TellDone is a product of Kesterly Ltd, a company registered in England and Wales under company number 17359915, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Kesterly Ltd provides and operates the Service and is the data controller for the personal data described in this policy. We are registered with the UK Information Commissioner’s Office under registration reference ZC206782.
This Privacy Policy explains how we collect, use, store and protect your personal data when you use our mobile applications (iOS, watchOS), our web application at app.telldone.app, our cloud service at api.telldone.app, our API and MCP endpoints, and our website at telldone.app (together, the “Service”).
We are established in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 are the law we work to. Where we mention other regimes — California, for example — that is stated separately and does not change the UK analysis.
By using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.
@privaterelay.appleid.com) instead of your real address. We treat that relay address as your account email and never attempt to derive, look up or correlate it with your real email.sub claim), used solely to recognise you on subsequent sign-ins.sub claim, your name (if you grant it) and your email, used solely to recognise you on subsequent sign-ins. Our servers request the minimum OpenID Connect scopes (openid, email, profile) and no other Google scopes.People who are not TellDone users. A recording, a transcript or a note may contain personal data about someone who has no account with us and never agreed to anything: their words, and sometimes their name if it was spoken. We do not use that data to build a profile of them, we do not contact them, and we do not attempt to identify them beyond storing what was said. Responsibility for where and whom you record remains yours — see the acceptable-use section of the Terms of Service. If you believe a recording held by one of our users contains your personal data, contact us at legal@kesterly.com.
Sensitive content. We do not ask you for health, political, religious, biometric or other special category information, we do not analyse your recordings in order to derive any of it, and no feature of the Service is built on it. Because you decide what to record, a recording may nonetheless contain such content. If you would rather it did not reach our processors, do not record it.
Where the AI infers the name of a person mentioned in a recording — a meeting attendee, for example — that name is stored as part of the note. That is personal data about someone who may not be a TellDone user; see the paragraph above.
Retention for each of these is in section 5. Our apps contain no third-party analytics SDKs, no advertising SDKs, no tracking SDKs and no crash-reporting SDKs, and we do not fingerprint devices. The web app contains no third-party analytics or error-tracking service either. The only third-party measurement anywhere in the Service is the Google Analytics tag on our website, described in section 8.1.
If you connect Todoist, Notion or Microsoft To Do, the authorisation happens on our servers and we store, encrypted at column level before it is written to the database:
The content we send to or receive from these services is limited to the fields you create in TellDone (title, notes, due date, tags, completion status). We do not pull arbitrary content from your Notion workspace or your Todoist account, and with Microsoft To Do we interact only with the dedicated “TellDone” list we create, not your other lists.
You can disconnect any integration at any time in Settings → Integrations. Disconnecting always deletes our stored copy of the token from our database and stops the sync. What it does at the provider’s end depends on the provider, and the differences matter:
Deleting your whole account revokes less than disconnecting does, not more. Account deletion removes our copies of all three tokens but makes no revocation call to any of them — not even to Todoist. The only revocation attempted on that path is for Sign in with Apple (see section 5.1).
So the rule to work from is this: revocation at the provider happens for Todoist when you disconnect it. For Notion and Microsoft To Do, and for every provider when you delete your account, you should also revoke TellDone’s access in that provider’s own settings — Notion: Settings → My connections; Todoist: Settings → Integrations → Connected apps; Microsoft: https://account.live.com/consent/Manage.
Items previously created in the third-party service are not deleted automatically; you can delete them there if you wish.
Two integrations work differently, because they run on your device rather than on our servers.
Subscriptions can be bought through two channels.
We record which plan your account is on and when it renews or lapses.
Where we grant access to a paid plan without charge — a promotional grant, or a manual grant we make ourselves — we record the grant against your account. No payment data is involved.
None of this is required of you by law. What follows is what the Service needs in order to work, and what happens if you withhold it.
