Privacy Policy
Last updated: August 19, 2026
Roll & Do is a small, independently run task and hobby app. This policy describes exactly what it stores, where that data lives, and how to get it back or delete it. It covers the Roll & Do website and app only.
What is collected
Account details from Google. When you sign in with Google, Roll & Do receives your name, email address, and profile picture URL. That is the entire scope requested at sign-in — no access to Gmail, Drive, Calendar, Contacts, or anything else in your Google account.
What you create in the app. Tasks, their durations, tags, deadlines, blocked reasons, and completion times; hobbies, their journal notes, and any photos you upload; and your cookie-jar count.
Standard server logs. The hosting provider records routine request information such as IP address and browser type, used to keep the service running and secure.
How Roll & Do accesses and uses Google user data
Google account data. Roll & Do uses the name, email address, and profile picture URL received from Google only to authenticate you, create and identify your Roll & Do account, show your identity inside the app, and respond to account or support requests. It is not used for advertising, analytics, credit decisions, or training artificial-intelligence or machine-learning models.
Google Calendar, only if you turn it on. Calendar sync is off by default. If you enable it, Roll & Do sends you to Google for a separate, affirmative permission request. The app requests the calendar.events.owned scope because Google does not offer a write-only event scope. Roll & Do uses this permission only to insert one past event on your primary calendar when you complete a task. The event contains the task title, category, optional Work/Life tag and project, completion time, and recorded time spent. Roll & Do does not list, read, edit, or delete existing Calendar events, and it does not use Calendar data for any other purpose.
Roll & Do stores the Google account identifier and profile details needed for your account, along with Google OAuth access and refresh tokens needed to keep an optional Calendar connection working. The tokens are used only by the Roll & Do server to request a short-lived access token and create the event described above. They are never displayed to other users.
How Google user data is shared, transferred, or disclosed
Roll & Do does not sell Google user data, share it with advertisers or data brokers, or transfer it for advertising, analytics, or AI/ML model training. Google user data is disclosed only in these limited circumstances:
- Service providers. Vercel processes requests to host and run the application, and Neon stores account details and OAuth tokens in Roll & Do's database. They process this data only as necessary to provide infrastructure to Roll & Do.
- At your direction. If you enable Calendar sync, Roll & Do sends the finished-task event to Google Calendar so it can appear in the Google account you selected.
- Legal and safety reasons. Data may be disclosed if required by law or if necessary to protect users, the service, or the public from fraud, abuse, or a security threat.
Roll & Do's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
What is not collected
- No analytics or tracking scripts of any kind
- No advertising, and no advertising identifiers
- No third-party trackers, pixels, or social plugins
- No sale or sharing of personal information with data brokers
Cookies
Roll & Do sets a session cookie to keep you signed in, plus a short-lived cookie used to protect sign-in against cross-site request forgery. There are no advertising or analytics cookies, so there is nothing to opt out of.
Where the data is stored
Your account and content are stored in a PostgreSQL database hosted by Neon. Uploaded journal photos are stored in Vercel Blob, in a private store, and are served through short-lived signed links rather than public URLs. The application itself is hosted by Vercel. These providers process data on Roll & Do's behalf and store it on servers in the United States.
Google processes your sign-in, and — if you have turned calendar sync on — receives the finished tasks it writes to your calendar. Google's own handling of that is covered by the Google Privacy Policy.
How long it is kept
Your content is kept for as long as your account exists. Completed tasks move into a weekly history and stay there until you delete them. Google account details and OAuth tokens are also kept only while they are needed to maintain your account or optional Calendar connection. Disconnecting Calendar revokes the grant with Google and deletes the stored Calendar access and refresh tokens. If you ask for your account to be deleted, the account and everything attached to it — including Google account details and OAuth tokens, tasks, hobbies, journal notes, and photos — are removed. Events already written to Google Calendar remain there until you delete them in Google Calendar.
Your choices
- Export. Use Export backup inside the app to download your tasks and hobbies as a JSON file at any time.
- Correct or delete individual items. Tasks, hobbies, journal notes, and photos can all be edited or deleted in the app.
- Delete everything. Email christine@colorworks.co from your account's email address and your account will be deleted.
- Revoke access. You can disconnect Roll & Do from your Google account at any time in your Google account permissions.
Depending on where you live, you may have additional rights over your personal data, such as requesting a copy or asking for it to be corrected or erased. Email the address below and those requests will be honoured.
Security
Traffic is encrypted in transit. Every request for your data is scoped to your signed-in account, and journal photos are stored privately rather than at public addresses. No service can promise perfect security, but Roll & Do collects as little as possible so there is little to lose.
Children
Roll & Do is not directed at children under 13, and accounts are not knowingly created for them.
Changes
If this policy changes in a way that affects what is collected or how it is used, the date at the top will be updated and the change will be noted here.
Contact
Questions, requests, or deletions: christine@colorworks.co.
See also the Terms of Service.