Privacy Policy

Effective October 5, 2026

About this policy

How I Do It, at howidoit.doab.ai, is operated by Doab.ai. Dato, our Digital AI Technology Officer, helps people learn, plan prototypes, and understand their tools. This policy describes how information is handled in this service. Contact hello@doab.ai with privacy questions or requests.

What we collect and why

We process account identifiers, verified email addresses, names, profile images, and details you choose to enter to manage sign-in, profiles, and access.

We save the work you submit: project descriptions, conversations, notes, prompts, decisions, tool inventories, pasted audit reports, extracted document text, source-code snapshots you submit for review, code findings, generated recommendations, and course submissions. This lets us provide the features you request and reopen your saved work.

We also process course and team membership, assignments, feedback, sign-in and recent-request timestamps, course activity, and operational information such as errors and AI usage. We use these to deliver teaching, administer access, protect the service, and investigate problems. Hosting and identity providers may process IP addresses and browser information when delivering the service.

Use public information, invented examples, or non-sensitive project material you are authorized to share for analysis. For health-related examples, use invented data only. Do not submit passwords, tokens, patient records, or sensitive personal records. Automated checks cannot detect every secret or sensitive detail.

Google sign-in

Google sign-in requests your basic identity: account identifier, email, name, and profile information. It does not request access to your Gmail, calendar, or Google Drive. We do not receive your Google password through this process.

Signing in does not connect your other tools or authorize an inspection of them. Environment audits are based on reports you supply. Code reviews are based on source snapshots you upload or explicitly import from GitHub. You can remove the Google connection in your Google Account settings; this does not delete information already saved here. Contact us to request its deletion.

Optional GitHub connection

Where enabled, connecting GitHub uses a GitHub App with read-only repository contents access. You choose its repository access in GitHub. We read the repository and commit you request; we do not execute repository scripts, push commits, create pull requests, or change repository permissions through this feature.

Connection credentials stay encrypted on the server and are not included in prompts or browser storage. The service uses a connection for up to one hour before asking you to reconnect. Disconnect removes the stored connection credential; revoke the app in GitHub to remove its provider-side grant. Disconnecting does not delete source snapshots you already saved. Use the code-review delete control to remove those active records.

AI and uploaded material

When you ask Dato a question, generate a roadmap, or request an audit or follow-up, relevant material is sent through Netlify's AI gateway to the configured AI provider. The current Dato service uses an OpenAI model. Relevant material can include your message, conversation and project context, extracted text, selected reports, sanitized source-code snapshots, code findings, and teaching references. Responses may be saved with your work.

The application requests that supported AI calls are not stored as provider response objects. This is not a guarantee of zero provider retention: gateway processing, security monitoring, logs, and provider terms may still apply. This service does not give itself permission to use your submissions to train a general-purpose AI model.

For pitch uploads, the browser extracts readable text. Upload deck & create roadmap sends and saves that text for analysis; this feature does not upload the original pitch file. The short-file chat control instead puts text into a draft for you to send.

For code reviews, uploaded ZIPs or folders are read in your browser; supported source text is previewed before submission. GitHub imports retrieve a selected commit through our server. Known secret-file types and common credential patterns are filtered, but those checks are not comprehensive. Review your code before sending it. The source snapshot and findings are stored in your private account for the review and follow-up questions. Code review does not inspect live services or run the code, and does not certify legal or policy compliance.

Feedback screenshots are separate. After your review, we receive your comment and a flattened image containing your annotations and covered details. Authorized operators can read these in a private inbox. Feedback screenshots are not sent to Dato. Review the image before submitting it.

Who can see your work

Personal projects and audits: other learners and instructors do not gain access simply because you join a course. Authorized operators may access information as necessary to maintain the service, investigate a problem, address abuse, comply with law, or handle your request.

Courses and teams: the enrollment notice explains shared visibility. Authorized instructors can review course and team questions, conversations, notes, prompts, tools, decisions, submissions, and relevant history. Authorized teammates can see shared team work. Copying material into a shared space changes who can see that copy.

Shared practice logins: anyone using the same login may see its work. Use invented examples only.

Administrators can see sign-in and recent-request information; instructors can see activity for courses they administer. This is not continuous monitoring, proof that someone is online, or an automatic grade.

Learning improvement and research

We may review authorized feedback and non-proprietary learning patterns to improve explanations, course delivery, and teaching frameworks. This purpose does not expand anyone's access to private workspaces.

We will not sell your personal information, learning records, pitch decks, project content, or datasets derived from them. Using providers to deliver the service is not a sale of your information.

Proprietary pitch and project content is excluded from secondary research, framework development, and materials for other learners. This includes nonpublic ideas, designs, strategies, financial information, code, inventions, and confidential details embedded in conversations. We may process that material to provide your requested assistance, but will not repurpose it for another learner or a competing product.

Before sharing learning findings beyond authorized staff, we will use combined findings or invented examples and check for personal identification and proprietary information. Removing names alone does not make a distinctive project or a small class anonymous. Material that cannot be separated safely will not be reused.

Formal academic research using learner-level information beyond course delivery will not begin without a separate explanation, voluntary consent, and any applicable institutional research or ethics review. Declining or withdrawing will not affect access, instruction, grades, or instructor treatment. Study-specific information must explain the data, researchers, retention, withdrawal process, and limits once findings are irreversibly combined or published. Signing in or accepting service terms is not research consent. Existing records are not automatically enrolled in research under this policy.

Providers and browser storage

We use Google and Supabase for identity services, and Netlify for hosting, server functions, storage, and the AI gateway. Optional code imports also use GitHub. Relevant AI requests also reach the configured model provider. Providers may process information in countries other than yours under their applicable arrangements and terms. We may disclose information when legally required, to address fraud or security threats, or at your direction.

Session cookies support sign-in and secure requests. Browser storage may retain navigation choices and browser-only practice work; unsaved edits may remain in memory while a page is open. Clearing browser storage does not delete server-saved work. External resources, fonts, and profile images may make requests to their hosts, whose privacy practices also apply.

Retention, choices, and requests

There is no single automatic deletion period for all saved projects, conversations, accounts, course records, audits, or feedback. Records may remain until removed through available controls or an operator handles a deletion request. Some activity reports use a 90-day window and count limits; that is not a promise that all related data is deleted after 90 days.

Available audit deletion removes content from the active record and list, while limited deletion/version metadata may remain. Provider backups, legal obligations, and copies already shared or exported can affect deletion. We will explain relevant limits when responding to a request.

You can edit supported fields, choose what to submit, use available copy/export and deletion controls, and contact hello@doab.ai to request access, correction, a copy, deletion, or other rights available under applicable law. We may verify identity proportionately. Where applicable, you may complain to your privacy regulator. Institutional course arrangements may impose additional record-handling duties; this policy does not replace an institution's notices.

Security and updates

We use account verification and access controls designed to protect saved work. No service can guarantee absolute security. Report suspected exposure promptly without sending secrets in your message.

We will date changes to this policy and bring material changes to affected users' attention before applying a new secondary use. A change to this policy alone will not enroll users in research or authorize sale of their data.