If we can't trust each other with the data, the whole product falls apart.

imdoingitnow ("imdoingitnow", "we", "us") runs a study-accountability service for families: a parent sets a study goal, the student records their screen while they study, and the parent sees a short summary. We are based in Bulgaria, in the European Union, and we are the "controller" of the personal data described here under the EU General Data Protection Regulation (GDPR).

This policy covers the website imdoingitnow.com, the parent dashboard, the student study page, the creator program and the emails we send (together, the "Service").

If you are in the United States, the "Notice for U.S. residents" section near the end also applies to you.

To contact us about anything in this policy, email hi@imdoingitnow.com.

We only collect what the Service needs. Depending on how you use it, that is:

Parent account

Your email address and a securely hashed password (we never store the password itself), your subscription status, settings such as colours, any feedback you send us and the in-app notifications we show you.

Children you add

The first name you enter, an optional age, the family code used to join, the study goals and tasks you set, and an optional colour.

Study sessions

A video of the student's screen while a session they started is running, still images taken from it, and — if the webcam setting is on — webcam snapshots or webcam video. Session times, duration, pauses, and anything the student types into the session (such as a note when ending). Recordings contain no sound at all.

Payments

Your payment card is entered on Stripe's secure pages and handled by Stripe; we never see or store your full card number. We receive a Stripe customer reference, your subscription status and payment results.

Creators in our creator program

Name, email, and any phone number, social media handle or notes they give us; their tier, commission and payout records; and whether they accepted the creator agreement. Bank, identity and tax details are collected and held by Stripe, not by us.

Referral links

When someone opens a creator's link, we count the visit using a one-way scrambled code made from their IP address and browser details, so we can count visits without storing the IP address. If they sign up, we keep the same kind of code for the sign-up, and Stripe's card "fingerprint" (a code, not the card number) from the first payment — both only to detect fraud such as one person creating many accounts.

Website use

Standard technical data our hosting provider handles to deliver the site (such as IP address and browser type), and anonymous, cookieless page-view statistics.

We do not collect audio, keystrokes, location, contacts or browsing history, and nothing is recorded outside a session the student started themselves.

The GDPR requires a legal basis for each use of personal data. These are ours:

Running the Service: accounts, goals, sessions, recordings and summaries

Contract — it is what you sign up for. For a child's data, the parent or guardian agrees to it on the child's behalf when adding them.

Taking payments and keeping billing records

Contract, and legal obligation (tax and accounting law).

Service emails: session summaries, payment problems, password resets, account notices

Contract.

Running the creator program: tracking referrals, paying commission, creator emails

Contract with the creator, and legal obligation for payment records.

Remembering which creator link you came from, so the discount applies

Legitimate interests — giving you the offer you clicked on.

Security and fraud prevention, including the scrambled visit and card codes

Legitimate interests — keeping the Service and its users safe and preventing abuse of the creator program.

Anonymous page-view statistics

Legitimate interests — understanding which pages are useful, without cookies or identifying you.

Meeting legal obligations and defending legal claims

Legal obligation, or legitimate interests where no specific law applies.

We do not sell personal data, show advertising, use your data for targeted advertising, or use it to train any artificial intelligence model — ours or anyone else's. We do not use automated decision-making that has legal or similarly significant effects on you. If we ever want to use your data for a new purpose that isn't compatible with these, we will ask for your consent first.

imdoingitnow records children, so we hold ourselves to a higher standard here.

• Only a parent or legal guardian aged 18 or over can create an account and add a child. Children do not have their own accounts.
• The parent decides to use the Service for their child and is responsible for telling the child that their screen is recorded. Before every session the student sees exactly what will be captured, and recording only starts when they press start.
• Recordings are only ever shown to the parent's account. They are never public, never shared with other users, and never used for advertising or AI training.
• For children under 13 in the United States, the parent gives consent under the Children's Online Privacy Protection Act (COPPA) when they create the account, add the child and start a subscription. Parents can review or delete their child's data, ask for a copy of it, or stop any further collection, at any time — see "Your rights".

