Last updated: 14 October 2026
Debo is a task app with personal AI agents, made by Habesha Labs LLC ("we", "us"). This policy explains what we collect, why, and what you can do about it. The short version: we keep your tasks so they sync between your devices, we don't sell your data, and we don't show ads.
Questions: hello@getdebo.com.
Account details. Your name and email address, so you can sign in and so collaborators can recognise you. You can sign in with your email address (we email you a sign-in code or link), or with Apple, Google or GitHub, in which case we receive your name and email from that service. You can also add a device with a one-time pairing code from a device you're already signed in on. If you use Sign in with Apple's "Hide My Email", we only see the relay address.
Your workspace content. Tasks, projects, sections, labels, comments, due dates, reminders, the activity history of your workspace, and the files you attach to comments. We store this so it syncs across your devices and to the people you share a project with. This is the core of the service.
Devices and sign-ins. For each device you sign in on, we keep a name (e.g. "iPhone"), the kind of device, when it was added and last used, and whether it was signed out. Sign-in tokens and pairing codes are stored only as one-way hashes, never in readable form. You can see, rename and sign out devices on the Devices page.
Push tokens. If you allow notifications on iPhone, we store the push token Apple gives us so we can send reminders and updates.
Technical logs. Our servers record requests (including IP address) to keep the service running, stop abuse and fix bugs. We use IP addresses briefly to rate-limit sign-in attempts. Server logs are kept for 7 days.
Usage analytics (planned). We plan to use PostHog to understand which features are used and where the app breaks. It isn't switched on yet. Planned design: a random identifier for each install, linked to your Debo account ID but never to your name or email; no task, project, comment or file content, prompts or agent replies; and a switch to turn it off in Settings. We may also record app sessions to find bugs, with everything you type masked.
Files you choose to attach. The iPhone app asks for photo access only when you attach a photo, and only uploads the photo you pick. Attachments are limited to 25 MB each.
Imports. If you import from Todoist, you enter your own Todoist API token in the app. The app uses it once, on your device, to read your Todoist data and copy it into Debo. The token is sent only to Todoist, never to our servers, and the app forgets it when the import ends. To avoid duplicates if you run the import again, the app keeps a list on your device that matches Todoist IDs to Debo IDs (no content).
We don't collect your contacts, location, or advertising identifiers.
Debo's agents run on your own computer, using AI tools you install and sign in to yourself, such as Claude Code or Codex, with your own accounts and subscriptions at those providers. When an agent works on a task, Debo sends the task content and your instructions to that provider from your machine. What the provider does with that data is governed by your agreement with that provider, not by this policy. We don't receive your provider credentials, and we don't run these models for you.
We share data only with the service providers we need to run Debo, and only for that purpose:
| Provider | What for | Data |
|---|---|---|
| Cloudflare (US) | Hosting, database, file storage | Everything stored on our servers |
| Apple | Push notifications, Sign in with Apple, App Store | Push tokens; notification content (who acted, the task or project name, and for comments and questions the message text); sign-in details. You can turn off each kind in Debo's Settings, or hide previews in iOS Settings |
| Google, GitHub | Sign-in (if you choose them) | Sign-in details |
| Resend | Sign-in emails (from signin@getdebo.com) and service emails | Your email address and the email we send you |
| PostHog (US) — planned | Product analytics | Usage events, no content |
| AI providers you connect | Running your agents | Whatever you or your agent send them, under your agreement with them |
We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or merger of our business (we'd tell you first).
We don't sell your personal information, we don't share it for advertising, and we don't use your content to train AI models.
If you share a project, the people in it can see its content and your name and email. Comments and activity you add there are visible to them.
We keep your account and workspace while your account is open. When you delete something it may persist in backups or history for up to 30 days. Revoked devices remain in your device list as a record. Server logs: 7 days.
You can export your data and delete your account in the app, under Settings → Account on iPhone and on Mac. The export is a file with your workspace data and links to download your attachments.
Before deleting your account, Debo asks you to confirm it's you, by signing in again or with a code we email you. Deleting your account also deletes the agents you own and your data. In projects you shared, your comments stay for the other members, shown as "Deleted user", and a shared project you own passes to the collaborator who joined it first.
If you can't do this in the app, email hello@getdebo.com and we'll do it for you within 30 days.
Connections are encrypted (HTTPS). Sign-in tokens and codes are stored only as hashes. Each workspace is stored separately. Attachments are private. No system is perfect; if we learn of a breach affecting you, we'll tell you as required by law.
Debo is not for children under 13, or under 16 in the EU/UK and other places where that's the age of digital consent. If you believe a child has given us data, contact us and we'll delete it.
Wherever you live, you can ask us to access, correct, delete or export your data, and to stop analytics on you. If you're in the EU/UK you also have the right to object, to restrict processing, and to complain to your data protection authority. Our legal bases: providing the service you asked for (contract), keeping it secure and improving it (legitimate interests), and your consent where we ask for it (e.g. notifications, session recording).
California residents: we don't sell or "share" personal information as the CCPA defines it, and we won't treat you differently for using your rights.
To use any of these rights, email hello@getdebo.com. We'll reply within 30 days.
We're based in the United States and store data there. If you use Debo from elsewhere, your data is transferred to the US.
If we change this policy, we'll update the date above. For significant changes we'll tell you in the app or by email before they take effect.
Habesha Labs LLC, 6255 Shackelford Terrace, Alexandria, VA 22312, USA — hello@getdebo.com — getdebo.com