Privacy Policy

Dovli is made and run by Mayank Jha, an independent developer (“we” in this policy). For anything about your privacy or your data, email support@dovli.in.

Your account. Your email address, and your name if you give one. If you sign in with Google, we also get your name, email and profile photo from Google. We note how you sign in (Google or email code), when you made your account, and when you last signed in and used Dovli.

Your pages. When you’re signed in, your pages, to-dos, tables and whiteboards are saved on our servers so they stay in sync across your devices. That includes pictures you add to a whiteboard. Pictures you add inside a document are kept on that device only for now. Pages are stored securely but are not end-to-end encrypted.

Your devices. For each device you use, a random device ID, the kind of device and browser (for example “Chrome on macOS” or “Android phone”), the app version, and when it was first and last used.

Sign-in codes. When you ask for a sign-in code, we keep a scrambled (hashed) copy of the code, when it expires, how many tries were made, and when codes were sent, so we can check it and stop misuse. To limit how many codes can be requested, we also keep a hashed form of your IP address and the times of recent requests.

Sharing. When you share a page, we keep who it’s shared with and what they can do. If you invite an email address that doesn’t have a Dovli account yet, we keep that address and the page title until they sign up or you remove the invite.

AI features (web). How much AI you’ve used each month, and which AI provider and model you chose. If you connect your own AI key, we keep it encrypted and use it only for your requests.

Connected AI apps. If you connect an AI app to Dovli (through MCP), we keep the connection’s name, which pages it may use and what it may do, and when it was last used.

Website analytics. The website uses Vercel Web Analytics and Speed Insights to count visits, see how fast pages load, and count a few button clicks (such as “Create free account”). Page addresses are stripped of page IDs and other details before they are sent, and we never send your name, email or page content. The phone app has no analytics or crash-reporting tools.

• To run your account, sign you in, and keep your pages in sync.
• To send the emails you ask for: sign-in codes, and invites when you share a page.
• To answer AI requests you make, and to keep AI use within fair limits.
• To keep Dovli safe, such as limiting how many sign-in codes can be requested.
• To understand, in total numbers, how the website is used and how fast it is.

We don’t sell your data, we don’t use it for advertising, and we don’t train AI models on your pages.

We use a few services to run Dovli. They handle your data for us, to provide their service:

• Google Firebase: accounts and sign-in, and the database where your account and pages are stored. Google Sign-In, if you choose to sign in with Google.
• Vercel: hosts the website and the server Dovli runs on, and provides the website analytics above.
• An email delivery service: sends sign-in codes and share invites.
• AI providers, only when you use an AI feature on the web: Groq or Anthropic for Dovli’s own AI, or the provider whose key you connect (Groq, OpenRouter, Anthropic or OpenAI). We send what the request needs, such as your question, the page you have open and the titles of pages inside it. We don’t send your name, email or account ID. Each provider handles that text under its own terms.
• Link previews: when you paste a link, your device asks microlink.io (or noembed.com for YouTube and Vimeo links) for its title and picture, so those services see the link. Videos you embed load from YouTube, Vimeo or Loom.
• Fonts: the website and the editor load fonts from Google Fonts and similar public font services, which see your IP address, as with any website.

And people or apps you choose:

• People you share with. They see the page you share and your name (or, if you haven’t set a name, your email). Invite emails include your name or email and the page title. Anyone with a page’s public link can see that page, until you turn the link off.
• AI apps you connect can see your name and email, and read or change the pages you allow.

We may also share information if the law requires it, or to protect Dovli and its users from fraud or abuse.

Your data is stored by the services above, which may keep and process it in data centres in different countries. We choose services that protect it with strong security.

• Your account and pages: until you delete them, or delete your account.
• Pages you delete for good: removed, except a small note (the page’s ID, title and type) so your other devices know to remove it too. That note goes when your account does.
• Sign-in codes: they work for 10 minutes and once only. The records behind them are kept only briefly.
• Website analytics: kept by Vercel in total numbers, not tied to you.

• Change your name (in the phone app, under Account), and stop sharing any page, at any time.
• Export your pages: a full backup, or every page as Markdown.
• Ask us for a copy of your data, or to correct or delete it, by emailing support@dovli.in from the address on your account.
• Delete your account and everything in it, in the app or on the web. See how.

Deleting your account removes your sign-in, your pages, your devices list, your AI settings and any key you connected, your AI app connections, your pages’ public links, invites you sent that are still waiting, and any sign-in codes for your email. It happens right away and can’t be undone. How to delete your account.

A few traces can remain: a page you shared may stay listed in another person’s “Shared with me” until they next open it, pages owned by other people may still note that you edited them, and our service providers may keep their own logs for a short time.

The website sets one cookie, to keep you signed in (for up to 14 days). The website and app also keep your pages on your device so they open quickly and work offline. Analytics does not use cookies.

Everything travels over encrypted connections (HTTPS). Only Dovli’s server can read or write the database, and it checks who you are before it opens or changes your pages. Keys you connect for AI are encrypted. No system is perfectly secure, so if we ever learn of a breach that affects your data, we’ll tell you.

Dovli isn’t meant for children under 13, and we don’t knowingly keep data about them. If you think a child has given us data, email us and we’ll delete it.

If we change this policy, we’ll update the date at the top. If a change matters for how your data is used, we’ll let you know in the app or by email before it takes effect.