Privacy policy

Your tasks stay
on this device.

Four & Done has no user accounts and no application backend. Your task content and daily plans are kept in your browser. This policy explains the limited circumstances in which other data is processed when you visit the website or join the waitlist.

1. Controller

2. Hosting and delivery

This website is delivered using Cloudflare Pages, a service provided by Cloudflare, Inc. When you open the website, Cloudflare processes technical connection data that may include your IP address, the requested address, date and time, referrer, browser and device information, and security-related request data.

The processing is necessary to deliver the website securely, prevent misuse, and maintain availability. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of Four & Done.

Cloudflare may process data outside the European Economic Area. Where required, transfers are protected by appropriate safeguards including the European Commission's Standard Contractual Clauses. Technical logs are retained only for as long as necessary for delivery, security and abuse prevention, subject to Cloudflare's applicable retention periods and legal obligations. Read Cloudflare's privacy policy and data processing addendum.

3. Data stored on your device

Task names, finish-line definitions, estimates, capacity selections, energy selections, saved-for-later items and daily plans are stored locally in your browser using IndexedDB. This data is not sent to Valerie Ross, Cloudflare, MailerLite or another application server by Four & Done.

Local storage is used so the application can remember the information you ask it to keep. This access is necessary to provide the local-first service you request. You can use My Data in the application footer to export a backup, import a backup, or permanently clear this data. Clearing browser or site storage may also remove it.

Local application data remains on your device until you delete it, clear the site's browser storage, or uninstall the application. Because we do not receive this data, we cannot view, recover or delete it for you.

4. Cookies

Four & Done does not set advertising cookies or use cross-site tracking. The local application storage described above is used only to provide the features you request.

5. Four & Done+ waitlist

The optional Four & Done+ waitlist opens a form hosted by MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. If you submit the form, we process your email address, subscription status, registration and confirmation times, and technical evidence needed to document your consent. MailerLite may also process connection and log data, including your IP address, when you use its form.

We use this information only to manage the waitlist and send early-access and launch updates. The legal basis is your consent under Article 6(1)(a) GDPR. We use double opt-in, so you must confirm your address before joining. You may withdraw consent at any time by using the unsubscribe link in an email or contacting us. Withdrawal does not affect processing that took place before it.

Waitlist information is retained until you withdraw consent or the waitlist and related launch communication have ended. We may retain the minimum information needed to record an unsubscribe and ensure that no further messages are sent. MailerLite acts as our processor; for EEA accounts it states that subscriber data is hosted in the EU. Read MailerLite's privacy policy and data processing addendum.

No task names, task details or daily plans are included when you open or submit the waitlist form.

6. Umami Cloud analytics

We intend to use a restricted, cookie-free configuration of Umami Cloud in the future to understand aggregate use and improve the application. Before activation, this status will be updated.

When activated, Umami Cloud will process page paths and titles, referrer, access time, browser, operating system, device category, screen size, language, approximate country or region, and fixed product events with coarse values such as a task count, selected time or energy level. The visitor's IP address and user agent are processed to derive an anonymous session identifier; Umami states that the IP address itself is not stored.

We will not send task text, task identifiers, email addresses or other direct identifiers. We will not use Umami's identify() function, distinct IDs, session replay or heatmaps. Umami will not be used for advertising or cross-site tracking.

The planned processing will be based on Article 6(1)(f) GDPR. Our legitimate interests are measuring aggregate feature use, finding usability problems and improving Four & Done while minimising the information collected. You may object to processing based on legitimate interests as described below. Analytics data will be deleted after 12 months.

The selected Umami Cloud account region is the European Union. The service is provided by Umami Software, Inc., 28 Geary Street, Suite 650 #243, San Francisco, California, USA. Any restricted transfer will be handled under Umami's data processing agreement and applicable transfer safeguards. Read the Umami privacy policy and data processing agreement.

7. Recipients and transfers

Personal data is disclosed only to the service providers described above where necessary to operate the website, provide the waitlist, or—after activation—produce privacy-limited analytics. We do not sell personal data.

Where a provider processes personal data outside the European Economic Area, we use the safeguards described in the relevant provider section, such as an adequacy decision or the European Commission's Standard Contractual Clauses. You may contact us for information about the safeguards applicable to a particular transfer.

8. Your rights

Subject to the conditions in the GDPR, you may request access to your personal data, correction, deletion, restriction of processing, or data portability. You may withdraw consent at any time. You may also object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.

To exercise these rights, email [email protected]. Please note that we cannot access or identify the task data stored only in your browser.

9. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our location is:

10. Automated decisions

We do not use personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.

11. Changes to this policy

We will update this policy when the services or processing activities change. In particular, the Umami status above will be changed before analytics is enabled.

Last updated: 10 October 2026