| Data | Required? | If you do not provide it |
|---|---|---|
| Email address | Required to hold an account with us — it is how we identify you and reach you | We cannot create or maintain an account |
| Password | Required unless you use Sign in with Apple or Sign in with Google | You cannot sign in with an email and password |
| Display name | Optional | Nothing; the Service addresses you less personally |
| Voice recordings | You choose what to record | The Service has nothing to transcribe or structure |
| Locale and time zone | Taken from your device | Scheduling, date interpretation and speech-to-text routing become less accurate |
| Device identifier | Generated by the app; needed for sync and per-device sign-in | Multi-device sync and per-device session revocation cannot work |
| Push notification token | Optional, and controlled by your device’s notification permission | You receive no push notifications |
| Integration authorisations | Entirely optional | That integration does not sync |
The legal bases below are stated under the UK GDPR. Where another regime applies to you — California, for example — see section 7.2.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the Service: transcribe your recordings, structure them into notes, tasks and events, and store them for you | Audio, transcripts, account data, generated content | Performance of our contract with you, Art. 6(1)(b) |
| Generate productivity reports | Notes, tasks, events | Performance of our contract with you |
| Send you report emails | Email address, report content | Consent — you can turn report emails off in Settings at any time |
| Send you transactional and security email (password reset, security notices, account notices) | Email address | Performance of our contract with you |
| Send push notifications | Device push token, the title of the note, task or event concerned | Performance of our contract with you (and your device’s notification permission) |
| Sync across your devices | All content, device identifier | Performance of our contract with you |
| Third-party integrations you connect (Todoist, Notion, Microsoft To Do) | The items you sync; the OAuth tokens we hold for that integration | Consent — you initiate each connection separately and can disconnect it |
| Sign in with Apple / Sign in with Google | Apple or Google sub claim, name, email |
Performance of our contract with you (account creation and authentication) |
| Enforce plan quotas and activate what you have paid for | Usage counts, receipt and entitlement data | Performance of our contract with you |
| Answer your support requests, including sorting them and preparing draft replies with the AI providers named in section 3, which a member of our team reviews before anything is sent | The content of your message, the earlier messages in that conversation, technical details of the request, the transcript of a voice message, and the account it concerns, including the account information listed for Anthropic in section 3 | Performance of our contract with you |
| Security and fraud prevention | Sign-in attempts, IP addresses, device data, rate-limiting counters | Legitimate interests, Art. 6(1)(f) — our interest in protecting the Service and the people who use it from abuse, unauthorised access and fraudulent use, and in keeping accounts secure |
| Diagnosing faults and improving the Service | Error logs, diagnostic bundles, analytics events, and any data in our database that our operations assistant reads to find a fault (see Anthropic, Operations, in section 3) | Legitimate interests, Art. 6(1)(f) — our interest in keeping the Service working, finding out why something failed, and making it better |
| Backups, so that we can restore the Service after a failure | Everything we store | Legitimate interests, Art. 6(1)(f) — our interest in not losing your data |
| Keeping a pseudonymised record of two kinds of action our team takes on Paddle payments (resolving a refund-check case, and manually re-processing a Paddle payment event that had not been processed), so that we can deal with complaints and claims about them | The day, the action and its reason code, a keyed code derived from the refund-check case or the Paddle event, a hash of the evidence reference our team recorded (for a re-processed event, a hash of the event reference and fixed counters), and, for a refund-check case linked to a Paddle transaction, a separate keyed code derived from the transaction ID (see section 5) | Legitimate interests, Art. 6(1)(f): our interest in dealing with complaints and claims about refunds and payments |
| Meeting a legal obligation that applies to us — for example responding to a valid legal request | Whatever the obligation requires | Legal obligation, Art. 6(1)(c) |
You can object to any processing we base on legitimate interests, and you can withdraw consent at any time without affecting what we did lawfully before you withdrew it. See section 7.
Our own commitment is unqualified: we do not use your audio, your transcripts, your notes or any other content you create in TellDone to train, fine-tune or evaluate any AI model, and we do not give anyone else your content for that purpose. No feature of the Service depends on doing so, and no setting anywhere turns it on.
Your content is sent to the AI providers listed in section 3 for two reasons only. The first is so that they can return a result (a transcript, a structured note, a report), which we pass back to you, or, when you contact support, a suggested category and a draft reply, which a member of our team reviews before anything is sent to you. The second is so that the operations assistant described in section 3 (Anthropic, Operations) can help us find and fix faults in the Service: it can read your content in our database for that purpose, and what it reads is sent to Anthropic. They act as our processors and we instruct them to use your content only for these purposes.
Where a provider below acts as our processor, we instruct it to process your data only to provide the function described and to keep it secure. Where a provider is an independent controller, your data is governed by that provider’s own privacy policy once it reaches their systems.
