Last updated: September 16, 2026
Updated 7 September 2026. If you allow analytics, Finally done, MB uses Google Analytics to understand website visits, traffic sources, active engagement and explicitly labelled interactions. Google processes browser/device information, approximate location and cookie identifiers. Analytics starts only after you allow it. Rejecting analytics does not affect the site.
We do not send note titles, note text, searches, health records, email content or form entries to Analytics. Advertising features and automatic enhanced measurement are disabled. This describes the public website, not new tracking in the native app.
Use Analytics settings on this site to withdraw permission. This stops subsequent measurement and removes this site's Analytics cookies. Withdrawal does not undo earlier processing. Your choice is stored in this browser for 180 days. Host-only cookies _ga and _ga_5F2J3LY3DG last up to 180 days without renewal. User and event data retention is two months, without reset on activity; aggregate reports may remain longer.
Google may process data outside the EEA. See Google's privacy notice for its processing and safeguards. Cloudflare processes technical requests to deliver and protect the site and provide aggregate traffic and crawler reports. Contact hello@finallydone.ai about data rights, including access, correction, deletion, restriction, portability and withdrawal where applicable. You may complain to the Lithuanian State Data Protection Inspectorate or your local authority.
Before discarding the request IP address, we may compare it with published operator network ranges to retain a network or crawler classification, the matching source and its freshness. We keep observed request categories and claimed identities separate from verified evidence; network ownership alone does not establish residential access, a person or an employer. We also record requested and returned content formats and broad public route categories to distinguish successful machine-readable content from missing-page responses.
Automated clients may voluntarily send the fixed purpose, resource, tool and requester-type categories described at /agent-intelligence.json, and optionally a public organization domain or public HTTPS project URL they intend to disclose. We validate the format and discard unsupported values. Public project URLs may retain a simple public path, but never credentials, query parameters or fragments. These claims are not verified identities or proof of an affiliation. We retain these as unverified declarations alongside the technical request statistics above, under the same access and retention limits. Participation does not affect access. Please do not send prompts, queries, personal details, names, account identifiers, credentials, private project links or private task descriptions. We do not create a unique guest identifier or infer a person from these declarations.
We also preserve consent-based Google Analytics reports in this private archive: daily reports for 24 full calendar months plus the current month, and monthly acquisition, interaction and successful-use aggregates for 60 full calendar months plus the current month. Explicitly marked testing visits are labelled separately. Historical reports without this label are treated as unclassified. These exports contain aggregate report dimensions and counts, not raw IP addresses, visitor identifiers or note content.
We use technical request information to understand public website reach, crawler activity and reliability, and to guide improvements to our websites and services. Cloudflare supplies approximate country, region, city, timezone, network number (ASN) and network owner where available. We retain these derived fields together with the public page or asset requested, response status, browser/device families, self-declared crawler category, referring website domain and technical response measurements. Location is approximate and network ownership does not identify your employer. Unknown values remain unknown.
This server-side processing uses information already accompanying a website request. It does not set analytics cookies, read your notes or create an individual visitor profile. Our intelligence store does not retain raw IP addresses, full user-agent strings, cookies, URL query strings, note content, account identifiers or private synchronization requests. Google Analytics remains separate and starts only after your consent.
We rely on our legitimate interests in understanding and improving our public services, monitoring crawler access and maintaining website reliability. We limit the information, access and retention, and do not use it for advertising or decisions about individuals. You can contact hello@finallydone.ai to object to this processing or exercise applicable data rights.
Our access-restricted Cloudflare D1 archive retains detailed derived records for 90 days. Daily grouped statistics are retained for 24 full calendar months plus the current month, and monthly grouped statistics for 60 full calendar months plus the current month to compare product, audience and channel changes over time. Private recovery copies rotate within eight days, and restored records are checked against these limits before use. Access is restricted to operating and analysing these websites. Cloudflare may process requests internationally; our primary intelligence archive is hosted by Cloudflare, with versioned recovery copies on our private infrastructure. Expiry runs in bounded batches and can be delayed by service or quota interruptions. No archive information is published as a public visitor dashboard.
Finally Done ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application and services.
Data Controller: Finally Done is operated by Finally done, MB, the data controller responsible for your personal information. For questions about data protection, contact support@finallydone.app. This policy covers the Finally Done app and this website; the company website at finallydone.ai has its own privacy notice.
Legal Basis for Processing: We process your personal information based on: (1) your consent when you create an account and use our services, (2) the necessity to perform our contract with you (providing the App's functionality), and (3) our legitimate interests in improving our services and ensuring security.
We collect information that you provide directly to us, including:
We may also automatically collect certain information about your device, including device identifiers, operating system, and app version. We do not currently collect detailed usage analytics or behavior tracking patterns, though we may implement such features in the future to improve user experience. We do not collect precise location data unless you explicitly grant permission.
Connecting Google is optional. You choose Google Tasks, Google Calendar, or both in the app's integration settings and authorize access through Google's consent screen. We receive your Google account identifier, email address and name to identify the connected account, and authorization tokens to carry out the features you enable.
The app communicates with Google's APIs to perform these actions. Authorization tokens and connected-account details are kept in the device's secure storage. The app also keeps local caches and pending task changes so that it can display data and retry changes. Deleting an event or task through the app changes the corresponding item in your Google account.
Disconnecting and deletion: Use Settings, then Integrations, to disconnect Google. The app attempts to revoke its Google authorization and removes the locally stored connection credentials. You can also revoke access at Google Account connections. Disconnecting does not delete tasks or events from your Google account, or automatically delete content you separately captured in Finally Done. Contact support@finallydone.app to request deletion of retained app data, including Google-related local or stored data, or deletion of your Finally Done account.
