Website privacy
Finally done, MB operates notes.finallydone.app. This public app stores your notes and attachments in this browser's IndexedDB Device Copy for offline use. Optional analytics does not upload that content. Private synchronization is not enabled on this public host.
Optional website analytics
Updated 8 September 2026. If you allow analytics, Finally done, MB uses Google Analytics to understand website visits, traffic sources, active engagement and explicitly labelled interactions. Google processes browser/device information, approximate location and cookie identifiers. Analytics starts only after you allow it. Rejecting analytics does not affect the site.
With analytics permission, we also measure starting a draft and successfully creating or saving a note. We also count failed saves and save duration groups: under 100 ms, 100-500 ms, 500-1500 ms, or 1500 ms and above. These diagnostics contain no error text or note content and do not count as successful use. We record the first successful use observed in this consent period and a coarse interval when you successfully use the app on a later day. A browser-local record stores only the last successful UTC day and the consent expiry, for at most 180 days; withdrawal removes it. It contains no note or visitor identifier. Explicitly marked testing visits are labelled separately.
We do not send note titles, note text, searches, health records, email content or form entries to Analytics. Advertising features and automatic enhanced measurement are disabled. This describes the public website, not new tracking in the native app.
Use Analytics settings on this site to withdraw permission. This stops subsequent measurement and removes this site's Analytics cookies. Withdrawal does not undo earlier processing. Your choice is stored in this browser for 180 days. Host-only cookies _ga and _ga_9C7HJ5WRDK last up to 180 days without renewal. User and event data retention is two months, without reset on activity; aggregate reports may remain longer.
Google may process data outside the EEA. See Google's privacy notice for its processing and safeguards. Cloudflare processes technical requests to deliver and protect the site and provide aggregate traffic and crawler reports. Contact hello@finallydone.ai about data rights, including access, correction, deletion, restriction, portability and withdrawal where applicable. You may complain to the Lithuanian State Data Protection Inspectorate or your local authority.
Website traffic intelligence
We use technical request information to understand public website reach, crawler activity and reliability, and to guide improvements to our websites and services. Cloudflare supplies approximate country, region, city, timezone, network number (ASN) and network owner where available. We retain these derived fields together with the public page or asset requested, response status, browser/device families, self-declared crawler category, referring website domain and technical response measurements. Location is approximate and network ownership does not identify your employer. Unknown values remain unknown.
This server-side processing uses information already accompanying a website request. It does not set analytics cookies, read your notes or create an individual visitor profile. Our intelligence store does not retain raw IP addresses, full user-agent strings, cookies, URL query strings, note content, account identifiers or private synchronization requests. Google Analytics remains separate and starts only after your consent.
We rely on our legitimate interests in understanding and improving our public services, monitoring crawler access and maintaining website reliability. We limit the information, access and retention, and do not use it for advertising or decisions about individuals. You can contact hello@finallydone.ai to object to this processing or exercise applicable data rights.
Our access-restricted Cloudflare D1 archive retains detailed derived records for 90 days. Daily grouped statistics are retained for 24 full calendar months plus the current month, and monthly grouped statistics for 60 full calendar months plus the current month to compare product, audience and channel changes over time. Private recovery copies rotate within eight days, and restored records are checked against these limits before use. Access is restricted to operating and analysing these websites. Cloudflare may process requests internationally; our primary intelligence archive is hosted by Cloudflare, with versioned recovery copies on our private infrastructure. Expiry runs in bounded batches and can be delayed by service or quota interruptions. No archive information is published as a public visitor dashboard.
Analytics history
We also preserve consent-based Google Analytics reports in this private archive: daily reports for 24 full calendar months plus the current month, and monthly acquisition, interaction and successful-use aggregates for 60 full calendar months plus the current month. Explicitly marked testing visits are labelled separately. Historical reports without this label are treated as unclassified. These exports contain aggregate report dimensions and counts, not raw IP addresses, visitor identifiers or note content.
Before discarding the request IP address, we may compare it with published operator network ranges to retain a network or crawler classification, the matching source and its freshness. We keep observed request categories and claimed identities separate from verified evidence; network ownership alone does not establish residential access, a person or an employer. We also record requested and returned content formats and broad public route categories to distinguish successful machine-readable content from missing-page responses.
Automated clients may voluntarily send only the fixed purpose, resource and tool categories described at /agent-intelligence.json. We retain these as unverified declarations alongside the technical request statistics above, under the same access and retention limits. Participation does not affect access. Please do not send prompts, queries, personal details, identifiers, credentials or private task descriptions. We do not create a unique guest identifier or infer a person from these declarations.