Privacy Policy

Effective from: October 27, 2026 · DoGooder by Bundee

1. Who we are

DoGooder ("Small deeds. Big ripples.") is an app that suggests one small good deed a day. It is published by Bundee.

The controller responsible for your personal data is Natthanan Ruksasaeng, established in Germany.
Pfarrgasse 3
67727 Lohnsfeld
Germany

Email: [email protected]

This policy covers the DoGooder app for Android (and later iOS) and this website.

2. Summary

• You can use DoGooder as a guest. Guest data stays on your device.
• If you create an account, we store your account details, your deeds and what you post in the community.
• Posts, comments, your name and your public profile can be seen by other people.
• The app shows ads from Google AdMob. We do not run any analytics tools of our own.
• We do not collect your location, contacts, microphone, calendar or push tokens.
• You can delete your account and your data at any time, in the app or on the Delete account page.

3. What data we collect and why

3.1 Guest mode

Without an account, your deeds, today's plan and streaks are stored only on your device. They are not sent to us. If you later sign in, they are synced to your account.

3.2 Account data

• Name. Required to create an account. You can change it later. It is shown on your profile, posts, comments, in search, on the leaderboard and on the supporter wall.
• Email address. Required to create an account and sign in. It is not shown to other users.
• Password. Only for email sign-up. We store only a secure hash (bcrypt), never the password itself.
• Sign-in details. Which sign-in method you use (email, Google or Apple) and a sign-in session. If you sign in with Google, we receive your name, email and the link to your Google profile picture. Google sign-in goes directly to Google (Google OAuth). If you sign in with Apple, we receive an Apple user ID and, if Apple shares it, your email and name. If Apple hides your email, we store a private placeholder address instead.
• User ID. An ID we create for your account.

Purpose: to create and run your account and to sign you in.

3.3 Profile and community

• Profile (optional): profile photo, a short bio (up to 200 characters), a country you choose yourself (not your location) and your preferred language.
• Posts and comments (text, and photos you choose to upload).
• Likes and follows.
• Reports and blocks: if you report a post or comment, we store the reason, an optional note and the result of our review. If you block someone, we store that block.

Purpose: to run the community feature and to keep it safe (moderation, hiding reported content, blocking).

Visible to others: your name, profile photo, public profile (bio, country, deed statistics), posts, comments and like counts can be seen by other users and, for posts, also by guests. If you set your profile to private, your bio is hidden but your name is still shown. Uploaded photos are stored at an address that cannot be guessed, but anyone who has that address can open the photo.

3.4 Your deeds

• Deeds you log (type, date, optional deed ID), today's plan, streaks, badges and leaderboard points.

Purpose: the core habit tracker. The date is your device's calendar date, not a location.

3.5 AI features

DoGooder uses AI from Anthropic (Claude) for two optional features. Requests go directly to Anthropic.

• AI deed ideas. We send the number of ideas wanted, an optional category and up to 40 short texts of deeds you already have. We do not send your name or email. For signed-in users, your user ID is used to count a daily limit (stored for up to 3 days).
• Translation of posts and comments. Only when you tap translate, the text of that post or comment is sent directly to Anthropic. The translation is saved with the post.

3.6 Voluntary tip

In the web version you can leave a voluntary tip. The Android app does not offer this payment.

Stripe (Stripe Payments Europe, Ltd., Ireland, and/or Stripe, Inc., USA) processes the payment. Stripe receives the amount, the currency and the data needed to take the payment. You enter your card on Stripe's page. We do not store card data. We store a payment record with the amount, currency, status, date and a Stripe reference.

The legal basis is GDPR Art. 6(1)(b) for carrying out the payment and GDPR Art. 6(1)(c) for the statutory retention. Transfers rely on the EU-US Data Privacy Framework where Stripe is certified and/or the EU Standard Contractual Clauses.

We keep payment records for up to 10 years (§ 147 of the German Fiscal Code, AO, and § 257 of the German Commercial Code, HGB). If you delete your account, these records stay until that period ends.

3.7 Invites

Each account has an invite code. If you join through someone's invite, we store who invited you. The invite page shows the inviter's name to anyone who opens the link.

3.8 Ads

The Android and iOS apps show banner ads from Google AdMob. The website and the web version show no ads.

• The app requests non-personalised ads only and limits ads to content rated "PG".
• The app itself does not read your advertising ID. However, the Google Mobile Ads SDK, which is part of the app, collects and shares with Google data such as device identifiers (including the advertising ID), approximate location derived from your IP address, app interactions and diagnostics, for advertising, fraud prevention and measurement. Google acts under its own privacy policy: https://policies.google.com/privacy
• Where required by law, we ask for your consent through Google's consent tool (User Messaging Platform, UMP) before ads are loaded. The dialog is active in the native app. You can change your choice under Profile → gear “Settings” → group “Support” → “Privacy settings / consent”. That entry is shown where consent rules require it (for example in the EEA and the UK).

3.9 Security and abuse protection

After failed password logins we store your email, the number of failures and a lock time (5 failures lead to a 15-minute lock). These rows expire automatically.

3.10 What we do not collect

We do not collect your precise or approximate location (no GPS), contacts, SMS, calendar, microphone, files other than photos you pick, browsing history, crash reports or a push token. Reminders are scheduled on your device and are not sent to us. We do not use our own analytics or tracking tools (no Firebase Analytics, Sentry, Amplitude or similar). The app uses the system photo picker and does not open your camera.