Gmail access is not part of the current Google Tasks and Calendar integration. Any additional Google service or new use of Google data requires appropriate disclosure and authorization before it is enabled.
We use the information we collect to:
AI Processing: Finally Done uses Google's Gemini API to transcribe audio you submit through the app. Your recording and transcription instructions are sent to Gemini, and the resulting text is returned to provide the transcription feature. Audio and app content may also be stored in our cloud services to synchronize your captures. Connecting Google Calendar or Google Tasks does not itself authorize unrelated uses of that data.
Google API Limited Use: Finally Done's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. We do not use, transfer or sell raw, aggregated or derived Google user data to create, train or improve foundational or generalized AI or machine learning models. Google user data is used only to provide or improve the user-facing features you authorize, and is not used for advertising.
Our backend uses Gemini API through a Google Cloud project with active billing. Under Google's Paid Services terms, prompts and responses are not used to improve Google's products or train its generalized models. Google may retain prompts and responses for a limited period for abuse prevention, service security and required legal disclosures. Any AI processing of Google API user data is limited to the authorized app feature. Human access to Google user data is limited to your affirmative agreement to view specific data, necessary security investigations, legal requirements, or internal operations using data aggregated and anonymized as permitted by Google's Limited Use requirements.
AI Transparency: Our App uses automated processing (AI) to provide responses and functionality. You have the right to understand how AI decisions are made and to request human review of significant automated decisions that affect you. If you have concerns about AI-generated content or decisions, please contact us.
Future Analytics: We may in the future implement analytics to track feature usage and analyze user behavior patterns to improve the user experience and add new features. If we implement such features, we will update this Privacy Policy accordingly.
We do not sell your personal information. We may share your information only in the following circumstances:
We implement appropriate technical and organizational measures to protect your personal information, including encryption of data in transit and at rest, secure authentication, and regular security assessments. However, no method of transmission over the internet is 100% secure.
Data Breach Notification: In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours as required by applicable data protection laws.
We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes.
Depending on your location, you may have the following rights:
Your choices: You may stop submitting content to AI features and disconnect optional Google services while retaining your Finally Done account. Revoking Google access stops future authorized API access; it does not erase existing app captures or the original items in Google. Contact us to request deletion of your app data or account. Website analytics has a separate consent control described above.
Current vs. Future Processing: Currently, we process data necessary for core service delivery and AI functionality. We may in the future implement optional analytics features (such as feature usage tracking or behavior pattern analysis). If we do, we will update this policy and provide opt-out mechanisms where technically feasible.
To exercise these rights, please contact us at support@finallydone.app. We will respond to your request within 30 days.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell your personal information.
Our App uses the following third-party services to help us operate and improve our services:
These third parties may have access to your information only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose. Each service provider has their own privacy policies governing their use of data.
Your information is stored and processed in the United States. If you are located outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. We implement appropriate technical and organizational safeguards to protect your information, including encryption and secure data transmission protocols. By using our App, you consent to the transfer of your information to the United States. We prioritize security and privacy-first design in all our data handling practices.
Our services are intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you are under 18, you must have your parent's or guardian's permission to use our App, and they must agree to these Terms and Privacy Policy on your behalf. If you believe we have collected information from someone under 18 without proper consent, please contact us immediately.
Our App may use cookies, local storage, and similar technologies to maintain your session, store preferences, and improve functionality. These technologies are essential for core App functionality. We do not currently use cookies for advertising or third-party tracking purposes. If we implement such features in the future, we will update this policy and provide opt-out mechanisms.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date and, where appropriate, notifying you through the app. Before using Google user data for a new purpose, we will disclose that purpose and obtain your affirmative consent where required. Continued use alone does not authorize a new use of Google user data.
When the on-site feedback service is available, you can send an idea or issue without an account or contact details. Your message and any image, marks, or voice note you choose to include are sent only when you select Send. Capture and image review happen locally first. Review attachments before sending and avoid including credentials or unrelated sensitive information.
Basic technical details are a separate option, off by default. They include browser language, viewport size, and app build, not page addresses, form contents, or browsing history. You may optionally provide an email address or a messenger platform and handle. These contact details are private report data, not public updates or analytics data. We use reports to review and respond to feedback and improve the service.
The feedback service stores reports in Cloudflare D1 and attachments in private Cloudflare R2. The current configuration schedules attachments to expire after 30 days and reports, including optional contact details, after 90 days. Deletion runs periodically and can be delayed by service interruptions. Contact us about deletion or other applicable data rights.
A private receipt is stored in this browser's localStorage so My feedback can retrieve deliberately published updates. The receipt is an access capability, not an account. Other people or scripts with access to this browser and site storage may be able to use it. Receipts remain until the site's browser data is cleared; clearing them does not delete the server report. An unsent draft stays in memory for the current visit.
Email update delivery is currently off. If enabled, receiving updates requires a separate request and confirmation of the email address. Email preferences provides withdrawal and mailbox-based access recovery where available; recovery does not restore report-deletion authority. A response or update is not guaranteed.
Optional browser error and performance monitoring is currently unconfigured and off. When configured, it requires its own Monitoring preferences choice, separate from report diagnostics and Google Analytics. The shared controls describe the limited measurements before consent and allow withdrawal. They exclude report contents, images, audio, contacts, receipt secrets, and full page addresses. Its versioned choice is stored in this site's localStorage; unavailable or invalid storage does not enable monitoring automatically.
If you have questions about this Privacy Policy, please contact us at:
Email: support@finallydone.app
← Back to Home