Privacy Policy

1. Who we are

Taskifier is made by xornoz labs LLC (“xornoz labs”, “we”, “us”). We are the controller of the personal data described in this policy, which means we decide how and why it's processed.

xornoz labs LLC
Email: privacy@taskifier.app

2. What this policy covers

This policy covers:

• the Taskifier iOS app, including its Home Screen widget;
• the Taskifier sync service at api.taskifier.app, used only when you sign in;
• Taskifier for the web at app.taskifier.app, once it's available;
• this website, taskifier.app.

Apple (the App Store, Sign in with Apple) and Google (Sign in with Google) have their own privacy policies, which apply to what they do with your data. See section 8.

3. Using Taskifier without an account

Accounts are optional. When you're signed out:

• Your tasks, repeating tasks and settings are stored only on your iPhone, in the app's own storage (shared with the Taskifier widget on the same device).
• The app makes no network requests to our servers. Nothing you type is sent to us, and we have no way to see it.
• Task alerts are local notifications scheduled by your iPhone. They aren't sent through any server, and the app doesn't use push notifications.
• The widget shows today's tasks on your Home Screen by reading the same on-device storage. It doesn't send anything anywhere.

Because this information never reaches us, we don't collect it.

4. Using Taskifier with an account

If you choose to sign in (with Sign in with Apple or Sign in with Google), Taskifier backs up your tasks and syncs them between your devices through our sync service. To do that we process the following.

Account information

We don't receive your Apple or Google password. Taskifier has no passwords of its own.

Your tasks

While you're signed in, the following are stored on our server and synced to your signed-in devices:

• each task's title, day, whether it's done, its priority, whether it carries over, and its position in the list;
• repeating tasks: the repeat rule, the days it starts and ends, and its title, priority and position;
• technical fields used to sync correctly: a random identifier for each task, and when it was created, last changed or deleted.

Task alert times stay on your device and are not synced. Your app settings (appearance, sort order and similar) also stay on your device.

Sessions

When you sign in we create a session so you stay signed in. We store a session record (which account and sign-in it belongs to, whether it's the iOS app or the web app, and when it was created and expires) and a one-way hash of your session's refresh token, never the token itself. Short-lived access tokens (valid for up to 15 minutes) are kept only in the app's memory and are never stored on our server.

On your iPhone, the refresh token is stored in the iOS Keychain and only on that device. In the web app, it's kept in a secure cookie (see section 16).

Technical and request data

• IP address. When you sign in, refresh a session or sign out, we use your IP address to limit the number of attempts (rate limiting), to protect the service from abuse. Our code doesn't store your IP address.
• Error logs. When something goes wrong, our server may log your account ID and an error code. Our logging rules forbid logging task titles, tokens or email addresses.
• Hosting logs. Our hosting provider, Cloudflare, processes request information (such as IP address, time, request path and response status) to deliver the service, keep it secure and provide us with logs. Cloudflare retains request and observability logs according to its platform defaults, then deletes them.

Messages from Apple

If you signed in with Apple, Apple may notify our server when you stop using Sign in with Apple with Taskifier, delete your Apple account, or change your email forwarding preferences. We use these notifications to sign you out, delete your Taskifier sign-in, or update your private relay status.

5. What we don't collect

• No passwords, phone numbers or postal addresses.
• No payment information. Taskifier doesn't currently offer in-app purchases.
• No location, contacts, photos, health data or browsing history.
• No advertising identifiers. Taskifier doesn't track you across apps or websites and doesn't ask for tracking permission.
• No analytics, crash-reporting or advertising software from third parties in the app or on this website.

Apple may give us aggregated, anonymized App Store and app-performance statistics (for example, downloads and crash reports from people who chose to share them with developers), under Apple's own privacy terms.

6. Legal bases (EEA, UK and Switzerland)

If data protection laws such as the GDPR or UK GDPR apply to you, we rely on these legal bases:

• Performance of a contract (Art. 6(1)(b)): to create and run your account, store and sync your tasks, keep you signed in, and delete your account when you ask. This is the service you sign up for.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure and working (rate limiting, error logs, hosting logs), and to handle Apple's account notifications. Our interest is providing a reliable, secure service; we keep this processing minimal.
• Legal obligation (Art. 6(1)(c)): when we must keep or disclose information to comply with the law.
• Consent (Art. 6(1)(a)): where we ask for it. For example, the app asks your permission before showing notifications (which are scheduled on your device). You can withdraw consent at any time in your device settings.

Signing in is never required. If you don't want us to process account and task data, you can keep using Taskifier signed out.

7. Where your data is stored

If you sign in, your account and task data are stored in a database on Cloudflare D1 and processed by our sync service running on Cloudflare Workers. Cloudflare runs a global network, so requests may be handled in data centers close to you.

On your devices, data is stored in the Taskifier app's storage on your iPhone (and, for the web app, in your browser's local storage).

