Doughnutted is built to be lightweight and minimal-data. This notice explains what we collect, why, and what rights you have over it.
Who we are
Doughnutted is an independently run project. There's no company behind it and no separate data processing agreement with any employer — if you sign up, you're dealing directly with Doughnutted. Some teams have a designated company owner, who can delete all of that team's data — see How long we keep data below for what that means. You can reach us at [email protected] for anything related to your data.
What we store
- Work email addresses, used for passwordless sign-in (magic links) and optional notifications.
- League table names, shown as first name + last initial only (e.g. "Alex J").
- Doughnutting and delivery events, including timestamps and basic metadata.
- Evidence photos uploaded when someone delivers the dough, used as proof of delivery. These are photos of the doughnut box itself, not of people.
- Office IP ranges, where a user chooses to configure these so the homepage only works from their office network.
What we don't store
- Personal profiles, avatars, or photos of people. Evidence photos are of doughnut boxes, not individuals.
- Passwords — sign-in is passwordless, via magic link.
- Any special category data (health, financial, biometric, etc.).
- Anything about your employer or workplace beyond what you choose to enter yourself.
Why we process this data
- Email— to sign you in via magic link, and to send notifications if you've opted in.
- League table name — to show delivery standings within your team, without exposing full identities.
- Delivery events and evidence photos — to run the core game mechanic: proving the dough got delivered.
- Office IP ranges— only if you've chosen to restrict access to your office network.
Notifications
Email notifications are optional and can be turned on or off at any time in your Profile settings.
Who we share data with
We don't sell data or share it for marketing. We use a small number of service providers to run Doughnutted:
- Hosting / infrastructure: Render
- Email delivery (for magic links and notifications): Resend
- Evidence photo storage: Cloudflare
These providers only process data on our instructions and don't use it for their own purposes.
Where your data is hosted
Doughnutted is available globally. Our hosting, email, and storage providers (Render, Resend, and Cloudflare) are established services with their own security and compliance measures in place.
How long we keep data
- Your account (email, league name) is kept for as long as you have an active account.
- Evidence photos are automatically deleted after 90 days.
- Delivery event records (timestamps and metadata, without the photo) are kept for as long as your account is active, so league history stays intact.
- You can delete your own data at any time from your Profile page. This is immediate and irreversible.
- If your team has a company owner, they can delete all of that company's data from Doughnutted. This is also immediate and irreversible, and applies to everyone in that team, not just the owner.
Security
We keep the data footprint small by design: no passwords, no avatars, no profile photos, and first-initial-only league names. We apply reasonable technical measures (encryption in transit, access controls) to protect what we do store.
Your rights
Wherever you're based, you can ask us at any time to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Get a copy of your data.
You can also delete your own data yourself, immediately, from your Profile page — no need to email us for that one. For anything else, just email us — see Contact below.
Cookies
Doughnutted uses only essential cookies needed for sign-in and session management. We don't use tracking or advertising cookies.
Changes to this notice
We'll update this notice if what we collect or how we use it changes, and update the date at the top.
Contact
If you need help, want your data deleted, or spot an issue, email [email protected].
Back to Doughnutted