Privacy policy

Last updated 14 October 2026 (v2.11)

Done & Dustd ("the app") is made by Charles Rahbani, a sole trader based in the United Kingdom ("we", "us"). We are the controller of the personal information described here. This policy explains what happens to your information when you use the app.

The short version

If you use Done & Dustd on your own, everything stays on your phone. If you share a household, your house's bins, collection days, turns and ticks are kept on a UK server with housemates' first names, so every phone in the house shows the same thing. No sign-up, no email address needed, no ads, no analytics, no tracking.

What stays on your phone

If you use the app on your own, your bins, collection days and ticks are saved only on your device. Whether or not you share a household, your reminders, points, badges, streaks, settings, council, postcode and your council's reference for your home stay on your phone only. Deleting the app deletes them.

Finding your council and bin days

If you type your postcode, the app sends just the postcode to GOV.UK's local authority service to find your council. GOV.UK handles the request under its own privacy notice.

If you choose "Fill in my bins", the app looks up your collection days for you:

• Your phone sends your postcode to BinDays (api.bindays.app), an independent service that knows how to read council websites.
• Your phone then fetches your council's list of addresses and, once you pick yours, its bin days, straight from the council's website. It sends what the council returns (the address list, your chosen address or property reference, and the bin days) to BinDays to be read.
• For a few councils (for example Cambridge and Hounslow) the phone asks the council's own service directly and no one else is involved.

BinDays is run separately from us, is responsible for how it handles what it receives, and also makes a bin app of its own. BinDays has told us (13 October 2026) that it keeps council, address and bin collection results in a cache for up to 90 days so it can answer repeat requests quickly (because automatic dates re-check every few days, that means for as long as automatic dates are on for your bins, plus up to 90 days after the last check); that its error logs can contain what a council returned; that it does not record IP addresses; that it runs on servers in France (in the EEA, covered by the UK's adequacy rules); and that it does not use the data for anything else or pass it to others. See BinDays' own privacy policy at bindays.app/privacy-policy. We don't keep your postcode, address or bin days on our server: the app saves your bins, dates, council, postcode and your council's reference number for your home on your phone only.

Keeping your dates up to date. If your bins came from "Fill in my bins", your phone uses that saved reference to check with your council again every few days when you open the app, so bank holiday and Christmas changes arrive by themselves. For most councils this goes through BinDays in the same way as above (so BinDays sees your postcode and address each time); for Cambridge and Hounslow your phone asks the council directly. To stop it, tap Stop automatic dates on the bin, or type its days in yourself. Once no bin follows your council, your phone deletes the saved reference too.

Bank holidays. About once a week your phone downloads the public UK bank holiday list from GOV.UK. Nothing about you is sent, apart from the internet address any website sees. If you'd rather not use BinDays, skip "Fill in my bins" and type your days in yourself.

Shared households (our server)

When someone sets up or joins a household, we keep:

• the household name;
• housemates' first names;
• a random ID for each phone (no name, email or phone number is needed);
• if you turn on Nudges from housemates (Settings, off by default), the push token your phone uses to receive them; turning it off deletes the token from our server;
• a short record of nudges sent, so we can stop spam;
• the household's bank holiday region and an invite code that lets new housemates join;
• the household's shared rota: each bin's name (whatever you call it), colour, type, how often and from when it's collected, collection time, whose turn it is, any skipped, moved or swapped collections, and the dates bins were put out (the last 120 days are sent);
• for each change, which phone made it (by its random ID, which other phones can't see) and when.

Why: to run the household features you or your housemate asked for (contract). The same applies to "Fill in my bins": we only send your postcode and address when you ask for it. Where someone adds your first name to their household, we rely on legitimate interests: a household rota needs names, and we keep only first names. Nudge records are kept for our legitimate interest in stopping spam. A household needs a first name for each person; notifications and "Fill in my bins" are optional.

Only phones in your household (and anyone they share the household link with) can see the names and the rota. Anything you type as a bin's name is shown to everyone in the household, so keep it to bin names. Nobody can see another phone's ID or push token.

Like any online service, our server provider briefly logs the IP address and device details of each request to keep the service secure and working (legitimate interests). These logs are kept for a short time under Supabase's own retention.

