Privacy Policy — Tasktastic

Who we are

Tasktastic ("we", "us", "our") provides this service. If you have a question about this policy or your data, contact us at privacy@tasktastic.app.

Information we collect

We collect only what we need to run the service:

Your Google account basics. When you sign in with Google, we receive your name, email address and profile picture so we can create and display your account.
The Google Tasks content you use with Tasktastic. This includes the lists and tasks you view through Tasktastic, and — for lists you choose to share — their titles, notes, due dates, completion state and subtasks. This is what we synchronise so that every member of a shared list sees the same thing.
Google authorisation tokens. To read and manage your Google Tasks, we hold an OAuth access token and refresh token for your Google account. These are stored in an encrypted token vault and are never shown to other users.
Service and diagnostic data. We collect technical information such as the type of device and browser, error reports and performance measurements. This data does not include your email address or the contents of your tasks.

The waitlist

Tasktastic is in a closed beta. If you join the waitlist on our website we collect the email address you type in, and nothing else about you. We use it only to email you when there is a place for you, and to answer you if you write to us about it.

The waitlist form is run for us by Headless Forms (headlessforms.cloud), which stores your submission and sends it to us. We do not use waitlist addresses for advertising and we do not sell them. We keep your address until you have been invited and have signed up, or until you ask us to remove it, whichever is sooner. To be removed, email support@tasktastic.app.

How we use your information

To sign you in and create your account.
To display your Google Tasks and to mirror changes to and from the people a shared list belongs to.
To send service emails, such as invitations to a shared list.
To keep the service secure, diagnose faults and improve reliability.

Under UK data protection law, we rely on the following bases: the performance of our contract with you (providing the service), your consent (connecting your Google account), our legitimate interests (keeping the service secure and working), and legal obligations where they apply.

Google user data

Tasktastic's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We only request the Google Tasks permission we need to provide the service. We do not sell your Google data, we do not use it for advertising, and we do not use it to train machine-learning models. Human access to your Google data is limited to what is required for security, support or legal reasons.

How we store and protect your data

Shared list data is held in Microsoft Azure, in a database that is encrypted at rest and in transit. Google authorisation tokens are held in an encrypted token vault provided by our authentication provider and are accessed only by the parts of the service that need them. Access to production systems is restricted and logged.

We may transfer and store data in countries outside the United Kingdom. Where we do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the standard contractual clauses.

When we share information

We do not sell your personal data. We share it only:

with the other members of a list you share, as needed for the service to work;
with the providers that run the service on our behalf, including Microsoft Azure (hosting, database and email delivery), our authentication provider (sign-in and token storage), Google (Tasks and sign-in), our error-monitoring provider and our waitlist form provider; and
where we are required to by law, or to protect the rights and safety of Tasktastic and its users.

How long we keep it

We keep your information while your account is active. If you ask us to delete your account, we remove your personal data and the shared-list data you own, except where we must keep something to meet a legal obligation. Backups are cycled out within 30 days.

Your rights

You can ask to access, correct, delete or export your personal data, and you can object to or ask us to restrict certain processing. You can also revoke Tasktastic's access to your Google account at any time from your Google account permissions. To make a request, email privacy@tasktastic.app. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ICO).

Cookies

The marketing website does not set advertising or tracking cookies. The Tasktastic app stores a small amount of data in your browser so that it can keep you signed in and work as an installable app. None of it is used to build an advertising profile.

Children

Tasktastic is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us their data, contact us and we will delete it.

Changes to this policy

We may update this policy as the service changes. When we do, we publish the new version number and the date it took effect at the top of this page. If a change is significant, we will make that clear on the website or by email.

Contact

Questions about this policy or your data? Email privacy@tasktastic.app or support@tasktastic.app.