Privacy Policy

SotiDo™ is the product name used for this service and is operated by a private individual based in Indonesia.

Introduction

SotiDo™ (the “Service”) is available on the web, as a Telegram Mini App, and through native iOS and Android apps. It lets people discover events, create and manage calendars and events, and share selected content. This Privacy Policy explains what information we collect, how we use it, how it is stored, and under what circumstances it may be shared.

This policy describes the processing that is necessary to provide the Service and the choices available to you. Where applicable law requires consent for an optional permission or technology, we request it separately rather than treating ordinary use of the Service as consent.

Data We Collect

We collect only the data necessary to operate the App and provide its features:

• Identity and Authentication Information. You may sign in with an email address and a one-time code, or through Google, Apple, or Telegram. Provider sign-ins may give us your name, display name, avatar/profile photo, email address, and a provider-specific user identifier. Email-code sign-in stores your normalized email address and does not require us to store an account password. If you create a passkey, your device or credential provider keeps the private credential; SotiDo stores only the public credential material and limited security metadata needed to authenticate you. We do not receive your biometric data or passkey private key. This information is used to create or link your account across platforms and to display your identity within the App.
• Calendars and User Content. The Service stores content you choose to create, including calendar and event titles, descriptions, dates, times, places, participants, private notes, saved contacts, reports, and moderation submissions. You may also attach photos or videos to supported event surfaces. If you choose to import your Google Calendar data (via Google OAuth with your permission), we access your Google Calendar events and related details only when you request the import. These event details may be stored in our database so that you can view and manage them in the App.
• Places and Optional Location Use. Places, addresses, and map pins that you manually add to calendars or events are stored as user-created content. The web version may ask for browser location access, and native apps may ask for device location access, when you explicitly choose nearby discovery, Globe centering, or automatic time-zone help. That location is used to service the active request or session and is not saved as persistent account or home coordinates.
• Technical Request and Security Data. When a device connects to the Service, our infrastructure providers and servers may process limited network and request information such as an IP address, request time, hostname and path, response status, referrer, user agent, and security or rate-limit signals. We use this information to deliver the requested content, protect the Service, diagnose failures, and produce bounded aggregate traffic statistics.
• Usage Data and Product Analytics. We may record explicit product interactions and operational information, such as calendar or event views, feature actions, game-mode entries, timestamps, and login activity, to provide owner statistics, maintain the Service, prevent abuse, and troubleshoot issues. Public-page reporting uses server-to-server aggregate Cloudflare edge statistics for registered page paths and first-party action redirects. SotiDo does not retrieve raw visitor IP addresses or raw URL query strings for that report, and the reported estimates are not treated as unique people. We do not use third-party advertising analytics or advertising pixels.
• Reports and Moderation Data. If you submit a content report or if content is reviewed for abuse-prevention purposes, we may store the report text, reason code, timestamps, your account identifier, internal review notes, and limited snapshots of the reported content.

The current first-release native apps do not offer digital-goods purchases and do not collect payment-card or banking information.

How We Use Your Data

We use the collected data solely to provide, maintain, and improve the core functionality of the App. Specifically:

• Providing Services. Identity information is used to authenticate you and allow you to securely access your calendar. Your display name and avatar may be shown to you and (only when you share events) to those specific people you share with. Calendar event data is used to display your schedule and enable sharing/collaboration when you request it.
• Synchronization. If you link Google Calendar, we use your OAuth authorization to fetch your calendar events and show them in the App. This data is used only to synchronize events when you ask us to.
• Operation and Improvements. We may use usage data and aggregated, non-personal information to debug issues, monitor performance, and improve features. This data is never used for advertising, promotional targeting, or behavioral profiling.
• Safety, Abuse Prevention, and Legal Compliance. We may use account data, event data, reports, and moderation logs to detect spam, investigate complaints, enforce our Terms, protect users and rights holders, and comply with legal obligations.

We do not use personal data for advertising, profiling, or promotional targeting. We do not sell or rent personal information.

Legal Bases for Processing

Where data-protection law requires a legal basis, we rely on the basis that matches the purpose:

• Providing the Service and performing our agreement with you for account access, calendars, events, collaboration, and requested features.
• Your consent for optional permissions or connections, such as device location access or a Google Calendar import, where consent is required. You may withdraw that consent through the relevant device, provider, or account controls.
• Our legitimate interests in securing, operating, debugging, and improving the Service, including privacy-preserving aggregate reporting, provided those interests are not overridden by your rights.
• Legal obligations and protection of rights when we must retain or disclose limited information to comply with law or address fraud, abuse, safety, or legal claims.

Third-Party Service Providers

To operate the App, we rely on a few trusted third-party services. We share data with these providers only as needed:

• DigitalOcean-hosted infrastructure. We operate the Service on self-hosted infrastructure running on DigitalOcean. User data (including account information and calendar events) may be stored in our managed application databases and storage systems only as needed to provide the Service.
• Cloudflare edge delivery, security, and aggregate traffic analytics. Requests to our public domains may pass through Cloudflare for DNS, content delivery, caching, traffic protection, and related network services. Cloudflare may process limited request metadata, including IP addresses, on our behalf. SotiDo reads bounded aggregate counts for registered public paths through Cloudflare's server-side Analytics API; we do not receive a per-visitor browsing profile from that report. Cloudflare's own processing is described in its Privacy Policy.
• Google APIs (OAuth & Calendar API). Used for Google Sign-In and (if you request it) importing calendar events. We do not use Google data beyond what is necessary for these features.
• Telegram Platform. If you use the App as a Telegram Mini App, Telegram provides your Telegram user ID and basic profile data. We use it to identify you. Telegram’s own privacy policy governs data Telegram collects.
• Apple Sign In (if used). Used to authenticate you. Apple may share your name and (optionally) email address, depending on your settings.
• Transactional email delivery. We currently use Postmark to deliver one-time sign-in codes and essential account messages. The provider receives the destination email address and message content needed to deliver that email; it does not receive your SotiDo session cookie or passkey private key.
• Analytics and internal reporting. The Service does not use third-party advertising analytics tags or advertising pixels. We combine first-party product facts with server-to-server aggregate Cloudflare edge statistics. These sources remain separate and are not joined into a cross-service identity profile.