8. Service providers and sharing

We don't sell your personal information, and we don't share it for advertising. We only share it with the providers needed to run Taskifier:

When you use Sign in with Apple or Sign in with Google, you deal directly with Apple or Google, under their privacy policies: Apple Privacy Policy, Google Privacy Policy. Cloudflare's policy is at cloudflare.com/privacypolicy.

We may also disclose information if required by law or a valid legal request, to protect the rights, safety or security of our users or others, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to your data.

9. How long we keep data

10. Deleting your account

You can delete your account from inside the app: open Settings (pull down on a day to add a task, then tap Settings at the top right), go to the Taskifier Cloud section and choose Delete Account. When you do:

• your account, sign-ins, sessions, tasks and repeating tasks are permanently deleted from our database in one step;
• if you signed in with Apple, we ask Apple to revoke Taskifier's access to your Apple ID;
• in the web app, the sign-in cookie is cleared;
• you choose whether to keep a copy of your tasks on the device you're using, as signed-out local tasks, or remove them.

You can also stop using Sign in with Apple for Taskifier in your Apple ID settings, or delete your Apple account. Apple then notifies us and we remove that sign-in (and the whole account, if it was your only sign-in) or sign you out.

Signing out ends your session on that device but doesn't delete your account or your synced tasks.

If you can't access the app, email privacy@taskifier.app and we'll help.

11. Your rights

Depending on where you live (for example, in the EEA, UK or Switzerland under the GDPR or UK GDPR), you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data (you can do this yourself in the app, see section 10);
• port your data, receiving it in a structured, machine-readable format;
• object to or restrict processing based on our legitimate interests;
• withdraw consent at any time, where we rely on consent;
• complain to your local data protection authority.

Your tasks are visible to you in the app at all times. To make any other request, email privacy@taskifier.app. We may need to confirm the request comes from the account holder, for example by asking you to write from the email address on the account. We'll respond within the time the law requires (generally one month under the GDPR).

To get a copy of your data, email privacy@taskifier.app. There's no in-app export yet; after verifying the request comes from you, we'll send you a copy of the account and task data we store within the time the law requires (generally one month under the GDPR).

12. California residents

If the California Consumer Privacy Act, as amended by the CPRA, applies, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for exercising these rights.

• Categories collected (only if you sign in): identifiers (name, email address, account ID, sign-in provider identifier), and the content you create (your tasks). Internet activity limited to the request data described in section 4.
• Sources: you, Apple or Google (when you sign in), and your devices.
• Purposes: providing your account and sync, security, and complying with the law.
• Disclosed to: our service providers listed in section 8, for business purposes only.
• We do not sell or share personal information (including for cross-context behavioral advertising), and we haven't in the past 12 months. We don't use or disclose sensitive personal information for purposes that would give you a right to limit it.

To make a request, email privacy@taskifier.app. You may use an authorized agent; we may ask for proof of their authorization and to verify your identity.

13. Children

Taskifier is a general productivity app and isn't directed at children under 13 (or the minimum age in your country). We don't knowingly collect personal data from children. If you believe a child has created an account, contact us and we'll delete it. Children can use Taskifier without an account, in which case no data is sent to us.

14. Security

We protect your data with measures including:

• encryption in transit: our services are available only over HTTPS, with HTTP Strict Transport Security;
• refresh tokens stored on our server only as one-way hashes, and short-lived access tokens that are never stored;
• Apple refresh tokens encrypted (AES-GCM) in our database;
• on iPhone, your session kept in the iOS Keychain, on that device only;
• in the web app, the session cookie is HttpOnly, Secure and SameSite=Strict, so page scripts can't read it;
• rate limiting on sign-in and sync, and a rule against logging task titles, tokens or email addresses.

No system is perfectly secure. If we learn of a breach affecting your personal data, we'll notify you and the authorities as the law requires.

15. International transfers

xornoz labs LLC is based in the United States, and Cloudflare operates data centers around the world. If you're outside the United States, your data may be transferred to and processed in the United States and other countries whose data protection laws may differ from yours.

Where the GDPR or UK GDPR applies, we rely on Cloudflare's Data Processing Addendum, its Standard Contractual Clauses and UK Addendum, and Cloudflare's Data Privacy Framework certification where applicable.

16. Cookies and local storage

• This website (taskifier.app) uses no cookies, no analytics and no third-party scripts or fonts.
• The iOS app uses no cookies.
• The web app (app.taskifier.app), when available, uses one strictly necessary cookie, __Host-tf_refresh, set by api.taskifier.app only after you sign in, to keep you signed in. It's HttpOnly, Secure and SameSite=Strict, and expires after 90 days without use. It isn't used for tracking or advertising. The web app also keeps your tasks, sync state and settings in your browser's local storage (never your sign-in tokens), and only loads Google's and Apple's sign-in scripts when you open the sign-in screen.

17. Changes to this policy

We'll update this policy when Taskifier changes how it handles data, and change the “last updated” date above. If a change is significant, we'll give you notice before it takes effect, for example on this page or in the app.

18. Contact us

Questions, requests or concerns about privacy:

xornoz labs LLC