| Provider | Role | What it receives | Where it is processed |
|---|---|---|---|
| netcup GmbH | Processor | Hosting of the application, database and object storage — all account data, voice recordings, transcripts and generated content | Nuremberg, Germany |
| Hetzner Online GmbH | Processor | Encrypted off-site backups of the database and object storage | Germany |
| Soniox | Processor | Speech-to-text: your voice recordings, including voice messages you send to support, and the resulting transcript. Soniox deletes the recording and the transcript as soon as transcription is complete; if an attempt fails, the recording is deleted within about 14 days | Chosen by your time zone: the European Union endpoint if your time zone is in Europe, Africa or the Atlantic islands, is Istanbul or Nicosia, is UTC, or is not known; the United States endpoint for every other time zone, including the Americas, the Pacific, the rest of Asia (including the Middle East) and Australia. If the first endpoint returns an error, the same recording is sent once to the other endpoint. For a voice message to support, the time zone in your profile when you contact us is used |
| Fireworks AI | Processor | AI analysis — the first provider in our processing chain: transcripts and note, task and event text, for note structuring, smart context, follow-ups, questions about your notes, day planning, edit classification, your profile summary and speaker separation | United States |
| Mistral AI | Processor | The same content, when the first provider is unavailable | European Union |
| OpenAI | Processor | The same content, when the first two are unavailable; all report generation; and support triage: the full text of your support message (for a voice message, its transcript) and its language, from which it suggests a category, a priority and a short summary | United States |
| Anthropic | Processor | Support: when you contact support, your message (the transcript of a voice message, or the text you wrote or emailed), up to six earlier messages in that conversation, the request’s channel, category, priority, status and language, and what our triage step produced from your message: a short summary, and signals it picked out (email addresses or a plan you mention, the action you ask for, and whether it flagged the message as a threat). If you have a TellDone account, also information about that account so that the reply can address your problem: your email address and a name guessed from it; your plan, language and time-zone settings; how long you have had the account and when you last used it; how many notes and tasks you have and how many recordings failed in the last 30 days (counts only, never their content); your subscription (provider, plan, status, end of the current period and whether it is set to cancel); whether your email is verified, whether an email-verification or password-reset link is active or has expired (never the link itself), and which sign-in methods you use; your plan limits and the names of any adjustments made to them for you; which AI clients and integrations you have connected (names, addresses, dates and access level, never their tokens), whether you have issued an access token for AI clients, and, for the last 7 days, how many requests AI clients made and which tools they used; details of your last five recordings without their content (time, status, length, format, source, platform, app version); up to three of your devices (platform, app version, when last used); and up to three app errors from the last 30 days, with a short description. If you write from an email address with no account, that email address. Anthropic prepares a draft reply, which a member of our team reviews before anything is sent to you. Anthropic is also configured as a further fallback for report generation; no plan currently routes reports to it | United States |
| Anthropic | Processor | Operations: an AI assistant provided by Anthropic runs on our own server and helps us monitor the Service and find and fix faults. To do this it can read any data in our database (including your account details, your notes, tasks, events and transcripts, and your support messages), as well as our server logs and usage statistics. What it reads is sent to Anthropic to be processed. It can also prepare draft support replies, which a member of our team reviews before anything is sent to you | United States |
| Resend | Processor | Transactional and report email: your email address and the full body of the email — for a report email, that is the report itself | Resend, Inc. is established in the United States |
| Apple (Apple Push Notification service) | Processor | Your device push token and the notification content, which can include the title of a note, task or event | Apple infrastructure |
| A messaging service for internal support notifications | Message delivery | If you send us a support request, a notification card about your request is delivered to our support team through a messaging service we use for internal support notifications, including up to 600 characters of the text of your request, or of the transcript of your voice message, together with the draft reply prepared for our team. Audio is not sent to this service | The messaging service’s own infrastructure |
| Processor | Hosting of our support mailbox: an email you send to support@telldone.app is received there, and our replies to support requests are sent from it by email | Google infrastructure | |
| Twilio Inc. | Processor | Our published telephone line: if you call or text the number in section 14, Twilio carries that call or message and receives your telephone number and the associated call or message details | United States |
| Independent controller | Sign in with Google: we verify the identity token you present. We request only openid, email and profile and no other Google scope on our servers |
United States | |
| Apple | Independent controller | Sign in with Apple: we verify the identity token you present; private email relay if you use Hide My Email | United States |
| Doist S.L. (Todoist) | Independent controller | Task content for the items you choose to sync, if you connect Todoist | European Union |
| Notion Labs, Inc. | Independent controller | Page and database content for the items you choose to sync, if you connect Notion | United States |
| Microsoft Corporation | Independent controller | Task content in the dedicated “TellDone” list, if you connect Microsoft To Do | United States |
| Paddle (Paddle.com Inc. in the United States, Paddle.com (Canada) Ltd. in Canada, Paddle.com Market Limited for the rest of the world; registered office of the UK company: 30 Old Bailey, London, EC4M 7AU) | Merchant of Record for web purchases: Paddle sells web subscriptions to you | From us: your TellDone account ID, a checkout reference and the plan you chose. You give your contact and payment details to Paddle directly in its checkout; we do not receive your full card number | On Paddle’s own systems |
We also use an operational alerting service (ntfy.sh) to tell us when something on our servers breaks. By design those alerts carry no user content.
If you connect an external AI client through the User MCP endpoint (see Terms of Service section 23), that client is not our processor. It acts on your instruction and under credentials you issued: we transmit only the responses to the specific tool calls it makes, and what the client’s vendor does with those responses is governed by that vendor’s own privacy policy. We never send your account contents to such a client in bulk, and we never share them with the vendor for any purpose beyond completing your request. You can revoke a client’s access at any time in Settings → Integrations → AI Agents.
The providers listed as independent controllers process your data under their own privacy policies once it is in their systems. We recommend you review:
We are established in the United Kingdom, so sending your personal data to an organisation outside the UK is a restricted transfer and needs a lawful route.
Our own servers are in Germany. The application, the database and the object storage that holds your recordings run on hardware in Nuremberg; our backups are held in Germany too. Germany is in the European Economic Area, and the EEA is covered by the UK’s adequacy regulations, so no further safeguard is needed for those transfers.