3.11 This website

This website is a static site hosted on Cloudflare Pages. We do not store server logs of the website ourselves. When you visit it, Cloudflare processes connection data (IP address, time, requested URL and user agent) briefly to deliver the pages and keep them secure, under its own policies. The website does not run its own tracking and does not load fonts from Google. We do not use Cloudflare Web Analytics. We do not set bot-challenge cookies on the other pages. Only the contact form uses Cloudflare Turnstile to block bots; Cloudflare may set a technically necessary cookie there. If you use the deletion form, we receive the email address and optional note you enter.

3.12 Contact form

You can write to us with the contact form.

• Name, email address and message. We use them to handle your request.
• IP address for Turnstile. On the contact page, Cloudflare Turnstile checks that a person sent the request. Your IP address is sent to Cloudflare for that check.

The purpose is handling your request. The legal basis is GDPR Art. 6(1)(b) when the request is pre-contractual or about an existing contact, otherwise GDPR Art. 6(1)(f) (legitimate interest in answering requests).

Turnstile (Cloudflare) protects the form against bots. The legal basis is our legitimate interest (GDPR Art. 6(1)(f)). Transfers rely on the EU-US Data Privacy Framework where Cloudflare is certified and/or the EU Standard Contractual Clauses.

Resend (Resend, Inc., USA) sends the message. Resend stores email content, metadata and logs in the USA for 30 days. Backups last 7 days. The AWS region eu-west-1 (Ireland) controls only where the message is sent from, not where it is stored. Transfers rely on the EU-US Data Privacy Framework where Resend is certified and/or the EU Standard Contractual Clauses.

The message arrives in the owner's mailbox. Forwarding uses Cloudflare Email Routing to Gmail (Google).

We delete the message once the request is done and no retention duty applies, after 12 months at the latest.

4. Legal bases

The legal basis is the GDPR. Where the Thai PDPA applies to users in Thailand, the corresponding basis is named as well.

• Contract / providing the service (GDPR Art. 6(1)(b); additionally PDPA Sec. 24(3)): account, sync, community, deeds and, in the web version, the voluntary tip.
• Legitimate interests (GDPR Art. 6(1)(f); additionally PDPA Sec. 24(5)): security, preventing abuse, moderation.
• Consent (GDPR Art. 6(1)(a); additionally PDPA Sec. 19): ads-related storage on your device where the law requires consent, and optional features where consent is required. You can withdraw consent at any time.
• Legal obligation (GDPR Art. 6(1)(c); additionally PDPA Sec. 24(6)): keeping tip payment records for up to 10 years (§ 147 AO, § 257 HGB).

If you do not give us the account data marked as required, you cannot create an account, but you can still use guest mode.

5. Who receives your data

We only share data with service providers that we need to run DoGooder:

Other DoGooder users see the content listed as visible in section 3.3. We do not sell your personal data. We may disclose data if the law requires it.

6. International transfers

We are established in Germany. The backend servers are in the EU (Render, Frankfurt). Some providers are in the USA or other countries. When data leaves the EU/EEA, transfers to Anthropic, Google, Stripe, Cloudflare (including Cloudflare R2 and Turnstile), Resend, MongoDB Atlas and Render rely on the EU-US Data Privacy Framework where the provider is certified and/or the EU Standard Contractual Clauses in the provider's data processing agreement, and on other permitted grounds under GDPR Chapter V. Where the Thai PDPA applies to users in Thailand, transfers also rely on PDPA Sections 28–29.

7. How long we keep data

• Account data, profile, posts, comments, likes, follows, deeds: as long as your account exists. Deleted when you delete your account.
• Tip payment records: amount, currency, status, date and the Stripe reference. No card data. Kept for up to 10 years (§ 147 AO, § 257 HGB). If you delete your account, these records stay until that period ends.
• Login-failure records: removed automatically after the lock period, and on account deletion.
• AI daily-limit counters: up to 3 days.
• Backups: database backups are overwritten after 14 days.
• Deletion requests by email or web form: we keep deletion logs and proof for up to 12 months.
• Contact requests: deleted once the request is done and no retention duty applies, after 12 months at the latest.
• Resend sending data: email content, metadata and logs are stored in the USA for 30 days. Backups last 7 days.

Details are on the Delete account page.

8. Your rights

Under the GDPR you have the right to:

• get access to and a copy of your data,
• correct inaccurate data (you can edit most of it in the app),
• delete your data,
• restrict or object to processing,
• data portability,
• withdraw consent at any time, without affecting processing before the withdrawal,
• complain to a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate (LfDI RLP), Prof. Dr. Dieter Kugelmann, Hintere Bleiche 34, 55116 Mainz, Germany, https://www.datenschutz.rlp.de/.

Where the Thai PDPA applies to users in Thailand, you have the corresponding rights under that law as well, including a complaint to the Personal Data Protection Committee (PDPC), https://www.pdpc.or.th.

Write to [email protected]. We answer within one month (GDPR). Where the Thai PDPA applies to users in Thailand, within 30 days. We may need to confirm that the account is yours.

9. Children and teenagers

Use is allowed only from the age of 16. We do not carry out age verification. If we learn that a person under 16 has an account, we delete it. Please tell us at [email protected].

10. Security

The production API is served only over HTTPS (TLS). Data between the app and our server is sent encrypted. Passwords are stored only as hashes. No system is completely secure, but we work to protect your data and will inform authorities and affected users about a data breach where the law requires it.

11. Changes

We may update this policy when the app changes. We will show the date of the latest version at the top and tell you in the app about important changes.

12. Contact

Natthanan Ruksasaeng
Pfarrgasse 3
67727 Lohnsfeld
Germany [email protected]