1. Who we are

DoLoop is operated by BarnRecords SASU, a French société par actions simplifiée unipersonnelle, share capital €100, RCS Évry 982 485 260, registered office 24 rue de la Sablonnière, 91410 Les Granges-le-Roi, France ("we", "us"). We are the data controller for the personal data described below.

For any question about this policy or about your data, write to contact@getdoloop.com. A human reads that address. You do not need to use a special form or template.

2. Scope

This policy covers the DoLoop website at getdoloop.com and the DoLoop web application. It does not cover any third-party site we link to.

3. Our approach, in one paragraph

DoLoop is a task organiser. We need an email address to give you an account, and we store the tasks and loops you create because that is the product. We do not sell data, we do not run advertising, we do not build profiles, and we do not use your task content to train machine-learning models. We collect as little as we can get away with, and we would rather answer "we don't have that" than explain why we kept it.

4. What data we hold

Account data — the data you give us when you register:

email address (required — it is your login identifier)
a password, stored only as a salted bcrypt hash. We never see or store your password itself.
display name (optional)
interface language preference
account creation timestamp
whether you signed up from one of our loop-template pages, and which one (such as template_weekly-home-reset); empty otherwise

Content data — what you create in the app:

tasks: name, description, type, schedule (cron expression), duration, dates
loops: name, description, order of tasks, activity state, schedule
activity counters: how many times each task has been completed, how many times it was skipped, and the timestamps of the last completion, last skip, and last arming
the timestamp of your last arming pass
the timestamp of your first arming pass

This content is visible only to you and to whoever operates the servers for the purpose of running and maintaining the service. There is no sharing, no public profile, and no team feature.

We use two of these fields only in aggregate, to measure whether people who sign up from a loop-template page start using DoLoop: the template you signed up from, and the timestamp of your first arming pass. Both are included in the data export described in §10.

API keys — only if you create one:

the name you give the key, its access level (read only, or read and write), and when it was created, when it expires and when it was revoked
the first characters of the key (such as dl_9zq27svr), so you can tell your keys apart
a SHA-256 hash of the key. The key itself is shown to you once and never stored: we cannot show it to you again.
when the key was last used (this date is updated at most once a minute)
the number of requests made with each key, per day. We count them to set fair-use limits; they are not billed.

When you give a key to a tool you choose — a script, an integration, an AI assistant — that tool can read (and, with a read-and-write key, change) your tasks and loops on your instructions. It acts for you, not for us: we do not choose or control it, it is not our processor, and its own terms and privacy policy apply to what it does with your data. Revoke the key at any time to cut it off.

Connected apps (OAuth). If you connect a third-party app (for example an AI assistant) to DoLoop, we store which app you connected, the access you granted (read or read & write), when it was connected and last used, and hashed access tokens. The app can access your tasks and loops within that access until you disconnect it from your account, you change or reset your password, or you delete your account. What the app does with the data it reads is governed by that app's own privacy policy.

Technical data — created automatically when you use the service:

server logs from our hosting provider containing IP address, timestamp, requested URL, user agent and response status. These exist for security and debugging.
aggregate website usage statistics for our public pages, described in detail in §5. These include your truncated IP address and browser user-agent, from which a short-lived visit fingerprint is derived — so they are pseudonymous rather than fully anonymous.

What we do not hold: payment or card data (there is no billing system and no paid plan), postal address, phone number, date of birth, location data, contacts, advertising or cross-site tracking identifiers, and any special-category data as defined in GDPR Art. 9.

5. Analytics

We measure usage of our public website pages with Matomo, an open-source analytics tool. We run it on a self-hosted server in the European Union that we operate together with the other products made by the same team; it is not a commercial analytics service and your data is not sent to any analytics company.

What this means in practice, stated precisely:

No cookies. Matomo is configured in cookieless mode. It stores nothing on your device — no cookie, no local storage entry, no advertising identifier — and it does not track you across other websites or across your devices.
Your IP address is truncated before it is stored. The last two bytes are removed, so an address such as 82.67.144.31 is stored as 82.67.0.0. We never store your full IP address in analytics.
A short-lived technical fingerprint is used. To recognise that several page views belong to the same visit, Matomo derives a temporary identifier from your already-truncated IP address and your browser's user-agent string. It is not stored on your device, it changes as those inputs change, it is not linked to your account, and cross-site recognition is switched off, so it cannot be used to follow you onto another site. It is a pseudonymous identifier rather than a fully anonymous one, and we would rather tell you it exists than let "cookieless" imply that it does not.
Do Not Track is honoured. If your browser sends a Do Not Track signal, no analytics data is collected from your visit at all.
Only public pages, plus the registration page. The registration page is counted like a public page, without the part of its address after ?. When a sign-up is completed, one "sign-up completed" event is sent. It contains no account details: nothing you type into the form, and no email address, name or user id. Like a page view, it carries the page address, the referrer and information about your device and browser, and it belongs to the same visit as your page views. If you signed up from one of our loop-template pages, a second event names that template (for example "plant-care"); it contains no account details either. The logged-in application is not measured: /dashboard and the login page send nothing. We do not know what you click inside DoLoop.
What we do look at: page counts, referrers, approximate country, device type and browser — in aggregate. We do not build a profile of you and there is no advertising of any kind.

Legal basis: our legitimate interest in understanding whether our website works (Art. 6(1)(f)). Because no cookie or other information is stored on or read from your device, this does not require consent under the ePrivacy rules, and DoLoop therefore shows no cookie banner.

6. Cookies and local storage

DoLoop sets no tracking cookies. The API is cookieless by design.