Speech-to-text is routed by your time zone. If your time zone is in Europe, Africa or the Atlantic islands, or is Istanbul or Nicosia, your audio goes to the European endpoint; it also goes there if your time zone is UTC or we do not know it. For every other time zone (the Americas, the Pacific, the rest of Asia including the Middle East, and Australia), it goes to the United States endpoint. If the first endpoint returns an error, the same recording is sent once to the other one, so audio routed to Europe can reach the United States, and the other way round. Voice messages you send to support use the time zone in your profile at the time; a voice message that comes with no time zone goes to the European endpoint first.
Language processing is not routed by your location. The first provider in our chain is in the United States, the second is in the European Union and the third is in the United States, and reports are generated in the United States. Which one handles a given request depends on availability, not on where you are. Support requests are sorted and drafted in the United States, by OpenAI and Anthropic. Our operations assistant also sends what it reads to Anthropic in the United States.
For transfers to the United States, the following providers listed in section 3 hold an active certification under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as providing adequate protection: Google, Microsoft Corporation, Resend, Twilio Inc. and Notion Labs, Inc. We check their status against the official Data Privacy Framework list periodically (last checked 29 September 2026).
If you want to know what covers a particular transfer, write to legal@kesterly.com and we will tell you.
| Data | How long we keep it |
|---|---|
| Account data (email, name, locale, sign-in identifiers) | Until your account is deleted |
| Voice recordings | While your account exists. Deleting a note does not delete its recording; recordings are deleted when you delete your account (see section 5.1) |
| Notes, transcripts, tasks, events, reports, tags | Until you delete them or your account. A deleted item goes to trash and is then permanently removed after the window for your plan: Free 30 days · Basic 30 days · Pro 90 days · Ultra 365 days |
| OAuth tokens for integrations we hold (Todoist, Notion, Microsoft To Do) | Until you disconnect the integration or delete your account. Deleting our copy is not the same as cancelling the permission you gave the provider: disconnecting Todoist also asks Todoist to revoke it (best-effort), while Notion and Microsoft To Do are never revoked by us, and account deletion revokes none of the three. Section 1.6 says where to remove each one yourself |
| Sign in with Apple / Sign in with Google identifiers | Until account deletion. On deletion we make one attempt to revoke the refresh token Apple issued to us; the attempt is not retried and deletion proceeds whatever its outcome |
| API usage ledger | 180 days |
| Analytics events (not linked to your account) | 548 days |
| Diagnostic bundles (linked to your account) | 90 days |
| MCP usage log | 90 days |
| Voice messages sent to support | 7 days. The transcript of the message stays with your support request and is kept for as long as the request (see the support rows below). Copies inside encrypted backups expire on the backup schedule, up to about six months |
| Recordings and voice messages at our speech-to-text provider (Soniox) | Deleted as soon as transcription is complete; after a failed attempt, within about 14 days |
| Support requests from your account: your messages, our replies, the conversation history, the suggested category and the draft replies | Kept while your account exists and deleted with it. You can also ask us to delete a support request without deleting your account: we delete that request with its messages, our replies, the draft replies and any voice message, and your account and your other requests stay. This does not remove the copies in our support mailbox or the notification cards our team received (see below), or a copy the TellDone app has already stored on your device, because the app is not told about the deletion |
| Support requests sent by email from an address that has no TellDone account | Deleted automatically, with their messages and draft replies, once 12 months pass with no update to the request and no message added to it by you or by us. If you reply in the same email conversation, your reply is added to that request and the 12 months start again. A new email from you opens a new request; if by then you have a TellDone account with that address, the new request belongs to your account (row above). Requests you emailed before you had an account stay separate from your account: deleting your account does not delete them, and they are deleted automatically once 12 months pass without activity. You can also ask us to delete them: our team deletes each conversation it can match to you, with its messages and drafts, and anything we cannot match is deleted automatically after 12 months without activity. Please send such a request from the same email address, ideally as a reply in one of those conversations, so that we can check it comes from you |
| Copies of support emails in our support mailbox, and the notification cards our team receives through our internal support messaging service | Kept separately from your account; we do not currently delete them after a fixed period, and neither deleting your account nor deleting a support request at your request deletes them |
| Our internal record that a support request was closed, or that support data was deleted, with any note our team added (for a deletion, its reason) and, for a deletion, how many items were deleted | 180 days. This record is not removed when the support request it refers to is deleted |
| Our record of deletions: the type of each account or support-data deletion, an internal reference and the time (see section 5.1) | 215 days after the deletion. Copies of this record inside our encrypted backups are deleted when those backup snapshots expire on the rolling schedule above |
| Refund-check cases opened when an account with a subscription bought through Paddle is deleted: a random case reference, the Paddle transaction ID, the amount and currency, the status and dates of the case, and the reason our team recorded when closing it, chosen from a fixed list. They contain no email address or card details, but the Paddle transaction ID identifies the payment at Paddle | Kept until the case is resolved, and deleted at our next daily maintenance run. A case is resolved when our team closes it or when Paddle confirms that the refund was approved. An open case is kept until it is resolved; if a case is still open 14 days after the account was deleted, our team is alerted, and if it is still open 30 days after the deletion, it is escalated for manual review. An open case is not deleted or closed automatically because of its age |
