Last updated: 1 November 2026

Privacy policy

This policy explains what D-WAY (“we”) collects when you use the D-WAY Android app and the website dway.az, why we collect it, who else handles it, how long we keep it and what you can do about it. Questions: [email protected].

What we collect

• Your account: name, surname, username, email address, country (if you give it), time zone and language. Your password is stored only as a one-way hash. If you sign in with Google, we receive your Google account ID, name and email address from Google.
• What you add: tasks (title, notes, category and your own category names, priority, period, reminder time and when you completed them) and the files and photos you attach to them; community posts, their photos, comments, likes, @mentions and reports; direct messages (text, photos and forwarded posts), message requests and the people you block.
• Challenges and events: which ones you join, your progress, and for paid events whether your place is paid. Payment happens outside D-WAY by bank transfer; we never receive your card details.
• Feedback you send from Settings, with the screenshot if you add one.
• Activity: the days you complete tasks (for your streak, progress and badges) and when you last used D-WAY.
• Device and connection: a push-notification token for your phone (Firebase Cloud Messaging), the app or browser you signed in with, and your IP address, which our servers and our network provider see with every request.

We don’t use advertising, analytics or tracking tools. The website sets only the cookies it needs to keep you signed in and to remember your language; your theme and a few display choices are kept in your browser.

Why we use it

• To run D-WAY: keep your tasks in sync between the app and the web, work out streaks, progress and badges.
• To send what you ask for: task reminders and notifications about messages, likes, comments, mentions, badges and events. You choose which kinds in Settings › Notifications.
• To send account emails: verification codes, password resets and the details of events you join.
• To run the community, challenges, events and direct messages, and to act on reports.
• To keep accounts safe: sign-in, ending sessions, and limiting how often requests can be made.
• To improve D-WAY from the feedback you send.

Who can see it

• Other D-WAY users see your name, username and what you post in the community; the people you chat with see your messages, when you joined and your best streak.
• The D-WAY team (admins) can see account details and activity counts to support you and moderate the community, reported posts, and the feedback you send.
• Photos in posts and chats are served from links that can’t be guessed but aren’t protected by a password, so anyone you share such a link with can open it. Files and photos attached to tasks are private and only reachable through links that expire within two hours.

Services that handle it for us

We don’t sell your data or share it for advertising. These providers process it on our behalf to run D-WAY:

• Contabo: the servers that run D-WAY and its database, in the European Union.
• Cloudflare: network, encryption in transit and protection against attacks; it sees IP addresses and requests.
• Microsoft Azure Blob Storage: photos, files and our encrypted database backups.
• Zoho Mail: sends our emails.
• Google: Firebase Cloud Messaging delivers push notifications; Google Sign-In, if you use it.

How long we keep it

• Your data stays while you have an account. When you delete it, your name, username, email address, country, password and Google link are erased and your tasks with their files are deleted at once; files leave our storage within the hour, and our encrypted backups are deleted after 30 days.
• What you shared with others (posts and their photos, comments, likes, chats, event places and challenge runs) stays under “Deleted user”, with nothing that identifies you. Delete posts or comments yourself before deleting your account if you want them gone too.
• Sign-ups that never confirm their email are deleted after 7 days.
• Feedback stays after you delete your account, without your name, so the team can still act on it.
• Server logs, which include IP addresses, are rotated and overwritten after a short time.

Security

Every connection to D-WAY is encrypted (HTTPS). Passwords are stored only as hashes, sign-ins can be ended on every device, and backups are encrypted before they leave our server.

Your choices and rights

• Change your profile in the app or on the web, and choose which notifications you get in Settings.
• Delete your account in Settings › Delete account, in the app or on the web; see how to delete your account.
• Ask for a copy of your data, or for something to be corrected or deleted, by emailing [email protected] from the email address of your account.
• If you think we handle your data wrongly, you can also complain to your data protection authority.

Children

D-WAY isn’t meant for children under 13. If you believe a child under 13 has an account, email [email protected] and we’ll delete it.

Changes

When this policy changes, we update the date at the top; for important changes we also tell you in the app or by email.

Contact

Questions or requests about your data: [email protected].