Privacy

Effective 15 October 2026 · Last updated 19 October 2026

DoneMark (“we”, “our”, “us”) runs donemark.dev and the app at app.donemark.dev. We respect your privacy and protect the personal and technical data you share with us.

This notice explains what we collect, how we use it, who else handles it, how we protect it and your rights, when you use our website, our app, our GitHub app and the services that go with them (together, the “Service”).

1. Information we collect

A. Your account

• Your GitHub identity. When you sign in with GitHub, we keep your GitHub user number, login, name, email address and the address of your profile picture. Your GitHub token is used to learn who you are, then discarded.
• Billing. When paid plans open, payment is taken by Paddle, which resells DoneMark as the merchant of record. Paddle handles your card: we never see or keep card numbers or security codes.

B. Your projects and what your CI publishes

• What you and your team write in DoneMark: organisations, projects, asks and their “done when” lines, sign-offs with their reasons, invitations and the activity record.
• Pull request details: pull request numbers and titles, branch names, commit identifiers, the names of the files a change touched, and the state of its checks.
• What your CI publishes about each change: test results, coverage and mutation reports, the screenshots and recordings your CI takes, and the cost figures your agent reports. This is the evidence DoneMark shows you before you sign off.
• We do not copy your repository. The GitHub app DoneMark asks for (named DoneMark witness on GitHub) can read, not write, your code; DoneMark reads what your CI publishes. We never use your code to train AI models.

C. Your AI key

• Your AI key stays in your GitHub secrets. When you give DoneMark a key for your own AI provider, such as Anthropic or OpenAI, your browser seals it before it leaves the page, and GitHub keeps it in your repository’s secrets. DoneMark has nothing that can open it and never stores it.
• It is used only by your own agents. The agents that run in your CI use it for the work you ask for. We never add anything to what your provider charges you, and we do not read what your agents send to it.

D. Collected automatically

• In the app: our servers log each request, with your IP address, your browser and the page asked for, to keep the Service running and secure. One session cookie keeps you signed in.
• On donemark.dev: This site sets no cookies, keeps nothing in your browser and loads nothing from third parties.
• Visits are counted without cookies. The server that sends you this site keeps a log of each visit with your address cut short, for 90 days. From it we count visitors, pages read, the site that linked here and the country. Only those totals reach DoneMark.

2. How we use your information

We use it to:

• Provide, run, maintain and improve DoneMark.
• Confirm who you are through GitHub, and let your organisation decide who may do what.
• Show the evidence for each change, and keep the sign-offs and the record.
• Draft “done when” lines and mockups for you, when drafting is on.
• Manage your plan and your billing.
• Send the messages the Service needs: account notices, security alerts, service updates and the notices you asked for.
• Answer your questions and your bug reports.
• Meet our legal obligations.

We do not:

• Sell, rent or trade your personal data or your repository data.
• Use your code, your pull requests, your CI output or what you write in DoneMark to train AI models.
• Use advertising trackers.

3. Who else handles your data

To deliver the Service, we share only what each one needs with these providers, who work on our behalf:

• GitHub, for sign-in and for reading your pull requests and CI results.
• OVHcloud, which hosts our servers and our backups in France.
• Paddle, once paid plans open, which takes payment as the merchant of record.
• Our email delivery provider, which sends the emails you receive from DoneMark.
• X, only if you came from one of our ads on X. When you sign up, we send X the click number X added to the ad’s link, so X can count that the click led to a sign-up. Nothing else: no email, no name, no cookie, and no script from X on our pages.
• An AI provider, only when drafting is on. When DoneMark drafts “done when” lines or a mockup for you, what you wrote in your ask is sent to an AI provider chosen by us or by your organisation’s administrator: Anthropic, OpenAI, Mistral, Moonshot, or OpenRouter, which passes it to the model chosen. An administrator can turn drafting off.
• Your own AI provider, when your agents use your key. Those requests go from your CI to that provider, under its own privacy terms.

4. How we protect your data

• All traffic to and from DoneMark is encrypted with TLS (HTTPS).
• Your AI key is sealed in your browser before it leaves the page, and only GitHub can open it.
• Only the people who run DoneMark can reach our databases, and only when they need to.

5. How long we keep it

• Your account: for as long as your account is active.
• Evidence and sign-offs: kept as your team’s record until you remove the project or close your organisation. A signed record is never edited, by design.
• Deleting your account: you can ask us to delete your account at any time. Within 30 days, your personal details and your organisation’s settings are deleted or made anonymous.

6. Your rights

Depending on where you live, including under the GDPR in Europe or the CCPA in California, you can:

• See and export a copy of the personal data we hold about you.
• Correct details that are wrong.
• Delete your account and the personal data that goes with it.
• Object to a use of your data.
• Remove DoneMark’s access to GitHub at any time, under Applications in your GitHub settings.

To use any of these rights, write to contact@donemark.dev. We answer within 30 days. If you are in Europe, you can also complain to your data protection authority, such as the CNIL in France.

7. Changes to this notice

We may update this notice when the product or the law changes. The date at the top of this page always shows the latest version, and for an important change we may also email you.

8. Contact us

Questions, concerns or requests about this notice or your data: contact@donemark.dev · donemark.dev