| Our pseudonymised record of two kinds of action our team takes on Paddle payments: resolving a refund-check case, and manually re-processing a payment event from Paddle that had not been processed. Each record holds the day, the action and its reason code, a keyed code derived from the refund-check case or the Paddle event, a hash of the evidence reference our team recorded (for a re-processed event, a hash of the event reference and fixed counters, never the event’s content), and, for a refund-check case linked to a Paddle transaction, a separate keyed code derived from the transaction ID, together with a random record ID, the key version, the operator who acted and the expiry day. It contains no account ID, email address, payment ID or amount; the keyed codes can be matched to a case, an event or a payment only by someone who has both the original reference and a separate key that we hold | 6 calendar years from the day of the action, then removed by our daily cleanup. This record is kept after your account is deleted |
| Records of payment events we receive from Paddle (references, status, dates, plan, amounts and currency) | Removed by a regular cleanup about 90 days after we process them. An event we have not yet processed is not removed by this cleanup; it is kept until we process it or, if it is linked to your account, until your account is deleted. When your account is deleted, the events linked to your account are deleted with it, whether processed or not |
| Security event identifiers received from Apple and Google | 48 hours |
| Web server access logs, including IP addresses | 14 days |
| Other server logs | System logs are capped by size (4 GB) rather than by time; at current volume that holds roughly two months of entries. There is no fixed time limit |
| Backups | Kept on a rolling schedule — 7 daily, 4 weekly and 6 monthly snapshots. Data you have deleted can remain inside a backup snapshot for up to about six months before that snapshot expires |
| Data exports you generate | Your export file is available for 48 hours; it is deleted at the next daily cleanup after it expires, so within about 72 hours of generation at the latest. The download link is the only way to reach the file, and deleting your account removes any export files when the deletion runs (see section 5.1), regardless of expiry |
| Billing records | Deleted with your account. The exceptions are a refund-check case for a payment made through Paddle, which can be kept after your account is deleted until the case is resolved, and our pseudonymised record of our team’s actions on Paddle payments; both are described in this table. |
You can delete your account from the app. We then email you a link that is valid for 7 days. Opening the link changes nothing: the deletion is scheduled only when you press Confirm Deletion on the page it opens, and it then runs after a 7-day grace period. You can cancel it at any point before the grace period expires. If you do not confirm within 7 days, the request lapses and nothing is deleted. If you ask us to, for example by writing to support@telldone.app, we can shorten the grace period so that the deletion runs within 24 hours. We never shorten it unless you ask. Once we have shortened the grace period at your request, the deletion can no longer be cancelled. If you have a subscription bought through Paddle, the deletion runs only after we have confirmed with Paddle that the subscription is cancelled; if that cannot be confirmed, nothing is deleted and the deletion is tried again later, so it can run after the end of the grace period.
When it runs, the deletion works in this order, deliberately:
No human reviews the content of your data at any stage; the only manual steps are shortening the grace period when you ask us to, our team’s review of an open refund-check case if you had a subscription bought through Paddle, and, if we ever restore our systems from a backup, the repeat deletion described below.
Two things deletion does not do, because they are not ours to finish. Deleting your TellDone account does not cancel the permission you gave to Todoist, Notion or Microsoft. We delete our copies of those tokens, but we make no revocation call to any of the three on this path — not even to Todoist, which we do call when you disconnect it individually — so the authorisation stays active in your account with that provider until you remove it there. Section 1.6 says where, and it is worth doing before or after deleting your account. And the Sign in with Apple revocation above is an attempt, not a guarantee — you can always review or remove that authorisation yourself at https://appleid.apple.com.
Deleting your account also does not delete some support records, which are kept separately: support requests you emailed to us before you had a TellDone account, copies of support emails in our support mailbox, and the notification cards our team received through our internal support messaging service. Section 5 says how long each is kept.
The one thing deletion cannot reach immediately is our backups. Backup snapshots expire on the rolling schedule above, so data from a deleted account can persist inside a snapshot for up to about six months. We keep a separate record of every account deletion and every deletion of support data, showing only the type of deletion, an internal reference and the time. If we ever have to restore our systems from a backup, our team uses that record to delete again, as a step of the restore, the accounts and support data that had been deleted before it. For an account with payments made through Paddle, a member of our team does this by hand after checking the account with Paddle. Until that step is complete, data deleted after the backup was made can be present again in our systems. A note that had already been permanently removed from your trash can return to your trash after a restore; it is removed again when the window for your plan ends. Copies outside our database (the notification cards our team received, copies in our support mailbox) are not affected by a restore and are not removed by this record. A backup snapshot containing your data is deleted when it expires.
If you are a California resident you have the right to: know what personal information we collect, its sources, the purposes and the categories of recipients; delete your personal information, subject to exceptions permitted by law; correct inaccurate personal information; opt out of the “sale” of personal information (we do not sell it, and never have); opt out of “sharing” for cross-context behavioural advertising (we do not share it for that); limit the use of sensitive personal information (we use it only as reasonably necessary to provide the Service you asked for); and not be discriminated against for exercising any of these rights.
