Legal Notice & Privacy

Scope

This notice applies to the website and service available at almostdone.io (the “Service”), including the public board pages served under /<username> when their owner has opted into public visibility.

Imprint (§ 5 TMG)

Responsible for content within the meaning of § 18 (2) MStV: Nicolas Malz, address as above.

Privacy Notice (GDPR)

We process personal data only to the extent necessary to provide the Service. The legal basis is your consent and our contractual obligation to provide the account you sign up for (Art. 6 (1) (a) and (b) GDPR), and our legitimate interest in operating a secure service (Art. 6 (1) (f) GDPR).

Data we process

• Account data: email address and a hashed password (or, if you sign in with Google, your Google account identifier and email). Used to authenticate you.
• Profile data: the username you choose and a public/private flag. The username forms the URL of your board (almostdone.io/<username>) and is visible to anyone who knows the URL when your board is set to “public”.
• Board content: the task titles, optional notes, due dates, tags, status (Later, Today, Doing, Done) and ordering you create. By default this content is private; only you can read it.
• Technical data: standard server log data such as IP address, user agent and timestamps, kept by our hosting provider for a short period for security purposes.

We do not use tracking cookies, advertising pixels or third-party analytics. We do not create profiles about you for marketing.

AI-assisted features

When you ask the Service to suggest tags for a task, the task title and notes are sent to the Lovable AI Gateway, which forwards the prompt to a large-language-model provider (currently Google Gemini and/or OpenAI). The provider processes the text only to generate a response and, per their data-processing terms, does not use it to train their models. Do not put information you do not want to share with these providers into the title or notes of a task on which you trigger AI suggestions. Legal basis: your consent expressed by triggering the feature (Art. 6 (1) (a) GDPR).

Sub-processors & international transfers

Account data and board content are stored in a managed Postgres database operated by Supabase Inc. on our behalf. The application is served via the Lovable platform. Both providers act as processors under Art. 28 GDPR. AI requests are processed by the providers named above, which may involve a transfer to the United States covered by Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

Retention

We keep your account, profile and board content for as long as your account exists. Tasks moved to Done fade visually after 48 hours but remain stored until you delete them. You can delete individual tasks at any time. To delete your account and all associated data, contact us at the email above and we will erase it within 30 days unless we are legally required to keep it.

Your rights

Under the GDPR you have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18) and port (Art. 20) your personal data, and to object to processing based on our legitimate interests (Art. 21). Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before. To exercise any of these rights, write to [email protected]. You also have the right to lodge a complaint with a supervisory authority, e.g. the data protection authority of Schleswig-Holstein (ULD).

Cookies

The Service sets only strictly-necessary cookies and local-storage entries needed to keep you signed in and to remember your theme preference. No consent banner is required for these under § 25 (2) TTDSG.

Copyright

© 2026 Nicolas Malz. The design, code and content of almostdone.io are protected by copyright. The content you create on your board belongs to you; by making your board public you grant other visitors permission to view it.

Liability

The Service is provided “as is” without warranty of any kind. We take reasonable care to keep your data secure but cannot guarantee uninterrupted availability. We are not liable for the content of external websites linked from this site; responsibility for those lies with their respective operators.