Privacy
Updated 16 September 2026.
Finally done, MB operates this website and is responsible for its personal-data processing. Contact hello@finallydone.ai. Apps have separate privacy notices.
Visits and enquiries
Cloudflare processes IP addresses, requested URLs and browser information to deliver and protect the website and report traffic, including identified AI crawler requests.
If you email us, we use your address, message and attachments to respond. Cloudflare Email Routing forwards incoming mail to Gmail; Brevo handles outgoing mail.
This processing serves our legitimate interests in running a secure website and responding to enquiries. Steps you request towards a contract may instead be processed on that basis.
On-site feedback and private updates
When the on-site feedback service is available, you can send an idea or issue without an account or contact details. Your message and any image, marks, or voice note you choose to include are sent only when you select Send. Capture and image review happen locally first. Review attachments before sending and avoid including credentials or unrelated sensitive information.
Basic technical details are a separate option, off by default. They include browser language, viewport size, and app build, not page addresses, form contents, or browsing history. You may optionally provide an email address or a messenger platform and handle. These contact details are private report data, not public updates or analytics data. We use reports to review and respond to feedback and improve the service.
The feedback service stores reports in Cloudflare D1 and attachments in private Cloudflare R2. The current configuration schedules attachments to expire after 30 days and reports, including optional contact details, after 90 days. Deletion runs periodically and can be delayed by service interruptions. Contact us about deletion or other applicable data rights.
A private receipt is stored in this browser's localStorage so My feedback can retrieve deliberately published updates. The receipt is an access capability, not an account. Other people or scripts with access to this browser and site storage may be able to use it. Receipts remain until the site's browser data is cleared; clearing them does not delete the server report. An unsent draft stays in memory for the current visit.
Email update delivery is currently off. If enabled, receiving updates requires a separate request and confirmation of the email address. Email preferences provides withdrawal and mailbox-based access recovery where available; recovery does not restore report-deletion authority. A response or update is not guaranteed.
Optional browser error and performance monitoring is currently unconfigured and off. When configured, it requires its own Monitoring preferences choice, separate from report diagnostics and Google Analytics. The shared controls describe the limited measurements before consent and allow withdrawal. They exclude report contents, images, audio, contacts, receipt secrets, and full page addresses. Its versioned choice is stored in this site's localStorage; unavailable or invalid storage does not enable monitoring automatically.
Optional analytics
If you allow analytics, we use Google Analytics to understand traffic sources, pages visited, active engagement time and interactions with service, product and contact links. Google processes browser and device information, approximate location and cookie identifiers. We do not enable advertising features or send email content or form entries to Analytics.
Analytics starts only with your consent. Rejecting it does not affect the website. Use Analytics settings at the bottom of any page to withdraw consent; this stops further collection and removes this site's Analytics cookies. Withdrawal does not undo earlier processing.
Your choice is stored in this browser for 180 days. Analytics cookies (_ga and _ga_NTD4YETYMQ) last up to 180 days. User and event data retention is set to two months; aggregated reports may remain longer.
Providers and retention
Cloudflare, Google and Brevo process data to provide these services, including outside the EEA. Their notices explain their international processing and safeguards.
We retain correspondence for as long as needed to handle the enquiry and any resulting work, resolve legal claims or meet legal obligations. Technical data retention depends on the hosting service and security purpose.
Your rights
Contact us to request access, correction, deletion, restriction or portability, or to object to processing based on legitimate interests, where applicable. You can complain to the Lithuanian State Data Protection Inspectorate or your local supervisory authority.
Website traffic intelligence
We use technical request information to understand public website reach, crawler activity and reliability, and to guide improvements to our websites and services. Cloudflare supplies approximate country, region, city, timezone, network number (ASN) and network owner where available. We retain these derived fields together with the public page or asset requested, response status, browser/device families, self-declared crawler category, referring website domain and technical response measurements. Location is approximate and network ownership does not identify your employer. Unknown values remain unknown.
This server-side processing uses information already accompanying a website request. It does not set analytics cookies, read your notes or create an individual visitor profile. Our intelligence store does not retain raw IP addresses, full user-agent strings, cookies, URL query strings, note content, account identifiers or private synchronization requests. Google Analytics remains separate and starts only after your consent.
We rely on our legitimate interests in understanding and improving our public services, monitoring crawler access and maintaining website reliability. We limit the information, access and retention, and do not use it for advertising or decisions about individuals. You can contact hello@finallydone.ai to object to this processing or exercise applicable data rights.
Our access-restricted Cloudflare D1 archive retains detailed derived records for 90 days. Daily grouped statistics are retained for 24 full calendar months plus the current month, and monthly grouped statistics for 60 full calendar months plus the current month to compare product, audience and channel changes over time. Private recovery copies rotate within eight days, and restored records are checked against these limits before use. Access is restricted to operating and analysing these websites. Cloudflare may process requests internationally; our primary intelligence archive is hosted by Cloudflare, with versioned recovery copies on our private infrastructure. Expiry runs in bounded batches and can be delayed by service or quota interruptions. No archive information is published as a public visitor dashboard.
We also preserve consent-based Google Analytics reports in this private archive: daily reports for 24 full calendar months plus the current month, and monthly acquisition, interaction and successful-use aggregates for 60 full calendar months plus the current month. Explicitly marked testing visits are labelled separately. Historical reports without this label are treated as unclassified. These exports contain aggregate report dimensions and counts, not raw IP addresses, visitor identifiers or note content.
Before discarding the request IP address, we may compare it with published operator network ranges to retain a network or crawler classification, the matching source and its freshness. We keep observed request categories and claimed identities separate from verified evidence; network ownership alone does not establish residential access, a person or an employer. We also record requested and returned content formats and broad public route categories to distinguish successful machine-readable content from missing-page responses.
Automated clients may voluntarily send the fixed purpose, resource, tool and requester-type categories described at /agent-intelligence.json, and optionally a public organization domain or public HTTPS project URL they intend to disclose. We validate the format and discard unsupported values. Public project URLs may retain a simple public path, but never credentials, query parameters or fragments. These claims are not verified identities or proof of an affiliation. We retain these as unverified declarations alongside the technical request statistics above, under the same access and retention limits. Participation does not affect access. Please do not send prompts, queries, personal details, names, account identifiers, credentials, private project links or private task descriptions. We do not create a unique guest identifier or infer a person from these declarations.