Privacy Notice

It's Basically Done: Privacy Notice Effective October 17, 2026. 1. Who we are Neurosonance, Inc. operates It's Basically Done at itsbasicallydone.com, app.itsbasicallydone.com and thisonelastthing.com with Jim Winner. This notice covers those services. Contact privacy@itsbasicallydone.com about your information or help@itsbasicallydone.com for support and legal notices. The program provides coaching and education about getting work finished. It does not provide medical care, psychotherapy, diagnosis or treatment. That does not make every answer nonsensitive. Information about your thinking, behavior and circumstances can be personal or sensitive, and applicable privacy rights still apply. 2. What we collect At the start, we collect your first name and email to send your return link and save your place. We then ask whether you are 18 or older, your country, and your state if you live in the United States. Adults in any country may sign up. The intake collects your selected answers, descriptions of your project and written responses. We keep your saved progress, consent choices, the version of each document you accepted, the acceptance time and the record that you reached the end of the Terms. We use your answers to generate your free Productive Stasis profile. We calculate the additional pattern scores and prepare internal personal notes only when you purchase or book a call, not simply because you completed the free intake or requested a call. If you buy a report, we keep the report, its delivery record and the related transaction identifiers and status. Our payment provider handles card information. We do not store full card numbers or security codes. If you request private work, we keep your request and any agreed call arrangements. We also keep communications you send us so we can respond. For paid members, we record when you first open your report and when you choose to record a move or use a practice. We use these records to show your 30-day clock, identify the next calendar event, and stop event follow-up emails after you take an action in the member area. The clock begins when you first open your paid report. We use your stored Productive Stasis pattern and SOMType direction to write the five scheduled check-in emails for your report. Those details stay inside this service and its necessary email delivery route. They are not sent to Google Analytics, Meta, or a separate email marketing platform. Paid check-in emails with a real deadline can display a countdown image from timer.jimwinner.com, a service we operate. The image address uses a random timer token. We give the timer service the finish date and an opaque reference, not your name, email address, project answers or profile. Your email app may request or preload the image. The service receives ordinary request information when that happens, including an IP address and request time. We do not treat image requests as proof that you opened or read an email, and we do not send them to Google Analytics or Meta. Emails sent before this change may still load their image from app.itsbasicallydone.com. The image links to your member calendar. Email apps can cache it or show only the first frame, so each message also states the finish date in text. Our web server records requests, including IP addresses, browser information, requested paths, times and response codes. If you start the free profile from a page about a particular kind of project, we also keep that page category with your intake so we can count which entrances lead to profiles. We use essential cookies and secure links to keep your place and control access. The five public entry pages and the post-payment thank-you page offer separate choices for Analytics and Marketing. Both are off until you choose them. If you choose Analytics, Google Tag Manager loads Google Analytics 4 to count entry-page views, free-profile starts and confirmed purchases. If you choose Marketing, Meta Pixel measures ad visits, free-profile starts and confirmed purchases. On the thank-you page, a purchase event contains an order identifier, the amount and currency. Google also receives a broad product category. Neither receives your name, email, intake answers, SOMType, project description or report. The thank-you page URL sent to a vendor contains no order identifier. Google and Meta also receive ordinary browser and request information. Google may set `_ga` and `_ga_*` cookies on the app domain, which default to two years but can expire sooner under browser rules. Meta may set an `_fbp` advertising cookie for about 90 days. Neither integration runs on the intake, checkout, profile or report pages. Our first-party choice cookie lasts up to 180 days. You can change your choices on an entry or thank-you page. Withdrawing a category stops its tag on the next page load and removes that category's app cookies. A browser Global Privacy Control signal keeps both categories off. Rejecting either category does not stop the free report or a purchase. Please describe your work in general terms. Do not include health records, diagnoses, passwords, account numbers, trade secrets or confidential information about other people. The paid-plan welcome explains how to use your report and the included check-ins. Check-in emails can include a short instruction from your dated plan and the following step, using saved task progress when available. The full report and personal exercises remain behind account access. An email can be forwarded or viewed by someone with access to your inbox, so these messages do not include your full assessment answers or report. No additional email tracking is added for these messages. 3. How we use it The paid-report workspace saves which sections you have viewed, tasks you mark complete, completion times, and task times you confirm. Viewing is recorded after active reading time and reaching a section's end. It is not proof that you understood the section or completed its task. Reading alone does not count as task completion or stop an action reminder. These records let you resume on another device and keep your report, calendar and member-area progress consistent. Your saved first name is used in the interface. For confirmed task times, our server requests a countdown from the same timer service described above. It sends an opaque reference and the due time, not your name, project text, assessment answers or report. The account page receives the remaining time through our server. It does not send viewing or completion events to advertising services. We keep account progress with your purchased service records, include it in your data download, and remove its account links when those records are deleted. The timer service can retain an unlinked opaque reference and deadline. Completing a task does not change your original Day 30 date or remove report access. We use your information to save your progress, deliver the profile and reports you request, arrange and prepare for agreed calls, provide support and protect the service from misuse. One intake supplies these services; you do not need to repeat your project answers after purchase. If you buy or book, Jim can review personal preparation notes within Neurosonance's secured administration area. The notes are not automatically sent to you. You can request the personal information in them. IBD does not automatically create a client record in a separate practitioner account or share your answers with other practitioners. By accepting the Terms, you authorize us to use your submissions to evaluate, validate, test, and improve the program, including its questions, scoring, and reports. This use is part of the exchange for the free Productive Stasis profile and is required to receive it. Promotional email is a separate use, described below. You may withdraw the research and improvement authorization at any time. After withdrawal, we stop future research and improvement use of information that identifies or can reasonably be linked to you. We may retain and use information already anonymized so that it can no longer reasonably identify or be linked to you. We do not attempt to reidentify it. Withdrawal does not undo research or improvements already completed. Basic service counts, such as completed intakes, help us operate the service. We send the service messages needed to deliver and support the project, such as your saved-place link, accepted Terms and report-ready notice. Incomplete-intake reminders include a way to turn them off. Where the law permits, we may also send promotional email about This One Last Thing and related work with Jim, including a follow-up after you start but do not finish checkout. United States recipients can stop these messages with the unsubscribe link in each promotional email or by contacting help@itsbasicallydone.com. Where local law requires prior consent, we send promotional email only after receiving the required permission. We do not send marketing text messages. Unsubscribing from promotion does not remove your access to a purchased report or stop essential service email. We do not enroll people who accepted an earlier version of this notice that required a separate promotional-email choice solely because this notice changed. 