If you believe we hold a child's data without proper consent, email hi@imdoingitnow.com and we will delete it.

We share personal data only with the service providers we need to run imdoingitnow ("processors"), who may use it only on our instructions:

Vercel

Hosts the website and app, and provides the cookieless page-view statistics.

Neon

Hosts our database.

Cloudflare (R2)

Stores recordings and still images, in private storage that is never publicly reachable.

Stripe

Processes subscription payments and, for creators, identity checks and payouts. Stripe also acts independently under its own privacy policy (stripe.com/privacy).

Resend

Sends our emails.

We may also share data with professional advisers (such as accountants or lawyers), with authorities where the law requires it, or with a buyer or successor if the business is ever sold — in which case your data would not be transferred without your explicit consent again, as promised above. We do not share data with advertisers or data brokers.

Some of our providers are based in, or store data in, the United States. When personal data leaves the European Economic Area, we rely on the European Commission's adequacy decision for providers certified under the EU-U.S. Data Privacy Framework, or on the Commission's Standard Contractual Clauses, so your data keeps the same level of protection. You can ask us for details of the safeguard used for any provider.

• Screen recordings, still images and webcam images are deleted automatically 30 days after the session, on every account. This cannot be switched off.
• If your subscription ends, every recording and your whole study history are permanently deleted 7 days later, unless you subscribe again before then. We keep no backups of them.
• Your account details, your children's names and goals stay until you ask us to close your account.
• Billing and payout records are kept for as long as tax and accounting law requires.
• Creator program records are kept while the creator is in the program and afterwards only as long as tax law and the resolution of any claims require.
• Sign-in links expire after 30 minutes (creator invites after 7 days).

When we no longer need data, we delete it or make it fully anonymous.

You have the right to:

• Access the personal data we hold about you (and, for parents, about your child) and get a copy.
• Correct inaccurate data.
• Delete your data. Recordings can be deleted one by one or all at once from your account at any time.
• Restrict how we use your data, or object to uses based on our legitimate interests.
• Data portability: receive your data in a common, machine-readable format.
• Withdraw consent at any time, where we rely on consent.

To use any of these rights, email hi@imdoingitnow.com from the address on your account. We will reply within one month. We may ask you to confirm your identity first. Using your rights is free.

If you're unhappy with how we handle your data, you can complain to Bulgaria's Commission for Personal Data Protection (КЗЛД, cpdp.bg), or to the data protection authority where you live. We'd appreciate the chance to sort it out with you first.

We use only the cookies the Service needs to work — to keep you signed in, link a student's device to their family, and apply a creator's discount. We use no advertising or tracking cookies, so you won't see a cookie banner. The full list is in our Cookie Notice at imdoingitnow.com/cookies.

All traffic is encrypted. Recordings sit in private storage and are shown only through links that expire after 5 minutes. Passwords are stored only as secure hashes, and card details never reach our servers. No system is perfectly secure, but we will tell you, and the authorities where required, without undue delay if a breach puts your data at risk.

If you live in a U.S. state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas), you may have the right to know what personal information we collect and how we use and share it, to access it, correct it and delete it, and to appeal if we decline a request. The categories we collect, why, and who we share them with are described above.

• We do not sell personal information, and we do not "share" it for cross-context behavioural advertising.
• We do not use personal information for targeted advertising or for profiling with legal or similarly significant effects.
• Recordings of children are sensitive personal information. We use them only to provide the Service to the parent, never to infer characteristics about anyone.
• We do not knowingly sell or share the personal information of anyone under 16.
• We will not discriminate against you for using your rights.

To make a request, email hi@imdoingitnow.com. You may use an authorised agent; we may ask for proof of their authority and to confirm your identity. California residents may also ask, under the "Shine the Light" law, which third parties received their personal information for direct marketing — we share none.

If we change this policy in a way that matters, we will email account holders before the change takes effect and update the date at the top. Minor clarifications are posted here.

Questions, requests or complaints about privacy: hi@imdoingitnow.com. A real person reads every message.