Categories collected, in CCPA terms: identifiers (email, Apple or Google sub claim, device UUID, IP address); audio and electronic information (voice recordings); internet activity (usage logs); and sensitive personal information (voice recordings, to the extent you choose to record sensitive content).
We do not make decisions about you that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. We do not profile you, and we do not build inferences about you for anyone else’s purposes.
The Service is nonetheless highly automated, and you should know exactly what that means: your recordings are transcribed, structured into notes, tasks and events, and summarised into reports by AI, with no human in the loop; and if you ask us to delete your account, that deletion is carried out automatically without human review; the only manual steps are shortening the grace period when you ask us to, our team’s review of an open refund-check case if you had a subscription bought through Paddle, and, if we ever restore our systems from a backup, the repeat deletion described in section 5.1. These are the features you asked for. They are not decisions taken about you in the sense above. Support is different: AI drafts a reply, but a member of our team reads and approves every reply before it is sent. Two things are automatic: a fixed message confirming that we received your request, and the category the AI assigned to it, which you can see in your list of requests.
This section covers everything the Service stores on, or reads from, your device — cookies, browser storage and the equivalent in the apps.
The website itself sets no cookies, contains no forms and collects nothing from you. Support from the website is an email link, not a form.
Before you consent, the site loads nothing from a third party: fonts and every other asset are served from our own servers, so the pages do not contact any third-party content delivery network. Every page carries a notice with Accept and Decline, and until you choose, no analytics tag is loaded. If you decline, your choice is remembered and the tag is never loaded.
| What is stored | Type | Purpose | When it is written | How long it lasts |
|---|---|---|---|---|
cookie-consent |
Browser local storage | Records whether you accepted or declined analytics, so we do not ask again and so your refusal is honoured | When you click Accept or Decline | Until you clear your browser storage |
theme |
Browser local storage | Remembers whether you chose the light or dark appearance | When your appearance preference is stored | Until you clear your browser storage |
_ga, _ga_* |
Cookies set by Google | Google Analytics 4 (measurement ID G-TFMR5XEXBC) — visit statistics only. We do not use advertising cookies, tracking pixels or cross-site trackers |
Only after you click Accept | Set and expired by Google, under Google’s own retention |
TellDone’s own web-app code does not read or write first-party cookies. What it keeps, it keeps in your browser’s local storage and IndexedDB, on your device, and uses to run the app; the table below lists all of it. The third-party sign-in providers described at the end of this section may use storage of their own, which is theirs and not ours.
The web app collects no behavioural usage analytics — no stream of clicks, screens or page views, and no third-party analytics or error-tracking service of any kind. When technical diagnostics are enabled, it may send us a limited report when a specific error occurs; that is described below and is the only thing of this sort it sends.
| What is stored | Where | Purpose | How long it lasts |
|---|---|---|---|
access_token, refresh_token |
Local storage | Your TellDone sign-in tokens, so you stay signed in. They are never put in a cookie | Removed from this browser when you sign out. The access token is valid for up to 7 days, the refresh token for 90 days; using the refresh token renews the 90 days, so signing in stays active while you use the app, and after about 90 days of not using it you are signed out |
lp.auth |
Local storage | A cached copy of your account details — identity, email, plan, preferences and entitlements — so the app can open and show your workspace before it reaches the network | Removed when you sign out |
telldone:auth-session |
Local storage | A random marker for the current sign-in, renewed each time you sign in | Removed when you sign out |
device_id |
Local storage | A random identifier for this browser, sent with changes you make and with diagnostic reports so we can tell devices apart. It is not removed when you sign out — clearing your browser storage removes it | Until you clear your browser storage |
locale, content_locale, theme, colorTheme, density, detailPanelWidth, settingsTab |
Local storage | Your interface preferences: language, appearance, layout density and which panel you had open | Until you clear your browser storage |
hasSeenOnboardingTour, hasSeenWelcome, hasAskedMic, pendingAutoRecord |
Local storage | Remembers that you have seen the introduction and been asked for microphone permission, so you are not asked twice | Until you clear your browser storage |
recorder:pendingAudioIds:<account>, recorder:successfulRunsCount |
Local storage | Keeps track of recordings that have not finished uploading, and counts successful runs so the app can spot a recorder that is failing | The pending list expires after 24 hours |
| Detail-view markers per item | Local storage | Remembers how you had a note, task or event displayed | Until you clear your browser storage |
telldone:diagnostics-enabled |
Local storage | Records whether you have turned technical diagnostics off | Until you clear your browser storage |
| Offline upload queue | IndexedDB | If a recording cannot be uploaded — you are offline, or the upload fails — the app keeps it on your device so it is not lost, and retries. See below | Removed as soon as the upload succeeds or you deal with it yourself. Otherwise it becomes eligible for clearing once it is more than 30 days old, and is cleared the next time the app opens the queue |
Signing out. Signing out removes the tokens above from this browser and revokes the refresh token, so nothing new can be obtained with it. It does not cancel an access credential that was already issued: that one remains valid until it expires, which can be up to 7 days. Section 6 explains why.