4. Who receives information We use Cloudflare Turnstile on public signup and sign-in forms to block automated abuse. Cloudflare processes technical signals, including your IP address and browser properties, for this security check and to improve its bot detection. Our server sends Cloudflare the verification token, not your name, email, intake answers or report. Security checks may be processed on Cloudflare's global network. This check is separate from optional analytics and marketing and runs when the form opens. We do not use its results to build advertising profiles. Cloudflare describes its processing at https://www.cloudflare.com/turnstile-privacy-policy/. Access within Neurosonance is limited to people who need it to provide or support this service. Service providers process information for hosting, encrypted storage, email, payment processing and security. Our current infrastructure includes a United States hosting provider and Amazon Web Services. SOMType's secured processing service helps generate the underlying profile. These services process only the information needed for their work. We do not sell or rent your personal information. When you choose optional Analytics or Marketing, Google or Meta receives the limited event information described above. Meta may use Pixel information for ad measurement and delivery, including activity across sites. You can withdraw either choice from the Privacy choices control. We do not publish your individual answers or send them to an email marketing platform. We may disclose information where law requires it, to respond to valid legal process, or where necessary to address fraud or a security incident. A business transfer would remain subject to applicable law and notice requirements; it is not permission to disregard your existing choices. 5. How long we keep it - Unfinished intake answers are deleted from live systems 30 days after your last answer. - If you complete the intake but never purchase or book a call, your intake record is deleted after 12 months. - Internal personal notes are deleted after 60 days if no call takes place. - Purchased reports and related service records remain available while needed to provide your purchase, subject to a deletion request and any legal retention requirement. When you request deletion, we remove your answers, profiles, reports and internal personal notes from live systems within 30 days and from archived and backup systems within six months. We prevent a recovery copy from putting deleted information back into ordinary use. A legal hold can extend retention; where permitted, we explain what is held, why and for how long. After deletion, we retain only information we must keep for legal, tax or accounting purposes, the limited record of the consents and Terms you accepted, and information already anonymized so that it can no longer reasonably identify or be linked to you. We do not attempt to reidentify anonymized information. The retained assent record does not include your intake answers. Operational logs are kept only as needed for security and troubleshooting, with longer retention only for a specific investigation or legal obligation. 6. Your choices and requests Use https://app.itsbasicallydone.com/my-data to request deletion or check an existing deletion request. No account is needed. We verify control of your email address before accepting a request. For access, correction, consent withdrawal or other privacy requests, email privacy@itsbasicallydone.com. We verify your identity before releasing personal information or changing someone else's records. You can request access to or correction of your personal information, deletion, withdrawal of the research and improvement authorization, an end to promotional email, and other rights that apply where you live. Where applicable, you may ask for a portable copy, object to or restrict processing, limit certain uses of sensitive information, or appeal a decision about your request by emailing us. We respond within the period required by applicable law and explain any permitted extension or exception. You may also contact the appropriate privacy regulator. We do not penalize you for exercising a privacy right, though we cannot provide or continue a service that requires information you ask us to delete or stop using. The Privacy choices control on entry and thank-you pages lets you reject, grant or withdraw optional Analytics and Marketing separately. These tracker choices are separate from accepting the Terms and from promotional-email preferences. Withdrawing a choice stops that tracker from loading on later visits. It cannot undo information already sent while it was allowed. The deletion page does not download your assessment questions or answers. We handle requests for access or a portable copy through our privacy contact, subject to applicable law and verification. This does not change your ability to download a report included in your service. For Washington and Nevada residents, the application applies additional restrictions before retrieving or combining practitioner material. Describing this program as coaching does not waive protections that state privacy law gives your information. 7. Security and location The application and its processing run on remote infrastructure in the United States. We use encrypted connections, encrypted intake and report storage, access controls and administrative authentication. Return and sign-in links should be kept private. No online service can promise perfect security. We will give legally required notices if an incident affects your information. If you use the service from outside the United States, your information is processed on our United States infrastructure. This notice does not remove rights that apply where you live, including access, correction, deletion, objection and complaint rights where applicable. Contact privacy@itsbasicallydone.com with questions about international processing or your rights. 8. Children, recordings and other sites We do not knowingly provide the intake to anyone under 18. Contact us if you believe a child supplied information so we can address it. The intake is written and does not record audio or video. It does not create a voiceprint or use a voice to identify you. Any separately agreed session recording would require advance notice and your agreement; this notice is not permission to record. Links to another website do not make its privacy practices part of this service. Review that site's notice before providing information there. 9. Changes We publish updates here with their effective date and provide additional notice when the law requires it. We ask for a new choice when required before changing a purpose that depends on your consent. A revised notice does not silently replace the record of what you previously accepted.