Privacy policy

Last updated 24 October 2026

Done is an unofficial student tool. It is not run by, or affiliated with, any university.

Your passwords

Your university (LMS) password is used once each time you type it (registering, Forgot password, Refresh attendance), to get the LMS's own app key (the same kind the official Moodle app uses) or to read your attendance. It is never stored, never logged and never sent anywhere else. The app key is stored encrypted, and only the part of our service that reads the LMS for you holds the key to open it.

Your Done password is stored only as a salted one-way hash; nobody, including us, can read it back. Changing it signs you out on every other device.

What we store

• Your name, LMS user id and email address, and your WhatsApp number if you link it (encrypted).
• The sealed LMS app key, and your plan and trial dates.
• A copy of your LMS data (courses, assignments, deadlines, grades, attendance, announcements), so pages open instantly. Changes are kept for 30 days for "what changed".
• Attendance you bring in with the Update attendance bookmark or by pasting it: only the numbers and the list of classes, never the pages. The bookmark runs in your own browser, only on your LMS, only opens your own attendance pages, and never presses anything there.
• What you add yourself: tasks, notes, reminders, your board, timetable and study settings, and your study chats.
• The text of your course files, for search and study tools. The files themselves are not kept; they are fetched from the LMS when you open them.
• Receipts of your submissions (course, assignment, file name and time).
• Files you upload (on the website, by email or on WhatsApp), only while the upload is in progress; they are deleted afterwards. Emails you send to Done stay in the Done Gmail account. Questions you email are answered from your saved data, the same as the website's assistant; their words aren't logged. If you saved your own Gemini key and Done can't tell what an email means, its words (without your name) go to Gemini to pick one meaning; Gemini never acts. Done removes a submission only when you ask, confirm with YES DELETE, and your LMS allows it.
• A short activity log (what happened and when, never message text), deleted after 30 days.

Who sees it

Only you. Each student's data is walled off in the database. Our team sees accounts, plans and service health, and sees your private data only if you allow it for a support question, for a limited time. Your data is never sold.

We use these providers to run the service: Vercel (website and background work), Neon (database), Cloudflare R2 (private files and backups), Google Gmail (email, and uploads you send by email) and Meta (WhatsApp, only if you link it).

Gemini (optional)

If you turn on Gemini with your own Google key, your question and the matching text from your course files are sent to Google. On Google's free tier, Google may use that content to improve its products and people at Google may read it. Without Gemini, answers are made by our own service and nothing is sent to Google.

Your choices

• Download all your data, or delete your account, at any time in Settings. Deleting removes everything at once; encrypted backups are kept for up to 30 days and then deleted.
• Unlink WhatsApp, turn reminders off, or sign out of every device.
• You can also remove the app key in the LMS (Preferences → Security keys); the service then stops reading your account.