Your information on doooo

Who we are

doooo. is run by Stupid Human Ltd, a UK company. We decide how the information on doooo is used, which makes us its “controller” under UK data protection law. For anything about your information, email hello@doooo.me.

What we keep about hosts

• Your email address and password if you sign up with them (passwords are stored scrambled, so we can't read them), or the name and email address Google, Apple or Spotify share with us if you sign in with them.
• Your invites: the words, the date, time and place, your photo, any time slots, and whether you've set a password (we keep only a scrambled form of the password itself).
• The descriptions you type for redesigns and the designs that come back.
• A record of each payment: the amount, the currency and Stripe's reference for it. Your card details go straight to Stripe and we never see them.

What we keep about guests

• The name you type and the songs you add.
• Your voice note, if you choose to record a shout-out.

What we keep about everyone

To enforce the limits in our fair use policy and slow down password guessing, we keep a scrambled code made from your internet (IP) address when you redesign an invite or enter an invite's password. We keep the code, never the address itself. Our hosting providers also keep short-lived technical logs to keep the service secure and working.

How we use it, and why we're allowed to

• To run doooo for you: making and publishing your invite, showing it to your guests, building the playlist and playing shout-outs. We need your information to provide what you've asked for.
• To keep doooo fair and safe: usage limits, stopping abuse and fixing problems. These are our legitimate interests, and we keep what we use for them to a minimum.
• To keep our accounts: payment records, which the law requires us to keep.

Who can see it

• The host sees their guests' names, songs and voice notes.
• Anyone with the invite link sees the invite, its photo, and guests' names and songs. If the host has set a password, they need that too.
• Anyone with the host's DJ link sees the event details, the running order and the shout-outs.

Companies that help us run doooo

We share information with these companies only to provide doooo, and they may only use it for that:

• Supabase stores our database, photos and voice notes, and runs sign-in. Your data is kept in Ireland.
• Vercel hosts the website.
• Stripe takes payments.
• Anthropic runs the AI behind redesigns. When you redesign, your description and invite photo are sent to it. They aren't used to train AI models.
• Spotify and Apple are used to find and play songs. We send them song titles and artists, not who added them. When you play a song or preview, your browser loads it from them, and their own privacy policies apply.
• Google, Apple and Spotify handle sign-in, if you choose to sign in with them.

Some of these companies are in the United States or handle data there. Where that happens, your information is protected by the UK's approved safeguards, such as the UK–US data bridge or the UK's standard data transfer contracts. We don't sell your information or use it for advertising.

How long we keep it

• Invites, photos, playlists and voice notes stay until the host deletes the invite or their account.
• Deleting your account deletes everything in it straight away, including your guests' songs and voice notes.
• Payment records are kept for six years after the payment, as UK tax law requires, without the invite they paid for.

Cookies and your browser

We only use the cookies doooo needs to work: one to keep you signed in, and one that remembers you've entered an invite's password (for 90 days). We also save a few conveniences in your browser, such as the name you last used on a playlist. There are no advertising or tracking cookies.

Spotify and Apple Music may set their own cookies when you use their players.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, or to stop or limit how we use it. Email hello@doooo.me and we'll reply within a month. Hosts can also delete invites, songs and their whole account themselves from their dashboard. Guests can ask the host, or us, to remove their songs or voice notes.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put things right first.

Children

Hosts must be 18 or over. Guests can be any age, but children under 13 should only add songs or voice notes with a parent's permission.

Changes to this policy

If we change how we use your information, we'll update this page and its date, and tell hosts about anything significant before it applies.