The web application stores two things in your browser's local storage:

an authentication token, so you stay logged in. Strictly necessary — without it the application cannot work.
your language preference.

Both are cleared when you log out or clear your browser data.

7. Why we are allowed to hold it (lawful basis)

Data	Purpose	Lawful basis (GDPR Art. 6)
Email, password hash, name, locale	Create and secure your account; let you log in	Performance of a contract, Art. 6(1)(b)
Tasks, loops, counters	Provide the service you signed up for	Performance of a contract, Art. 6(1)(b)
API key details and daily request counts	Let you, and the tools you authorise, use your account through the API; keep keys secure; set fair-use limits	Performance of a contract, Art. 6(1)(b); request counts: legitimate interest, Art. 6(1)(f)
Template you signed up from, timestamp of your first arming pass	Measure, in aggregate only, whether people who sign up from a loop-template page start using DoLoop	Legitimate interest, Art. 6(1)(f)
Server logs	Security, abuse prevention, debugging	Legitimate interest, Art. 6(1)(f)
Truncated IP + browser user-agent, as a short-lived visit fingerprint (§5)	Count page views and group them into visits on our public pages	Legitimate interest, Art. 6(1)(f)

Data: Email, password hash, name, locale
Purpose: Create and secure your account; let you log in
Lawful basis (GDPR Art. 6): Performance of a contract, Art. 6(1)(b)

Data: Tasks, loops, counters
Purpose: Provide the service you signed up for
Lawful basis (GDPR Art. 6): Performance of a contract, Art. 6(1)(b)

Data: API key details and daily request counts
Purpose: Let you, and the tools you authorise, use your account through the API; keep keys secure; set fair-use limits
Lawful basis (GDPR Art. 6): Performance of a contract, Art. 6(1)(b); request counts: legitimate interest, Art. 6(1)(f)

Data: Template you signed up from, timestamp of your first arming pass
Purpose: Measure, in aggregate only, whether people who sign up from a loop-template page start using DoLoop
Lawful basis (GDPR Art. 6): Legitimate interest, Art. 6(1)(f)

Data: Server logs
Purpose: Security, abuse prevention, debugging
Lawful basis (GDPR Art. 6): Legitimate interest, Art. 6(1)(f)

Data: Truncated IP + browser user-agent, as a short-lived visit fingerprint (§5)
Purpose: Count page views and group them into visits on our public pages
Lawful basis (GDPR Art. 6): Legitimate interest, Art. 6(1)(f)

We do not rely on consent for anything, because we do not do anything that needs it.

8. Who else sees it (processors)

Scaleway SAS (8 rue de la Ville-l'Évêque, 75008 Paris, France) — hosts the application, the database, the server logs and the database backups, on servers and object storage in France (Paris region), and sends our emails (such as password resets).
Our own analytics server (European Union) — the Matomo instance described in §5. It is operated by us, on infrastructure shared with the other products built by the same team, and it receives no account or content data. It is not a third-party analytics company and no analytics data is sold, shared or sent anywhere else.

That is the complete list. We have no advertising partners, no data brokers, and no third-party customer-support, CRM, or session-recording tools. All processing takes place in the EU/EEA; we make no international transfers under GDPR Chapter V.

9. How long we keep it

Account and content data: for as long as your account exists. Delete your account and it goes.
API keys: for as long as your account exists, including the record of keys that were revoked or have expired (they can no longer be used), together with their daily request counts. All of it is erased when you delete your account.
After deletion: your account, tasks, loops and counters are erased from the live database immediately. Database backups may retain a copy for up to 30 days, after which they are deleted on a rolling schedule. Backups are not used for anything other than disaster recovery.
Server logs: 14 days.
Analytics: aggregated reports (page counts, referrers, countries) are kept indefinitely, as they contain no identifier. The underlying raw visit records described in §5 — truncated IP, user-agent and the derived visit fingerprint — are deleted automatically after 760 days.

10. Your rights

Under GDPR you have the right to access your data, correct it, erase it, restrict or object to its processing, and receive it in a portable machine-readable format. You may also lodge a complaint with your national data protection authority — in France that is the CNIL (Commission nationale de l'informatique et des libertés, www.cnil.fr).

In practice:

Access / export — export your tasks and loops from the application, or email contact@getdoloop.com and we will send you everything we hold in JSON.
Correction — change your name and language in the app; email us for your email address.
Erasure — delete your account, or ask us to. Deleting your account deletes your tasks and loops with it (they are cascade-deleted with the user record).
Objection / restriction — email us.

We will respond within 30 days, and normally much faster. Exercising these rights is free, and we will not ask you to justify yourself.

11. Security

Passwords are stored as bcrypt hashes and are never logged or recoverable. All traffic to getdoloop.com and api.getdoloop.com is served over HTTPS. Access to the production database is limited to those who operate the service.

DoLoop is an early-stage product built by a very small team. We are not going to claim a security posture we cannot back up. If you find a vulnerability, please tell us at contact@getdoloop.com before telling anyone else, and we will credit you if you want the credit.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and tell affected users directly.

12. Children

DoLoop is not directed at children under 16. We do not knowingly create accounts for them. If you believe a child has an account, email us and we will delete it.

13. Automated decision-making

None. Nothing in DoLoop profiles you or makes automated decisions with legal or significant effects about you.

14. Changes to this policy

If we change this policy materially — a new processor, a new purpose, a new category of data — we will update the date at the top and notify registered users by email before the change takes effect. Cosmetic corrections may be made without notice.

15. Contact

BarnRecords SASU, 24 rue de la Sablonnière, 91410 Les Granges-le-Roi, France — contact@getdoloop.com

Full publisher details are in our legal notices.

Privacy Policy