Privacy policy

1. Who runs LooksDone

LooksDone is run by Youssef Dhibi, an individual based in Tunisia. It is not a company. In this policy, “LooksDone”, “we”, “us” and “our” mean him.

This policy covers the website at looksdone.app, the LooksDone app at dashboard.looksdone.app, and the review script that site owners add to their websites. Using LooksDone is covered by the Terms of service.

For any question about this policy or your data, email dhibi.ywsf@gmail.com.

2. Who is responsible for which data

LooksDone holds two kinds of data, and the responsibility differs.

• Your account. Your name, email address, photo and sign-ins. We decide how this is used, so we are responsible for it (in GDPR terms, the controller).
• What is in a workspace. Projects, site addresses, invitations, comments, screenshots and task history belong to the workspace’s owner. The owner decides who can see them and when they are deleted, and we store and process them on the owner’s behalf (in GDPR terms, as a processor).

If you comment as a client in someone else’s workspace, your comments are part of that workspace. You can ask its owner about them, or ask us and we will help.

3. What we collect

Your account

LooksDone has no passwords. You sign in with Google, and Google shares your name, email address, profile photo and Google account ID with us. We ask Google for your basic profile and email address only, never for access to your Gmail, Drive, contacts or calendar. We also keep the sign-in tokens Google issues, and use them only to connect your Google account to LooksDone.

Sign-ins

For each sign-in we record when it started, your IP address and your browser’s user agent (a line of text that names the browser and system). We use this to keep you signed in and to notice misuse.

Workspaces and projects

We store the names of your workspaces and projects, the website addresses you add to a project, its key, who is a member, their role, which projects each member can open, and invitations: the invited email address, who sent the invitation and the access it gives.

Reviews

When someone opens a review on a website and leaves feedback, we store:

• The comment. Its text, replies, the shape drawn (pin, box, ellipse, arrow or area) with its color and position, who wrote it and when, and its status and assignee as a task.
• Where it belongs on the page. The page’s address and title, and a description of the commented element: where it sits in the page’s structure, plus one-way codes (hashes) made from its text. The text itself never leaves the reviewer’s browser, and text in form fields is never read for this.
• Screenshots. One of the area around each comment, and one of the top of each page reviewed. They show the page as it appears on the reviewer’s screen, including anything typed into visible form fields. Avoid reviewing pages that show information your workspace should not see.
• The device it was written on. The browser and its version, the operating system, the window size, the screen’s pixel ratio and the browser’s user agent.
• Workspace activity. A history of what happened (“Sam resolved a task”) and notifications for the people involved.

Visitors of websites that use LooksDone

When you visit a website that has the LooksDone script installed, your browser downloads the script from our server, as it does for any file on the web. Our server receives your IP address and browser details as part of that request, uses them only to send the file, and does not store or log them.

The script then checks whether this browser tab has opened a review from LooksDone. If it has not, the script stops there: it shows nothing, sets no cookies, stores nothing on your device and sends no further requests.

This website

looksdone.app uses no analytics, no cookies and no third-party scripts or fonts. The server that delivers it receives your IP address in order to send you the pages, and we do not keep logs of visits.

When you write to us

If you email us, we keep the emails and the address you wrote from so we can answer.

What we do not collect

We collect no payment details (LooksDone is free), no advertising identifiers, and nothing from other Google services.

4. Why we use it

Where data protection law asks for a legal basis, these are ours.

• To provide LooksDone, because it is necessary for our agreement with you: signing you in, showing your workspaces, saving and syncing comments live, showing screenshots and checking who can open which project.
• To keep LooksDone secure and working, because we have a legitimate interest in doing so: limiting how often requests can be made from one IP address (these counts are kept in memory and never stored), investigating errors and stopping abuse.
• To answer you when you write to us.
• To meet legal obligations, when the law requires it.

We do not use your data for advertising or profiling, we do not sell it, and we do not use it to train AI models. LooksDone sends no emails of any kind, including newsletters.

