--- title: "Privacy Policy - DokuAI" description: "Privacy policy for the DokuAI website (dokuai.app): GitHub Pages hosting, Google Analytics with Consent Mode v2, no third-party fonts." url: "https://dokuai.app/privacy/" language: "en" last_updated: "2026-10-17" --- # Privacy Policy, dokuai.app website Effective date: October 2026 Scope of this notice This policy covers the marketing website **dokuai.app** only, what happens when you load the page in your browser. The privacy policy for the **DokuAI iOS app** itself (data captured on site, voice transcription, server-side processing, retention, sub-processors such as Civo, OpenAI, RevenueCat, Apple) is the separate document linked from the App Store listing and at [digitalfreedom.co.za](https://digitalfreedom.co.za/). ## 1\. Service provider The website dokuai.app is offered under the **DigitalFreedom** brand. The data controller (Art. 4(7) GDPR) is: DigitalFreedom Global LLC (trading as DigitalFreedom) 30 N Gould St, Ste N · Sheridan, WY 82801 · United States Data protection inquiries: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) General inquiries: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za) ## 2\. GDPR as the global baseline We adopt the EU General Data Protection Regulation (GDPR) as the strictest baseline and apply it as a **global floor**, every visitor, in every country, benefits from at least the GDPR-level protections set out here. We additionally respect any applicable local data-protection law (UK GDPR, Swiss FADP, CCPA/CPRA, PIPEDA, Australian Privacy Act, LGPD, APPI, PIPA, DPDP Act, POPIA, etc.); where it is more protective for you, the more protective standard applies. ## 3\. What we collect on this website ### 3.1 Hosting (server log data) The site is hosted on **GitHub Pages**. When you load a page, GitHub processes: - IP address - browser user-agent string - requested URL and timestamp - referrer URL (where available) Purpose: deliver the page and protect against abuse (rate limiting, anti-DDoS). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website). Retention: per GitHub's policies. International transfer is covered by the EU-US Data Privacy Framework. See [GitHub's General Privacy Statement](https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement). ### 3.2 Browser local storage The site sets the following keys in your browser's `localStorage`: - `theme`, your light/dark preference, only when you actively switch the theme. No personal data, never transmitted to a server. - `cookie-consent`, your decision on the cookie banner (`granted` or `denied`). Set when you click Accept or Decline. - `locale-explicit`, set to `1` when you close the language hint or choose a language in the language menu, so the hint does not appear again. No personal data, never transmitted to a server. - `dk-check:` followed by the page path, only on the deposit checklist page: which checklist items you ticked, so your walkthrough survives a reload. Deleted when you clear the checklist. No personal data, never transmitted to a server. You can clear these entries any time in your browser settings. Legal basis: § 25(2) No. 2 TDDDG (strictly necessary for the user-chosen function). Only if you accept the cookie banner does the site additionally set the following key in your browser's `sessionStorage`: - `dk_utm`, in `sessionStorage`, only if you arrive through a link with campaign parameters: the values of `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term` from the address of the page you landed on, and only values of 1 to 64 characters made up of letters, digits, dot, underscore and hyphen. Purpose: attributing app downloads to the campaign. Google Play links on the page receive these values in their `referrer` parameter; App Store links receive the campaign name (`utm_campaign`) as `ct`, together with our App Store provider ID (`pt`) and `mt=8`. The store receives these values in the link you open when you tap a store button. If Google Analytics runs (section 3.3), the same campaign values are included in the `store_click` event. Deleted automatically when you close the browser tab. No personal data, never transmitted to our server. Without consent nothing is stored: campaign parameters in the address of the page you open are then added to the store links in memory for that page view only. Legal basis: Art. 6(1)(a) GDPR (consent) + § 25(1) TDDDG. You can withdraw consent at any time via the "Cookie settings" link in the footer or by clearing this site's data in your browser. After withdrawal `dk_utm` is no longer read or written; a value already stored is deleted when you close the tab. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. ### 3.3 Google Analytics 4 with Consent Mode v2 Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EU). We use Google Analytics 4 to understand which content works. **Cookies and personalised measurement only run after you accept the cookie banner.