Who helps us run it

• Supabase (Supabase Pte. Ltd, based in Singapore) stores the household data on servers in London, UK, on our behalf. Its staff or sub-processors (some in the US) may sometimes reach it from outside the UK; that is covered by our data processing agreement with Supabase, which includes the UK's approved International Data Transfer Addendum to the EU standard contractual clauses.
• Expo (push service) and Apple (Apple Push Notification service) deliver nudges and "joined" alerts to phones. They receive the push token and the alert text, which includes the sender's first name and the household name. Expo also delivers app updates (see "App updates"). Expo is based in the United States, so this is a transfer outside the UK, covered by Expo's data processing terms and UK-approved safeguards (as for Supabase).
• Google (Gmail) holds support emails you send us. Google acts under its own terms and may process them in the United States.
• Apple (App Store) handles purchases.
• Cloudflare hosts our website (see "Our website").
• BinDays and your council receive your postcode and address only if you use "Fill in my bins" (see above). They act independently, not on our behalf.

We don't sell your information or share it with anyone else.

Keeping and deleting

• Leave a household (House tab) and your phone, its ID and its push token are removed from it. If you're offline, the app keeps trying each time you open it until our server confirms. Your first name stays on the household's rota until a housemate removes it, or you can ask us to remove it.
• When the last person leaves, the household is deleted, together with its shared rota. Until then the rota (bins, turns, skips and swaps) is kept for as long as the household exists. Done dates older than 120 days are removed automatically every night, and a deleted bin leaves a small marker that is removed after 90 days.
• Households unused for 12 months are deleted automatically.
• Nudge records are deleted after 30 days.
• Phone IDs not in a household are deleted after 30 days.

Sharing a household link

If you share your household, the app makes a link and QR code containing your bins, collection days and housemates' first names. You choose who gets it. For a shared household the link also contains an invite, so anyone who has it can see that information and join your household (seeing housemates' names and sending nudges) until the invite is reset with Free up a spot. Only share it with your household.

The household details travel inside the link itself; we don't store the link. If a link opens our website's join page (donedustd.co.uk/join), the details sit after the "#", which browsers keep on your phone, so they never reach our website's server.

Our website

Our website (donedustd.co.uk) is hosted by Cloudflare. It uses no cookies, no analytics and no tracking. Like any web host, Cloudflare briefly handles your IP address and browser details to deliver pages and block attacks (legitimate interests: serving pages safely). We don't receive those logs; Cloudflare keeps them under its own retention. If you email us from the site, see "Emails you send us".

App updates

Small fixes reach the app through Expo's update service. When the app checks for an update, Expo receives your IP address, the type of phone, the app version and a random install ID (not your name). We use this only to deliver the right update (legitimate interests: keeping the app fixed and secure). We don't receive this data; Expo keeps it under its own retention.

Camera

The camera is used only when you choose to scan a household QR code. Images aren't saved or sent anywhere.

Notifications

Bin reminders are scheduled on your phone, by your phone. Nudges and "joined" alerts from housemates have their own switch (Settings → Nudges from housemates), off until you turn it on. Nudges and "joined" alerts from housemates are sent through our server and Expo's push service to Apple. They contain only the alert text, such as "Sam nudged you: your recycling needs to go out tonight" or "Sam joined Flat 4!", so they include a first name and the household name.

Purchases

Subscriptions and one-off purchases are handled by Apple (App Store) or Google (Google Play). We never see your card details. The store tells the app whether a purchase is active so it can unlock features.

Emails you send us

If you contact support, we receive your email address and whatever you write. We use it only to reply and to improve the app, and delete it within 12 months. We never add you to a mailing list. (Legitimate interests: answering you.)

Security

Data travels encrypted (HTTPS). The server is locked down so each phone can read only its own household. If a breach is likely to put you at risk, we will report it to the ICO within 72 hours and tell you without delay.

Children

Done & Dustd is made for households, and households often include children and teenagers. So we've built it to be safe for them too: a child on the rota is just a first name, with no profile, no photos, no chat and nobody outside the household can see them unless someone shares your household link with them; nothing is used for advertising or tracking; and nudges from housemates are off until someone on that phone turns them on in Settings. A parent can add a child's first name, and can remove it at any time. You need to be 13 or over to set up or join a household on your own phone; a parent can add a younger child's first name to the rota. If you think we hold a child's information that we shouldn't, email us and we'll delete it.

Automated decisions

We don't make automated decisions about you or build profiles.

Your rights

Under UK data protection law you can ask to see, correct, delete or move information we hold about you, ask us to limit how we use it, or object to how we use it. To remove your phone from a household, use Leave household in the app; to have your name removed too, ask a housemate to take it off the rota or email us. For anything else, email done.dustd@gmail.com and we'll reply within one month. If you're unhappy, tell us first and we'll put it right if we can. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change this policy we will update the date above and, for significant changes, tell you in the app.

Contact

Charles Rahbani · done.dustd@gmail.com