Recordings waiting on your device. The offline queue is the one item here worth reading twice. When an upload cannot complete, the entry the app stores on your device can contain the audio recording itself, or the text you typed, together with the file name, the time and time zone you recorded at, and what it is attached to.
Most of the time you will see it: when an upload has failed for good or run out of retries, the recording stays visible in the app with Retry and Dismiss, and it waits there until you choose one. What is not visible is the tail. An entry that is never dealt with becomes eligible for clearing once it is more than 30 days old — but that clearing happens when the app next opens the queue, not on a timer. So if you record while offline and never come back to the app, the recording stays on your device: past 30 days it is eligible to go, and it goes the next time the app looks. Entries left over from an older version of the app, which are not attached to any account, are held aside and cleared the same way.
All of this is storage on your own device rather than ours. We describe it because it is your recording and you should know where it is.
Technical diagnostics. When a recording, an upload or the live connection fails, the app can send us a report of that failure. It is triggered by errors only — never by what you click or look at — and it is first-party: the report goes to our own servers and to no one else. It contains the kind of error, the platform, the time, the type and identifier of the item involved if there is one, a short summary and technical context, and it carries your sign-in token and the device_id above, so the report is linked to your account. It is on by default, and you can turn it off in Settings → Data and privacy. That choice is stored in the browser you make it in and does not carry over to other browsers or devices. Retention is in section 5, with the other diagnostic bundles.
When you contact support from the web app, the message you send carries the screen you sent it from, your time zone and your browser’s user-agent string, so we can reproduce the problem. If you send a voice or file message, we receive what you attach.
The one third party the web app contacts without you asking it to. On the sign-in screen, the Sign in with Google button loads a script from Google in order to draw itself. That happens before you have signed in and without you clicking anything, so where that button is shown, Google receives your IP address and the usual network metadata simply because the sign-in page loaded. Sign in with Apple behaves differently: its script loads only at the moment you choose Apple sign-in. Any cookies Google or Apple set at that point are theirs, governed by their privacy policies; TellDone does not read or write them.
Everything else the web app reaches, you start yourself: connecting Todoist, Notion or Microsoft To Do takes you through that provider’s own authorisation pages; a link you open — whether it is one you exported, or one of ours to help or legal pages — goes where it says it goes. Apart from the sign-in script above and the destinations you choose, the web app talks only to our own servers, and its fonts and icons are served from our own servers.
The apps contain no advertising SDKs, no third-party analytics SDKs, no tracking SDKs and no crash-reporting SDKs. They have exactly three third-party components: a library that converts your recording to OGG Opus on the device, a local database library, and Google’s sign-in library. Only the last of those talks to anyone, and only to Google: it is used when you sign in with Google, and each time the app starts it also contacts Google to check that the app is genuine, whether or not you use Google sign-in. No App Tracking Transparency prompt is shown, because there is nothing to ask you about: we do not track you across other companies’ apps or websites, and the app contains no code for it.
What the apps ask permission for, and only when it is needed:
The apps do not ask for your location, contacts, photos, camera or health data at all.
What is kept on your device. A local cache of your notes, tasks and events in the app’s own private storage; your recordings in the app’s shared container so the Watch app and extensions can reach them; and your sign-in tokens in the iOS Keychain.
What leaves your device goes to our own servers and nowhere else — your recordings and transcripts, and your notes, tasks and events as they sync. Alongside those, the apps send two small streams:
You must be at least 16 years old to create a TellDone account, and we do not knowingly collect personal data from anyone under 16.
Sixteen is our own contractual requirement, not the legal minimum. Under UK data protection law, where an online service relies on consent, a child of 13 or over can give that consent themselves. We set the bar at 16 because we do not offer parental-consent account creation.
In the United States, the Service is not directed to children under 13 within the meaning of the Children’s Online Privacy Protection Act (“COPPA”), and we do not knowingly collect personal information from children under 13.
If we discover that we hold data about someone below our minimum age, we delete it promptly. If you believe a child has given us personal data, contact us at legal@kesterly.com and we will act without undue delay.
We may update this Privacy Policy. When we make a material change — one that materially affects how we collect or use your data, including any change in how we use Google API user data or Sign in with Apple data — we will:
If you disagree with a change, you may close your account before the effective date.
TellDone’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What this means in practice:
openid, email, profile). We use what we receive solely to create and authenticate your TellDone account.https://www.googleapis.com/auth/tasks, so that it can keep your tasks in step. That request is made at the moment you connect the integration and not before, it is the only additional Google scope TellDone asks for anywhere, and the app talks to Google directly from your device — the token never reaches our servers.You can revoke our access to your Google account at any time at https://myaccount.google.com/permissions.
