Donut is a private, single-user service. The "user" referred to
below is the individual owner of this instance.
Data we receive
WhatsApp messages and voice notes sent to or from the
assistant, delivered via Twilio.
Profile name and phone number as provided by Twilio
with each inbound message.
Google Calendar events from calendars the user has
explicitly chosen to connect, fetched read-only via the
Google Calendar API.
OAuth refresh tokens issued by Google, encrypted at
rest with a key never sent off-host.
How we use it
Conversational context for generating replies (sent to OpenAI's API
under their data-use policy, which prohibits training on API
traffic by default).
Voice-note synthesis using a locally-hosted text-to-speech model;
audio never leaves the host except as the WhatsApp reply itself.
Persistent storage of message history and calendar selection in a
private SQLite file on the user's own server.
Sharing
We do not sell, rent, or share data with third parties. The processors
named above (Twilio for messaging transport, OpenAI for generation,
Google for calendar reads) receive only what's necessary to perform
their function, and only at the user's direction.
Retention
Messages and calendar selections are retained until the user clears
them (e.g. via the in-app !reset command or by disconnecting
the calendar). OAuth tokens are deleted on disconnect.