Who we are
TaskDriver ("TaskDriver", "we", "us") is built by independent productivity nuts for people who want to get more done. This policy covers the TaskDriver web app at app.taskdriver.io, our mobile apps, our API, and this website.
TaskDriver is an independent project rather than a registered company. Nir Cohen decides how the personal data described in this policy is handled and is responsible for it, and can be reached at im@nir.earth — for a question about this policy, or for any request under Your rights.
What we collect
Account information
When you create an account we store your email address, your display name, and your authentication state. Sign-in is handled by our identity provider, Descope; we do not see or store your password, and if you sign in with Google we receive only your email address and basic profile details.
The content you put in TaskDriver
Your tasks, spaces, notes, comments, attachments, recurrence rules and preferences. This is yours. We store it so the product can show it back to you and to the people you explicitly share a space with.
Data from services you connect
Only the services you choose to connect, and only while they stay connected. The next section covers Google in detail because that is where most of it happens.
Technical data
Standard server logs — IP address, user agent, timestamps, and error traces — kept for security and debugging. We do not run third-party advertising or cross-site tracking on our apps.
Google user data
TaskDriver requests access to Google Calendar, Gmail and Google Drive only when you connect each one, and each is optional. Below is every Google permission we request and what we actually do with it.
Read your calendars and events so TaskDriver knows your real availability, and create or update the events it schedules for you. We cache event titles, descriptions, times, your RSVP status and the event link so the app can render your day without calling Google on every keystroke.
Read message headers — subject, sender, message ID — and the short preview snippet Gmail returns, so that starring or labelling an email can become a task with a meaningful title. We do not read, store or transmit full message bodies or attachments.
Act on the messages you have turned into tasks, and only in the ways you switch on: archive or trash an email when its task is completed or deleted. We never send email, and we never modify a message you have not linked to a task.
Create and manage the single TaskDriver label used to mark messages you have captured, and to detect messages you label yourself.
Detect when someone @-mentions you in a comment on a Drive document so it can become a task, and read file names and links for the documents you attach to tasks. Read access to file content is required by Google's Comments API — narrower permissions only cover files opened through our app, which is not how mentions reach you. We store the comment text, the commenter, and the file name and link. We do not copy, index or retain the contents of your documents.
Identify which account you just connected, so the app can label it correctly when you connect more than one.
Limited Use
TaskDriver's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms: we use Google user data only to provide and improve the features you connected it for. We do not sell it, we do not use it for advertising, and we do not transfer it to others except as needed to run the service, to comply with the law, or as part of a merger or acquisition where it remains subject to this policy.
Humans and AI
No one at TaskDriver reads your Google user data, except with your explicit permission for a support request you have raised, or where required by law or to investigate abuse or a security incident.
We do not use Google user data to develop, train, or improve generalised artificial-intelligence or machine-learning models. Where a TaskDriver feature uses an AI model to act on your behalf, it processes only what is needed to carry out the request you made, and any model provider we use is contractually barred from training on your data.
Where your data lives
TaskDriver runs on Railway, in a managed PostgreSQL database with storage encrypted at rest by the provider. All traffic between you and us, and between us and Google, is encrypted in transit with TLS.
Access tokens and refresh tokens for connected accounts are held in that database and used only by the TaskDriver backend to make the API calls described above. Access to production systems is restricted to the operators of the service.
Who else processes your data
- Railway — application hosting and database.
- Descope — authentication and session management.
- Google — the APIs you connect, and Google Cloud Pub/Sub for Gmail change notifications.
We do not sell your personal data to anyone, and we never have.
Keeping and deleting it
We keep your content for as long as your account exists. Cached data from a connected service is kept only while that service stays connected.
- Disconnect an integration and we revoke the token with Google immediately and delete the stored tokens and the cached data for that account.
- Delete your account and everything associated with it — tasks, spaces, connected accounts, cached Google data — is removed from our production database. Backups age out on their own cycle, within 30 days.
- Revoke access at Google at any time, independently of us, from your Google Account permissions page. TaskDriver stops receiving data the moment you do.
Server logs are retained for up to 30 days.
Your rights
You can access, correct, export or delete your data, and you can object to or restrict how we process it. Most of this is available directly in the app; for anything that is not, email im@nir.earth and we will respond within 30 days. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.
Children
TaskDriver is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
Changes
If we change this policy in a way that materially affects how we handle your data, we will update the date at the top of this page and notify you in the app or by email before the change takes effect.