If you connect Microsoft To Do, TellDone offers an optional, strictly user-initiated two-way sync of your tasks between TellDone and your Microsoft To Do account. This integration is available on the Basic plan and above (Basic includes one integration slot; Pro and above include unlimited integrations) and is connected only after you complete Microsoft’s OAuth consent flow. TellDone is an independent application that works with Microsoft To Do; we are not affiliated with, sponsored by, or endorsed by Microsoft.
Authorisation uses the Microsoft identity platform (OAuth 2.0, authority login.microsoftonline.com/common) and supports both personal Microsoft accounts and work or school accounts. We request delegated permissions only — permissions that act on your behalf; we never request application-only or administrator access:
Tasks.ReadWrite — to read and write the tasks in your Microsoft To Do.offline_access — to obtain a refresh token so the sync can continue in the background without asking you to sign in again.openid — to identify the account you connected.We do not use administrator (“admin consent”) permissions; each user consents individually for their own account. When the integration is active, we create a dedicated task list named “TellDone” in your Microsoft To Do and write the title, description, deadline and completion status of your TellDone tasks into that list. We poll that same “TellDone” list — using a delta query, roughly every five minutes — for completion and deletion changes and reflect them back in TellDone. We interact only with the “TellDone” list we create; we do not read your other Microsoft To Do lists. We never use data obtained from Microsoft to develop, improve or train AI or machine-learning models, and we do not use it for advertising.
Your Microsoft OAuth access and refresh tokens are stored in our database encrypted at column level (Fernet symmetric encryption). Our production servers are in Germany.
You can disconnect Microsoft To Do at any time in TellDone Settings → Integrations. Disconnecting immediately deletes the stored tokens from our servers and stops the sync. Disconnecting in TellDone does not, by itself, revoke TellDone’s authorisation on Microsoft’s side; to remove that grant as well, revoke TellDone’s access in your Microsoft account settings at https://account.live.com/consent/Manage. Tasks previously written to the “TellDone” list are not deleted from your Microsoft To Do when you disconnect; you can delete them there if you wish.
Our use of Microsoft APIs is subject to the Microsoft APIs Terms of Use; once your data is in Microsoft’s systems it is governed by the Microsoft Services Agreement and the Microsoft Privacy Statement, at https://privacy.microsoft.com/privacystatement.
When you use Sign in with Apple, we receive only what Apple provides:
sub claim);@privaterelay.appleid.com.We use this only to create and authenticate your TellDone account and, for the email address, to send you transactional email such as report digests, password resets and security notices. We do not attempt to deanonymise the relay address, do not send marketing email to relay addresses, and respect your choice to disable email forwarding in your Apple ID settings.
When you delete your TellDone account we attempt to revoke the refresh token Apple issued to us, using Apple’s Sign in with Apple REST revocation endpoint. The attempt is made once and is not retried; if it fails, the failure is logged and your account deletion goes ahead anyway. So treat it as an attempt rather than a guarantee, and revoke Apple’s authorisation yourself if you want to be certain — at any time in iOS Settings → [your name] → Sign in with Apple, or at https://appleid.apple.com.
When you connect Notion via OAuth, you are taken to Notion’s authorisation screen where you select which workspace and which specific pages or databases TellDone may access. We can only see the resources you grant; we cannot read other content in your workspace. We use this access only to create, read, update and delete items that correspond to your TellDone notes, tasks or events. We never use your Notion content to train any AI model, and never share it with any party other than the processors listed in section 3, strictly to provide the sync.
When you connect Todoist via OAuth, we request exactly two scopes: data:read_write and data:delete. We use this access solely to create, read, update, complete and — if you opt in — delete tasks that correspond to your TellDone tasks. We do not use your Todoist content to train any AI model and do not share it beyond the processors in section 3.
You can disconnect either integration at any time in TellDone Settings → Integrations, which deletes our stored copy of the token and stops the sync. When you disconnect Todoist we also ask Todoist to revoke the token, on a best-effort basis. Notion has no way for us to do that, so disconnecting does not cancel the permission you granted inside Notion — remove our access yourself in Notion → Settings → My connections. And on either integration, if you delete your whole TellDone account rather than disconnecting, no revocation call is made at all; remove our access in the provider’s settings (Todoist — Settings → Integrations → Connected apps). Section 1.6 sets this out in full.
The data controller for personal data processed under this Privacy Policy is:
TellDone is a product of Kesterly Ltd.
Data Protection Officer. We have not designated a Data Protection Officer. Data protection questions and requests go to legal@kesterly.com and are handled by the company.
If you think we have got something wrong, tell us first: legal@kesterly.com. You have the right to complain directly to us about how we handle your personal data, under section 164A of the Data Protection Act 2018.
We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to look into it, and tell you the outcome without undue delay.
You can also complain to the UK’s data protection regulator, under section 165 of the Data Protection Act 2018:
You do not have to complain to us first, though it is usually quicker.
This Privacy Policy applies to the TellDone mobile applications (iOS, watchOS), the web application at app.telldone.app, the cloud service at api.telldone.app including our MCP endpoint, and the website at telldone.app. It does not apply to third-party services linked from our app or website — Notion, Todoist, Google, Apple, Microsoft and others — which have their own privacy policies.