Privacy Policy
Last updated: October 2026
This policy explains how Donnish Pty Ltd handles personal information, including on this website, our phone line and Donnish App Health.
Who we are
Donnish Pty Ltd is based in Queensland, Australia. The Privacy Act and the Australian Privacy Principles apply to how we handle personal information.
The laws in force in Queensland apply to this policy. Our terms and conditions apply to your use of this website. Nothing in an agreement with us reduces your rights under the Privacy Act.
What we collect
When you contact us
When you use our contact form or email us, we collect what you give us. That is usually your name, email address, phone number and what you need help with. If you send us a CV, we keep that too.
When you send the contact form, we also record your IP address, your browser details, your approximate location based on your IP address, and the page you came from. We use these to stop spam and to see how people find us.
If you subscribed to updates from us, we keep your email address and the IP address and browser you subscribed from.
When you call us
Our phone line is answered by an AI receptionist run by Synthflow. Calls are transcribed and may be recorded. We keep your phone number, the transcript, any recording and the details of your enquiry.
When you use this website
We and our providers collect technical information such as your IP address, browser, device and the pages you visit. The section on cookies, analytics and session recordings explains how.
When you use Donnish App Health
If you use Donnish App Health, or we send you an App Health report, the Donnish App Health section below explains what we collect.
From other people
We also get information from other people, such as a client giving us a contact name, and from public sources.
How we use it
- To reply to you and provide our services
- To run, secure and fix this website and Donnish App Health
- To stop spam, fraud and misuse
- To understand how people use this website and to measure our advertising
- To meet our legal obligations
We do not sell your personal information.
Cookies, analytics and session recordings
On your first visit we ask whether you accept analytics and advertising cookies. You can change your choice at any time with Cookie Preferences in the site footer.
We use these tools:
- Google Analytics counts visits and enquiries. Until you accept, it runs without cookies. Whether or not you accept, when someone sends the contact form our server tells Google an enquiry was made, with the rough location and the page it came from, but not the name or contact details.
- Microsoft Clarity and PostHog record how people use our pages, such as clicks, scrolling and what is on screen. These are session recordings. Both are set to hide what you type into form fields. They record your visit whether or not you accept. If you decline, PostHog does not recognise you on your next visit, but Clarity may still use its own cookies to do so.
- X (Twitter) runs an advertising tag, which loads only if you accept. If you arrive from an ad on X, we save X’s click reference in our own cookie, whether or not you accept. We only send it to X if you have accepted. If you have accepted and you then send us an enquiry, we may also send X a hashed copy of your email address and phone number, which X matches to its own users to tell us whether its ads work.
- Cloudflare Turnstile, on pages with our contact form, and Vercel BotID, across the site, check that a visitor is a person and not an automated script. They run whether or not you accept, because they keep the site secure, and they may set their own cookies.
These providers may also use what they collect under their own privacy policies, including for advertising.
Some cookies and browser storage are needed for the site to work, such as the one that remembers your cookie choice. These are always on.
Donnish App Health
Donnish App Health is our software for checking the health of an application and tracking the fixes. Our staff use it, and we may give access to developers at our clients.
Your account
You sign in with a Google account we issue. We store your name, work email address, account status and role, which version of our terms you accepted, and your GitHub username if you add it. A cookie keeps you signed in.
We log what you do in App Health, such as changes to findings, and each time you sign in or out, with your IP address and browser details. If someone tries to sign in and is refused, we record the email address, IP address and browser they used.
Coding agents
You can connect a coding agent, such as Claude Code. We store a hashed copy of its access token, which we cannot read back, along with the agent’s name, what it is allowed to do and when it was last used. We log what the agent does for you: your email address, the agent, the action, the time and a short summary. Notes your agent writes are saved with the item they are about.
If you connect your own agent, its provider handles what you send it under your agreement with them.