5. Who can see it

• People in your workspaces. Members see the names and photos of the people in the workspace, and the comments, screenshots, device details and activity of the projects they can open. The workspace owner also sees members’ email addresses and pending invitations.
• Our hosting provider. Contabo GmbH (Germany) runs the server that holds the database and the screenshots.
• Google, which handles sign-in. When LooksDone shows your profile photo, your browser loads it from Google’s servers.
• Authorities, only when the law requires us to share data, and only the data required.

If LooksDone is ever transferred to someone else, your data would go with it under this policy, and we would tell you in the app beforehand. We never sell personal data.

6. Where it is stored

The database and the screenshots are stored on a server in Germany, in the European Union, rented from Contabo GmbH. LooksDone is run from Tunisia, and its operator connects to that server from there to maintain the service and to answer support requests.

7. How long we keep it

• Your account stays until you delete it in Settings. Your name, email address, photo, Google connection and sign-ins are then erased straight away. Comments you wrote in other people’s workspaces stay there as part of their work, shown as written by “Deleted user”.
• Workspace content stays until its owner deletes it. Deleting a project or a workspace removes everything in it, screenshots included, straight away. Deleting a comment removes it from LooksDone and erases its screenshot straight away. Its text is kept out of sight until the project is deleted, so the task history stays consistent.
• Sign-ins end when you sign out, or after 7 days without using LooksDone. A link that opens a review expires after 90 seconds, and a review session after 45 minutes.
• Invitations stay until they are accepted, declined or withdrawn.
• Error logs are kept for up to 30 days. They never contain passwords, tokens or cookies.
• Backups, when we make them, are replaced within 30 days, so deleted data leaves them within that time.
• Emails with us are kept for up to two years after the conversation ends.

8. How we protect it

• Every connection is encrypted with HTTPS.
• There are no passwords to leak: sign-in goes through Google.
• Review links and review sessions are stored only as one-way hashes, and a review session lives only in the browser tab that opened it.
• Every request checks that you belong to the workspace and can open the project. Reviews open only on the website addresses added to the project.
• Logs leave out passwords, tokens and cookies.

No system is perfectly secure. If a breach affects your data, we will tell you, and the authorities where the law requires it, without undue delay.

9. Cookies and storage in your browser

• The LooksDone app sets one cookie that keeps you signed in, and short-lived cookies while you sign in with Google. It also remembers a few choices in your browser’s local storage: whether the sidebar is folded, the last workspace you opened and the platform you picked in the install guide.
• A review on a website keeps its session in that tab’s session storage. It is gone when the tab closes, or after 45 minutes.
• This website sets nothing.

All of these are needed for LooksDone to work. There are no advertising or analytics cookies, which is why there is no cookie banner.

10. Your rights

Depending on where you live (for example under the GDPR in the European Union and the United Kingdom, or Tunisia’s Organic Law No. 2004-63 on personal data), you can ask us to:

• give you a copy of your personal data, in a format you can take elsewhere;
• correct it;
• delete it;
• stop or limit how we use it, or object to a use;
• withdraw consent you gave, where we relied on it.

You can delete your account yourself in Settings. For anything else, email dhibi.ywsf@gmail.com from the address on your account. It is free, and we answer within 30 days. If the data is in someone else’s workspace, we may ask its owner to act, since it is their data to manage.

If you think we have mishandled your data, please tell us first so we can fix it. You can also complain to a data protection authority: in Tunisia, the Instance Nationale de Protection des Données Personnelles (INPDP); in the European Union, the authority of the country you live in.

11. Children

LooksDone is a tool for work and is not meant for anyone under 16. If we learn that someone under 16 has an account, we delete it.

12. Changes to this policy

When this policy changes, the date at the top changes too. If a change affects how your data is used, we will show a notice in the app before it takes effect.

13. Contact

Youssef Dhibi, Tunisia: dhibi.ywsf@gmail.com