** Before consent, only cookieless, aggregated pings are sent to Google, Consent Mode v2 defaults (`ad_storage`, `ad_user_data`, `ad_personalization`, `analytics_storage`) are all set to *denied* before `gtag.js` loads. Data processed after consent: pseudonymous client ID, IP address (anonymised on Google's side), page URL, referrer, language, screen size, time on page, interactions with the cookie banner. Purpose: aggregated reach and engagement measurement. Retention: 14 months (GA4 default). Legal basis: - Cookies and personalised measurement: Art. 6(1)(a) GDPR (consent) + § 25(1) TDDDG. - Cookieless aggregated pings before consent: Art. 6(1)(f) GDPR (legitimate interest in aggregated reach measurement). International transfer: data may be processed in the United States. Google relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses as the legal basis for transfers outside the EU. You can withdraw consent at any time via the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. ### 3.4 What we do *not* do on this website - no marketing tracking pixels (Meta, LinkedIn, X) - no third-party fonts (Geist is self-hosted from this domain, no connection to Google Fonts) - no payment or checkout, purchases happen on Apple's App Store - no account creation, login or contact form on this website - no newsletter signup on this website - no audio, video or session-replay recording ## 4\. Sub-processors used by this website For the website itself, the following parties may process data on our behalf or as independent controllers: | Party | Role | Location | | --- | --- | --- | | GitHub, Inc. | Static site hosting (GitHub Pages), DNS routing, abuse protection | USA (EU-US DPF) | | Google Ireland Ltd. (Google Analytics) | Aggregated analytics; cookieless before consent, full GA4 after consent | EEA, with onward transfer to Google LLC (USA) under EU-US DPF / SCCs | The app-specific sub-processor list (Civo for backend infrastructure, OpenAI for AI inference, RevenueCat for subscriptions, Apple as App Store merchant of record, and others) is documented in the separate DokuAI app privacy policy. ## 5\. International data transfers Transfers to the United States (GitHub, Google) are covered by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR) and additionally by EU Standard Contractual Clauses where required. We rely on the providers' contractual safeguards and on supplementary technical measures (TLS in transit, anonymisation on the provider's side). ## 6\. Your rights Under GDPR you have the right to: - access the personal data we hold about you (Art. 15 GDPR) - rectification (Art. 16 GDPR) - erasure (Art. 17 GDPR) - restriction of processing (Art. 18 GDPR) - data portability (Art. 20 GDPR) - object to processing on grounds of legitimate interest (Art. 21 GDPR) - withdraw consent at any time, with effect for the future (Art. 7(3) GDPR) - lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR) — in the EEA EFTA states (Norway, Iceland, Liechtenstein) that is Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein). To exercise any of these rights, email [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za). ### 6.1 Additional regional rights - **California (CCPA/CPRA):** right to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and non-discrimination. We do not sell or share personal information for cross-context behavioural advertising. - **UK (UK GDPR):** equivalent rights to the EU GDPR list above. Supervisory authority: Information Commissioner's Office (ICO). - **Switzerland (FADP):** equivalent rights; supervisory authority: FDPIC (Bern). - **Canada (PIPEDA):** access, challenge accuracy, withdraw consent. - **Australia (Privacy Act):** access, correction, complaint to OAIC. - **Brazil (LGPD):** confirmation, access, correction, anonymisation/blocking/deletion, portability, information about shared data, consent revocation. ## 7\. Children's privacy This website is not directed at children. We do not knowingly collect personal data from children under 16 (or the applicable age of consent in your jurisdiction). ## 8\. Changes to this policy We may update this policy when the website's data flows change (for example if new analytics or hosting providers are introduced). The current version is always available at this URL with the effective date at the top. ## 9\. Contact DigitalFreedom, a brand of DigitalFreedom Global LLC 30 N Gould St, Ste N · Sheridan, WY 82801 · United States Data protection: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za) General: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za) * * * © 2025-2026 DigitalFreedom Global LLC. All rights reserved.