Connected Jira and GitHub accounts
Donnish, not Atlassian or GitHub, is responsible for the privacy, security and integrity of the information Donnish App Health handles from your connected accounts.
You can choose to connect your own Atlassian (Jira) or GitHub account. We store encrypted access tokens, your Atlassian account ID and name or your GitHub username, the access you granted, and when. We only use them to act for you in Jira or GitHub. If we post to Jira or GitHub for you, we log it and the account it was posted as.
App Health can also keep your GitHub access in an encrypted cookie in your browser, so it can create issues and comments for you. It lasts until you remove it from the App Health connections page or it expires. You can cancel our access at any time in your GitHub settings.
You can disconnect an account at any time from your App Health account page. We remove its tokens from App Health straight away, and also if your App Health account is suspended or removed. When you disconnect Jira, we also remove your Atlassian name. We keep your Atlassian account ID with the record of the connection and the activity log, without the tokens, so there is a record of who did what. Older copies in our database backups expire with those backups.
When you disconnect GitHub from your account page, we also ask GitHub to cancel our access. Atlassian does not let us do that, so after you disconnect Jira, remove Donnish App Health under Connected apps at id.atlassian.com.
We regularly tell Atlassian which Atlassian accounts we hold information about, as Atlassian requires. If Atlassian tells us an account has been closed, we delete or de-identify what we hold for it, including in our activity log. If Atlassian tells us an account has changed, we update or remove the name we hold.
Who can see it
People with App Health access, including our staff, may see the activity log. It shows who did what and when, with their email address and sign-in details.
Clients and their applications
We keep contact details for the people at our clients we work with and send reports to.
When we check a client’s application, our checks read the code and settings and do not change them, and we record what we find. If a client asks us to fix something, we may work on a copy of their code. Findings can include people’s names and email addresses, for example from code comments or commit history. We use this information for that client’s work, as our agreement with that client allows.
Who we share it with
We use these providers to run our business. They handle personal information for us:
- Vercel hosts this website and Donnish App Health
- Neon runs our databases on Amazon Web Services. Website enquiries and call records are stored in Sydney, Australia. Donnish App Health data is stored in the United States
- Google Workspace and other everyday business tools hold our email, documents and records
- Resend sends our email, including enquiry notifications, and may send App Health reports
- Slack carries our internal alerts, including new enquiries and calls
- Synthflow runs the AI receptionist on our phone line
- Google, Microsoft, PostHog and X provide analytics and advertising, as described above
- Cloudflare, Vercel and rate-limiting providers protect the site from spam and abuse
- Sentry receives error and performance reports, which can include your browser details, the page you were on and what you sent in a form
- GitHub and Atlassian host our code and work tracking, and provide App Health’s connected accounts
- AI tools, such as Claude, that we and our staff use to help with our work
We may also share information when the law requires it, to protect our rights or safety, with our professional advisers, or if we sell or restructure our business.
Overseas
Most of these providers are in the United States or keep data there, and some may handle it in other countries. Our website runs on servers in the United States, so what you send us passes through there, and Donnish App Health data is stored there. Copies of enquiries also sit with our email, chat and call providers. Some of our team work from Manila in the Philippines, and they can access this information to do their work.
Security and keeping information
We take reasonable steps to protect personal information. No system is completely secure.
We keep personal information for as long as we need it for our business or the law requires.
If we have a data breach that the Privacy Act requires us to report, we will notify you and the Office of the Australian Information Commissioner as it requires.
Access, correction and complaints
You can ask us what personal information we hold about you, and ask us to correct or delete it. We may need to confirm who you are. Copies may stay in backups for a while. If the law lets or requires us to keep information or refuse a request, we will tell you why.
If you have a complaint about how we have handled your information, contact us first. We will look into it and reply to you. If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
We may update this policy. The current version is on this page, with the date it last changed.
Contact us
For a privacy question, request or complaint, contact us:
- Post
- Level 1, 888 Brunswick Street, New Farm, QLD, 4005 Australia