Privacy Policy

At TaskFlow we take your privacy very seriously. This Privacy Policy describes how we collect, use, store, and protect your data when you use our web application and related services.

TaskFlow is currently a free service. There is no paid subscription or specific business entity associated with it at this time. For privacy, security, or legal matters, you can contact us at todotask95@gmail.com.

TaskFlow is designed under an offline-first approach (local priority). This means that the type and amount of data we collect directly depends on the usage mode you choose:

• Local Mode (offline-first by default): If you use the application without signing in, everything you create (projects, tasks, tags, notes, goals, and time logs) is stored only in your browser's local storage, using localStorage and IndexedDB. We do not collect, transmit, or store that data on our servers.
• Synchronized Mode (with a user account): If you choose to sign in, we process authentication data provided through Supabase and Google OAuth, such as your user ID, email address, and, when available, your profile name or avatar. TaskFlow never receives or stores your Google password. Your productivity data and saved assistant personal context are also synchronized and stored on our cloud infrastructure through Supabase so you can access them from multiple devices.
• AI Functions: If you use the AI assistant or notes-to-markdown conversion, we may process the messages, instructions, notes, personal context, and productivity data you choose to include in the request. This data is sent to the user-configured AI provider (currently OpenRouter) to generate the requested response. Depending on the model you select, OpenRouter may send the request to the final model provider. If you choose to save your OpenRouter key in Synchronized Mode, we store it encrypted in Supabase to be used in future requests.
• Support: If you write to us by email, we will process your email address, the content of your inquiry, and any technical information you voluntarily include to reply to you.

We use your information only for these purposes and under these lawful bases:

We do not sell, rent, or share your personal data with third parties for commercial or marketing purposes.

We implement rigorous technical and organizational security measures to safeguard your information:

• All data transfer between your browser and our servers is performed using secure encryption protocols (HTTPS/TLS).
• In Synchronized Mode, the database and authentication are managed through Supabase, which complies with leading industry physical and logical security standards.
• Access to your synchronized data is strictly protected using Row Level Security (RLS) policies in the PostgreSQL database, designed to restrict access to your own information, without prejudice to technical access strictly necessary to operate, secure, or resolve issues with the service.

To provide the service we use technology providers that may act as data processors or independent providers as applicable:

• Supabase: authentication, database, storage, and synchronization when you use an account or remote functions.
• Google: OAuth authentication provider when you choose to continue with Google. They may provide us with your email, account identifier, and basic profile data depending on your Google account settings.
• Vercel: hosting, deployment, infrastructure security, and aggregate analytics if you explicitly accept them.
• OpenRouter: AI model access provider when you configure an API key and use the AI functions. Content sent to OpenRouter may include personal data if you include it in your notes, tasks, messages, or context. Depending on the model chosen, the request may also be processed by the final model provider. If you save the API key in Supabase, TaskFlow encrypts it before storing it.

These providers may process data outside the European Economic Area. In that case, the safeguards available under the GDPR, such as standard contractual clauses or other legally recognized mechanisms, will apply.

Under the General Data Protection Regulation (GDPR) and similar laws, you have rights regarding your information, which you can exercise within the application where available or by writing to todotask95@gmail.com:

• Access and Portability: You can export at any time all your projects, tasks, notes, and historical data in a readable and structured JSON format from your account settings panel.
• Modification and Rectification: You can edit or update any of your data directly from the application's user interface.
• Right to be Forgotten (Deletion): You have the ability to permanently delete your account from the application settings panel. Upon doing so, we will delete the data associated with your account on our servers, except for those that must be temporarily retained for legal obligations, security, abuse prevention, technical troubleshooting, or backups.
• Limitation, objection, and withdrawal of consent: You can request that we limit processing, object when appropriate, and withdraw your consent for cookies or optional features without affecting the lawfulness of prior processing.

If you feel we have not properly addressed your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

We retain synchronized data as long as you maintain an active account or until you request its deletion. Local data remains in your browser until you clear, export, overwrite, or delete the browser's local storage. Support data will be retained for the time necessary to manage the inquiry and, as reference, up to 12 months unless there is a legal obligation or open issue that justifies a longer period. Technical security and abuse limitation logs are kept for short periods proportional to their purpose; for example, AI usage limit counters reset automatically in short temporal windows. Technical backups, if they exist, are kept only during the ordinary backup and restore cycle, normally up to 90 days.

We use essential cookies and equivalent local storage technologies for site operation and session management. Optional analytics only load if you explicitly accept them. For more information on the use of cookies, similar technologies, and how to change your preferences or withdraw consent, see our Cookie Policy.