Privacy Policy.
StarkDo holds the thoughts your brain keeps dropping. That trust is the whole point of the product, and this page describes — in plain language — how we honour it.
Overview
StarkDo is built by a small team for a particular kind of brain. We collect the minimum we need to make the app useful to you, we don't train AI models on your tasks, and we offer a fully self-hosted version for people who want their data to never leave their machine.
If anything here is unclear, write to us at [email protected] and a human will answer.
Data we collect
Account data
When you create an account we collect your email and a hashed password (or an OAuth identifier from a provider you choose). Your display name is optional. You may also choose to add a phone number for Telegram or for two-factor authentication — both opt-in.
The tasks themselves
Your captures, lists, due dates, tags, voice transcripts, and the calm metadata around them. This is what we exist to hold. We never sell it, never share it, and never use it to train AI models.
Voice recordings
When you capture by voice, we transcribe the audio to text. By default, the audio file is deleted as soon as the transcript is ready. You can opt into keeping the audio for later playback; that preference lives in your settings.
Operational data
Standard logs (timestamps, IP, device type, error stacks) needed to keep the service running and debug failures. We rotate logs aggressively and never join them to task content.
Location
If you use StarkDo's location-based reminders, the app accesses your device's location — both approximate and precise — to notice when you arrive at or leave a place you've defined (for example "Home" or "Office"), so the tasks you tagged for that place surface at the right time.
To do this while the app is closed or not in use, StarkDo accesses location in the background (geofencing). The places you create — their name, coordinates, and radius — and the enter/leave events they generate are stored in your StarkDo account on our servers, and are used only to power your own context-aware reminders.
This feature is entirely optional. It runs only if you add a place and grant the location permission, and you can turn it off at any time in your device settings. We never sell your location data, never share it with third parties, and never use it for advertising.
How we use it
- Run the product. Sync your tasks across devices, deliver notifications, run the daily Top 3 picker.
- Improve the product. Aggregate, anonymised metrics — how many people pause a pomodoro, which screens get used most. Never linked to your identity.
- Support. When you write to us, we read your message and look at the minimum diagnostic context needed to help.
- Legal & safety. We comply with valid legal requests, scoped narrowly, and we tell you when we're allowed to.
AI & your tasks
The Top 3 picker and the natural-language understanding ("call the dentist next week, mornings") run on AI models — either ours or a third-party provider you can choose in settings.
What you should know:
- We don't fine-tune or train models on your tasks. Ever.
- Your tasks are sent to the model only at the moment of inference, encrypted in transit, and we forbid the provider from retaining or training on them under our agreement.
- You can bring your own API key (self-host plan) and bypass our infrastructure entirely.
- You can also disable AI features and use StarkDo as a quiet, manual task system. Nothing breaks.
Sharing
We share personal information only with:
- Sub-processors that run the service on our behalf — hosting, transactional email, analytics, the chosen AI provider. Each one is bound by a data processing agreement.
- Government authorities when compelled by a valid legal request, narrowed to what the request specifically requires.
- Successors in the event of a merger, acquisition, or asset sale — under the same protections described here.
We do not sell personal information. We do not share it for cross-context behavioural advertising.
Cookies
The website uses a small number of strictly necessary cookies for authentication and preferences. We don't run third-party advertising trackers. If we ever add product analytics they will be first-party and aggregated, and you'll be able to disable them.
Retention & deletion
Active accounts: we keep your tasks as long as you keep your account, plus the period required to close out billing and legal obligations.
Closed accounts: we delete your tasks within 30 days of account deletion. Backups that contain residual copies expire within an additional 90 days.
You can export everything (Markdown, JSON, ICS) at any time. You can delete everything at any time. There are no hoops.
Security
We apply industry-standard controls — TLS in transit, encryption at rest, role-based access with least privilege, audit logging, secret management, routine third-party penetration testing.
End-to-end encrypted sync between your devices is opt-in on paid plans. With E2EE on, we cannot read your tasks even if we wanted to — but you also can't recover them if you lose your keys.
If we become aware of a breach affecting your data we notify you promptly and in line with applicable law. Security disclosures: [email protected].
Your rights
Depending on where you live (GDPR, CCPA/CPRA, UK GDPR, Israeli Privacy Protection Law, and similar regimes), you may have the right to:
- access the personal information we hold about you;
- correct it if it's wrong;
- delete it, subject to legal and operational exceptions;
- port it to another provider;
- object to or restrict certain processing;
- withdraw consent where processing relies on it.
To exercise these rights, write to [email protected]. We respond within the timeframe required by applicable law.
Self-host
StarkDo offers a free self-hosted plan. When you self-host:
- Your tasks never leave your machine.
- You bring your own AI key (if you want AI features); your prompts go directly from your server to the provider you chose.
- We don't collect telemetry. The binary doesn't phone home.
- This Privacy Policy doesn't apply to the data on your server — it's your data on your infrastructure.
Children
StarkDo is not directed at children under 16, and we don't knowingly collect their personal information. If you believe a child has provided information to us, write to us and we'll delete it.
Changes
We may update this policy as the product evolves. Material changes are announced in the app and emailed to account holders at least 30 days before they take effect. The effective date at the top reflects the current version.
Contact
For any privacy question, complaint, or rights request: [email protected].
For security disclosures: [email protected].
For everything else: [email protected].
You also have the right to lodge a complaint with your local supervisory authority.