your data powers your investigation; it is not aggregated, sold, or shared with anyone else.

Only you. Done is single-tenant: there is one user account, which is yours. Postgres Row-Level Security restricts every row to the account that owns it, and the sole operator (the person running the application) does not access user data outside of debugging an incident the user has reported.

Done is a thin orchestration layer on top of regulated, audited infrastructure. The third parties that touch your data are:

• Vercel (hosting) — privacy policy. Runs the application code.
• Supabase (Postgres, file storage, auth) — privacy policy. Holds your corpus and account.
• Anthropic (Claude API) — privacy policy. Done sends excerpts of your corpus to Claude to produce briefs; Anthropic API requests are configured for zero data retention and are not used to train models.
• Plaid (financial connector, when you opt in) — privacy policy. Plaid acts as the conduit between Done and your financial institution. You consent to Plaid's data sharing directly in the Plaid Link UI; your bank credentials are entered into Plaid and never reach Done's servers.
• GitHub (source code & scheduled jobs) — operational secrets for the daily snapshot job are stored in encrypted GitHub Secrets; no personal corpus data is stored in GitHub.

Done uses one category of cookie: an httpOnly secure session cookie set by Supabase Auth so that you stay signed in across requests. There is no analytics, no advertising tracker, no third-party embed, and no cross-site tracking pixel.

Connection to Done is TLS 1.2 or higher in all paths. Data at rest is AES-256 encrypted on the Postgres volume (Supabase / AWS default). Authentication is passwordless — magic-link email or WebAuthn passkey — so no passwords are stored. The operator's administrative accounts (Vercel, Supabase, GitHub) all require multi-factor authentication. The full posture is documented in the SECURITY.md file in the source repository.

Different categories of data live for different lengths of time — for example, connector snapshots are superseded on every refresh, and dismissed briefs expire after 90 days. The full lifecycle and your deletion rights are in the Retention Policy.

You can request full deletion of your account and all associated data at any time by emailing brennenm@quobo.co. Confirmed deletions are completed within 30 days.

Because Done is single-tenant and yours, the rights typically described under GDPR / CCPA apply trivially: you can access, export, correct, or delete any of your data at any time by signing in, or by emailing the contact below. Done does not sell personal data; there is no opt-out because there is no sale.

Done is not intended for and not directed at anyone under 13. If you believe a child has used Done, email brennenm@quobo.co and the account will be deleted.

Material changes are dated at the top of this page and noted in the change history at the bottom of the SECURITY.md file. The current operator commits to giving you reasonable advance notice (via email to the address on file) before any change that broadens data collection or sharing.

brennenm@quobo.co