Privacy Policy

1. Who This Policy Covers

This policy covers visitors to our marketing pages, authenticated users, and organization administrators who manage workspaces. If you use the Service through an employer or other organization, that organization's internal policies may also apply to how they use data you submit to them.

2. Information We Collect

Account and profile data: When you create or access an account, we collect identifiers such as your email address, name, profile photo (if you upload one), time zone, and preferences stored in your profile (for example, notification settings and workspace context such as last selected team when the product stores it).

Workspace and collaboration content: We collect content you create in the Service, such as check-ins, comments, tasks, team membership, roles, invitations, and administrative configuration performed by workspace owners or managers.

Usage and diagnostics: We collect information about how you interact with the Service, including feature usage, approximate timestamps, and error logs that help us operate and improve reliability.

Device, network, and log data: We automatically collect technical information such as browser type, device type, IP address, and request metadata for security, fraud prevention, abuse detection, and service operations.

Optional live location data: If you enable live location sharing in DidThis and grant location permission in your browser, we collect latitude, longitude, accuracy metadata, and timestamps associated with your device. When a Mapbox access token is configured for the deployment, we may send coordinates to Mapbox to derive a formatted address label and country code for display in product experiences such as the team map. If Mapbox is not configured, we may still store coordinates without a derived address label.

Session prompts: When live location sharing is off, DidThis may display an in-product prompt for eligible team members to offer enabling sharing. Choosing Not now typically snoozes further prompts for about eight hours on that device (stored locally). Dismissing the prompt does not enable sharing. Your browser may separately show a system permission dialog if you choose to enable sharing.

3. How We Use Information

• Provide, operate, maintain, and secure the Service.
• Authenticate users, manage sessions, and enforce access controls.
• Show team maps and manager-facing views when you enable live location sharing, including batched background updates (not continuous streaming) while sharing remains on.
• Personalize the product experience, send service-related communications, and deliver notifications you opt into.
• Bill and administer subscriptions where applicable.
• Detect, investigate, and help prevent abuse, fraud, and security incidents.
• Comply with law and enforce our agreements.

4. How We Share Information

We do not sell your personal information. We share information with service providers who process data on our behalf under contractual safeguards, including hosting and database providers, authentication vendors (such as WorkOS), mapping/geocoding providers (such as Mapbox when enabled), analytics providers, email delivery providers, and payment processors when you purchase paid plans.

Within a workspace, certain information is visible to other members by design. For example, team rosters may show names and presence indicators. When you enable live location sharing, managers on your team may be able to view your live location on the team map as implemented in the product. A separate profile control may limit whether city or country labels appear to teammates in certain roster views; that control does not disable live coordinate processing while sharing is on.

We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect the rights, safety, and security of DidThis, our users, or the public.

If DidThis is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction subject to appropriate confidentiality and security obligations.

5. Legal Bases (EEA/UK/Switzerland)

Where the GDPR or similar laws apply, we rely on one or more of the following legal bases: performance of a contract with you; legitimate interests in operating and securing the Service (balanced against your rights); consent where required (for example, certain marketing communications or optional location processing where consent is the appropriate basis in your jurisdiction); and compliance with legal obligations.

6. Retention

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type. When you disable live location sharing for a team, DidThis removes your stored live location record for that team as implemented in the product at that time; other account and workspace records may remain until you or an administrator deletes them or closes the workspace, subject to legal holds and backups.

7. Security

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure; we continuously work to improve our controls and monitoring practices.

8. International Transfers

DidThis may process information in the United States and other countries where we or our service providers operate. If we transfer personal information from regions that require safeguards, we use appropriate mechanisms such as standard contractual clauses where applicable.

9. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and measure product performance. You can control cookies through browser settings; disabling cookies may impact certain features.

10. Your Choices and Rights

• Profile controls: You can enable or disable live location sharing and adjust related privacy settings in Profile.
• Browser controls: You can allow, deny, or revoke location permissions using your browser or device settings. Revoking permission may prevent live location features from working even if your DidThis setting is on.
• Accuracy limitations: Location signals can be inaccurate due to environment, hardware, VPNs, or third-party mapping services.
• Shared devices: If you share a device, other users may be able to access your session or browser permission state.
• Access, correction, deletion: Depending on your jurisdiction, you may have rights to access, correct, delete, or export personal information, and to object to or restrict certain processing. To exercise these rights, contact us at info@didthis.com. We may need to verify your request and may be limited by law or legitimate business needs (for example, retaining billing records).

11. Children's Privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate steps.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and may provide additional notice where appropriate. Your continued use of the Service after the effective date constitutes acceptance of the updated policy where permitted by law.

13. Contact

Privacy questions and requests: info@didthis.com.