We do not share your personal data with third parties beyond what is necessary to provide the Service.

Analytics

SotiDo uses two limited analytics sources. Product analytics records selected actions already handled by the Service, such as visible calendar or event opens and authenticated game-mode entries. Public-page analytics reads aggregate request and visit estimates from Cloudflare through a server-to-server API. Cloudflare estimates may be sampled, may include bots or repeated requests, and are not a count of unique people. We use these sources for owner statistics, service health, capacity planning, and product improvement.

Ordinary public pages do not load a general-purpose analytics beacon. SotiDo does not currently set or read analytics-specific cookies, browser storage, advertising identifiers, or device fingerprints for public-page traffic reporting. We do not combine Cloudflare traffic estimates with account identities or use them for advertising. If we introduce an optional client-side analytics technology in the future, we will update this policy and provide consent controls before activation where required.

If you use the Service as a Telegram Mini App, Telegram platform policies and Telegram Mini App environment analytics may still apply inside Telegram.

Cookies and Similar Technologies

The Service uses limited first-party cookies and browser storage for requested functionality:

• Session and authentication cookies keep you signed in, protect authenticated requests, and are cleared or expire according to the session rules.
• Cloudflare security cookies may be issued when a security challenge, bot protection, rate limit, or similar edge protection is needed.
• Functional local or session storage may remember choices such as language, theme, calendar presentation, drafts, or short-lived application state. It is not used to recognize you across unrelated services or deliver advertising.

The server-side public-page analytics described above does not require an analytics cookie. Where applicable law requires consent for a future non-essential cookie or similar client technology, SotiDo will ask before enabling it. Necessary authentication, security, and user-requested functional storage remains available so the Service can work.

Data Sharing and Disclosure

We do not sell or share your personal information for advertising, profiling, promotional targeting, or unrelated purposes.

We may disclose data only in these cases:

• Service operation — to the providers listed above, only as needed.
• Legal requirements — if required by law, regulation, or valid legal process.
• Protection of rights — to prevent fraud/abuse, review reports, respond to rights-holder complaints, or protect users and the Service, in accordance with applicable laws.

If you share events with other users, event information you choose to share will be visible to those recipients. The App does not share your events with others by default.

International Processing

SotiDo is operated from Indonesia and uses providers that may process data in other countries. Where required, we use provider agreements and available contractual or organizational safeguards for cross-border processing. The protections and rights described in this policy continue to apply regardless of where a service provider processes data on our behalf.

Data Security

• Encryption in transit. Communications use HTTPS/TLS.
• Access controls. We apply authentication and access rules to prevent unauthorized access.
• No guarantee. No method of transmission or storage is 100% secure, but we work to protect your data.

Data Retention and Deletion

• Retention. We retain data as long as needed to provide the Service, unless deletion is requested.
• Analytics retention. Product analytics facts and aggregates are retained only for bounded operational and owner-reporting periods. Cloudflare keeps edge analytics according to the limits of our current service plan. SotiDo requests only bounded recent windows and briefly caches aggregate responses; it does not create a separate permanent store of raw Cloudflare page requests.
• User-requested deletion. You can delete your account in the app settings when you are signed in, or use the public account deletion request page at /account/delete. You can also request deletion of your account and associated data by contacting us. We may need to verify your identity before processing the request.
• Google permissions. You can revoke Google access in your Google Account settings at any time. Revoking access stops future imports/sync; previously imported data may remain until you delete it or request deletion.
• Backups. Residual copies may persist in encrypted backups for a limited period before being purged.

Payment Processing

The current first-release native apps do not offer digital-goods purchases. If paid features are enabled in a future release, payment details will be entered through the applicable platform or payment provider rather than stored by SotiDo, and this policy and the relevant store disclosures will be updated before that feature is released.

Your Rights and Choices

• Access and correction. You can review and update supported profile, calendar, and event information in the App and may request a copy or correction of other personal data where applicable.
• Deletion and portability. You may request deletion and, where applicable, a portable copy of personal data you provided.
• Objection and restriction. Where applicable, you may object to or request restriction of processing based on legitimate interests.
• Withdraw consent. Withdrawing consent does not affect processing that occurred before withdrawal or processing supported by another lawful basis.
• Revoking permissions. You can revoke third-party access (Google/Apple/Telegram) in the respective account settings.
• Account deletion. You can delete your account in app settings, use /account/delete, or contact us (see below).
• Complaint. Depending on where you live, you may have the right to complain to your local data-protection authority.

Children’s Privacy

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided information, contact us to request deletion.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the effective date at the top of this page. Continued use of the Service after changes means you accept the updated policy.

Contact Us

SotiDo is operated by a private individual based in Indonesia. For privacy purposes, the operator is the controller of personal data processed by SotiDo. If you have questions or requests (including access, correction, objection, portability, or deletion), contact: [email protected] or [email protected]