Privacy Policy

When you create an account through our authentication provider (Clerk), we receive your email address, your name where you provide it, and any other profile fields you enter.

When you use TaskPilot, we store the content you create: tasks, projects, life areas, tracker entries (weight, walking, notes), contacts, scorecard data, your bio, AI memory notes you choose to save, and the timestamps and outcomes of your completions.

We log basic technical information about each request (IP address, user agent, request timestamp, response status) for operational security and abuse prevention.

We collect your account information to authenticate you and to identify your workspace. We store the content you create because that is the service: TaskPilot only works if it can hold the data you put in. We collect operational logs to keep the service running, secure, and accountable.

We do not sell your data. We do not show you advertising. We do not build profiles for third parties.

To operate TaskPilot we use the following third-party services. Each processes only the data necessary to do its job.

• Clerk— authentication. Stores your email, name, and session tokens. US-based.
• Neon— managed Postgres database. Stores all the content you create in TaskPilot. Region selected to balance latency and data residency.
• Vercel— hosting and content delivery for the TaskPilot application. Processes requests and serves the site.
• Anthropic— AI features, where you have enabled them. Receives the prompts we send (which include your bio and recent task context). Used only for the duration of a request.
• OpenAI— AI features, where you have chosen OpenAI as the provider. Same treatment as Anthropic.

We may add or change subprocessors as the product matures. Material changes will be reflected in this policy with a new “last updated” date.

Data may be stored or processed in the United States, the European Union, or Australia depending on the subprocessor. If you have specific data residency requirements, contact us before signing up.

We retain your data while your account is active. If you delete your account, we delete or anonymise your content within 30 days, except where retention is required for legal, accounting, or security purposes (for example, audit logs of authentication events, which we retain for up to 12 months).

You can also delete individual tasks, projects, contacts, and tracker entries through the app at any time.

Under the Australian Privacy Principles and equivalent frameworks you have the right to:

• Access the data we hold about you.
• Have inaccurate data corrected.
• Delete your account and the data associated with it.
• Export your data in a portable format.
• Object to processing or withdraw consent for optional features such as AI.
• Complain to us, and to your local privacy regulator (in Australia, the OAIC).

To exercise any of these rights, email ishtiaque.tg@gmail.com. We will respond within a reasonable timeframe.

We use HTTPS for all traffic, encrypt secrets at rest where the underlying platform supports it, and apply the principle of least privilege to internal access. No system is impenetrable. If we become aware of a breach that affects your data, we will tell you and the relevant regulator as required by law.

We use a small number of cookies and similar storage mechanisms (such as localStorage) to keep you signed in, remember your display preferences, and run the offline service worker. We do not use third-party advertising or tracking cookies.

TaskPilot is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has signed up, contact us and we will delete the account.

We may update this policy. If a change is material, we will give notice through the app or by email. The “last updated” date at the top of this page reflects the most recent change.

Privacy questions or complaints? Email ishtiaque.tg@gmail.com.