Privacy Policy

What we collect, why, and the control you have over your information.

Last updated: October 29, 2026

The short version: we collect only what we need to run IterDone, we don't sell your data, and you can ask us to export or delete it whenever you want. The full policy is below.

1. Who we are

IterDone ("we", "us", or "our"), part of Pangloss Technologies, provides work and project management software. This Privacy Policy explains how we handle personal information when you use our website and Service. For privacy questions, contact privacy@iterdone.com.

2. Information we collect

Information you provide

Account information — your name, email address, and either a password (stored hashed) or the account identifier Google provides when you sign in with Google.
Workspace content — the tasks, lists, comments, files, goals, docs, and other content you and your team create inside your workspace.
Communications — messages you send us for support or sales.

Information we collect automatically

Usage data — pages viewed and features used on public marketing pages, to understand and improve the product.
Device and log data — IP address, browser type, and timestamps, for security and diagnostics.
Cookies — see our Cookie Policy for the full list of what we set and why.

3. How we use information

To provide, maintain, and improve the Service;
To authenticate you and keep your account secure;
To respond to your requests and provide support;
To send important service notices (and, only with your consent, product updates);
To detect, prevent, and address fraud, abuse, and security issues;
To comply with legal obligations.

We do not sell your personal information, and we do not use your workspace content to train third-party AI models.

4. How we share information

We do not sell your personal information. We share it only:

With service providers who help us run the Service (such as hosting, email delivery, and analytics on marketing pages), under confidentiality obligations and only as needed;
When required by law, or to protect the rights, safety, and security of our users and the public;
In connection with a merger, acquisition, or sale of assets, with notice to you.

5. Third-party services

Google Sign-In — if you choose to sign in with Google, Google shares your name and email with us to create or match your account.
Resend — our transactional email provider, used solely to deliver notification emails (for example, support replies).
Google Tag Manager / Analytics and Cloudflare Web Analytics — used on our public marketing pages to understand aggregate traffic. Neither runs inside your authenticated workspace.

6. AI assistants and connectors (MCP)

IterDone offers a Model Context Protocol (MCP) server that lets an AI assistant you choose, such as Claude, act on your workspace. This only happens when you or a workspace admin connect an assistant, either by signing in and approving a consent screen (OAuth) or by creating an API key.

What the assistant can access — whatever the connecting member could see in the workspace, limited by the read or write scope granted and, for API keys, by any space restriction. Tool calls (for example reading or creating tasks) run under the connecting member's identity and permissions.
What we store — the OAuth client registration (client name and redirect URL), hashed access and refresh tokens, and the connection's scope. We do not store the contents of your conversations with the assistant.
What the assistant provider receives — data returned by tool calls is sent to the AI provider you connected and is handled under that provider's own terms and privacy policy, not ours.
Your control — each connection appears as an entry under Admin > API Keys, where it can be revoked at any time; access stops immediately.

7. Cookies

We use cookies that are necessary for the Service to function — for example, to keep you signed in — and, only on public marketing pages, analytics tooling to understand how the site is used. See the Cookie Policy for specifics. You can control cookies through your browser settings, though disabling essential cookies may break parts of the Service.

8. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you close your account, we delete or anonymize your personal information within a reasonable period, except where we must retain it to meet legal obligations or resolve disputes.

Payment and invoice records are retained as required by financial and tax law (including records held by our payment processor, Stripe) and are out of scope for account-erasure requests. We erase the personal data we control (account profile, app content) on a valid request; billing invoices stay.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Email privacy@iterdone.com and we will help.

10. Security

We protect your information with encryption in transit, hashed passwords, access controls, and tenant isolation so each company's data is separated. No system is perfectly secure, but we take protecting your data seriously. Learn more on our security page.

11. International users

We may process and store information in countries other than your own. Where we transfer information across borders, we take steps to ensure it remains protected consistent with this policy.

12. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "last updated" date above and, for material changes, provide additional notice where appropriate.

14. Contact

Questions about your privacy? Email privacy@iterdone.com or visit our contact page.