Last updated: 2026-09-14 | Version: 1.2
Privacy policy
The short version: Dorift stores the tasks you type, the email you sign in with, and your subscription state. Everything lives on servers in Frankfurt. We don't run analytics, we don't sell data, and we don't share it with third parties beyond the narrow list of infrastructure providers we need to run the service.
Who we are
Dorift is operated by the independent developer listed at dorift.com/about (the "controller" under GDPR). Privacy contact: hello@dorift.com.
What we collect and why
Account data
Email address, hashed password, authentication tokens. Legal basis: performance of contract (Art. 6(1)(b)) — we can't operate an account without it.
Task data
The content of your tasks, categories, tags, notes, time entries, and preferences. Legal basis: performance of contract.
Subscription data
Tier, renewal date, Stripe customer and subscription identifiers. Legal basis: performance of contract.
Crash reports
If the app crashes, we record: your account id, the error type, a
shortened and redacted error message (quoted text and email
addresses are stripped before it is stored), the stack trace, app
version, platform (Android or web), the Dart runtime version, a
fingerprint used to group similar crashes, severity, and the time.
Legal basis: legitimate interest (Art. 6(1)(f)) in keeping the app
working. Your account id is stored so we can find and delete your
crash reports if you delete your account. Crash reports are
written to our own crash_reports table inside the
Supabase database in Frankfurt — Dorift does not forward them to
any third-party crash-reporting service (Sentry, Crashlytics,
Bugsnag, Rollbar, or similar). You can turn crash reporting off at
any time in Settings → Data. This description applies to every
version of the app that shows that switch; older versions, until
they update, still send the full error message and have no
switch.
Crash reports are deleted automatically 90 days after they are received (Article 5(1)(e) storage limitation). The deletion runs as a monthly server-side job and applies regardless of whether you still hold an account.
Who we share it with
Only the infrastructure providers on the transparency page. Each is bound by an Article 28 data processing agreement. We publish the full list with regions and data categories so you can audit us.
International transfers
Primary storage is in the European Union (Supabase eu-central-1 · Frankfurt). Limited transfers happen only for:
- Stripe payment processing, under Stripe's EU entity and Standard Contractual Clauses.
Retention
We keep your data for as long as your account is active. When you delete the account, we hard-delete all your rows within 30 days (the window covers sync conflict windows and scheduled backups). Stripe records are retained according to their policies and applicable tax law.
Your rights
Under GDPR, you can request access, rectification, erasure, portability, and restriction of processing. All of these are self-serve inside the app. If you prefer email, write to hello@dorift.com; we respond within the one-month Article 12(3) window.
You also have the right to lodge a complaint with your supervisory authority.
Security
TLS 1.2+ in transit; AES-256 at rest via Supabase-managed encryption; per-row Row-Level-Security so authenticated users only see their own data. Passwords are hashed with bcrypt (Supabase default). We follow the Article 32 obligation to keep technical measures appropriate to the risk, and update them as the state of the art evolves.
Changes to this policy
Material changes are announced in-app and by updating the date at the top. Trivial edits are versioned in the git history for the site repo.