Privacy policy

This policy explains what personal information Tatask collects, why, who it's shared with, and the choices you have. It covers this website (tatask.com), the web app (app.tatask.com), and the Tatask apps for iPhone and Android.

I'm Max Girkins. I run Tatask on my own and I'm the data controller for the information described here. If you have any question about your data, or want to use any of the rights below, email me at max@tatask.com and I'll reply myself.

The short version

This website sets no cookies and stores nothing on your device to track you. We count visits with Fathom and PostHog, both in their most privacy-preserving, cookieless modes.
Your tasks are yours. We store them so they sync between your devices. We don't read them, sell them, use them for advertising, or use them to train AI.
We don't sell personal information to anyone, and there are no ads in Tatask.
Payments are handled by Paddle (on the web), and Apple or Google (in the apps). We never see your card details.

On this website

Analytics: Fathom

We use Fathom Analytics to count page visits and a few events, such as clicks on a sign-up button or an app store link. Fathom doesn't use cookies, doesn't store anything on your device, and doesn't collect personal information. It produces aggregate numbers only, such as how many people visited a page today, and can't identify or follow individual visitors.

Analytics: PostHog (cookieless)

We use PostHog, hosted in the EU, to understand how people move through the site, for example which pages lead to people trying Tatask. On this website PostHog runs in cookieless mode:

it sets no cookies and writes nothing to your browser's storage;
visitors are counted using a privacy-preserving hash that PostHog calculates on its servers from your IP address and browser details, together with a salt that changes every day, so the same visitor can't be recognised from one day to the next;
it doesn't record your screen, and anything typed into forms on the site is never captured;
requests are sent through our own domain.

PostHog records which pages you view, links and buttons you click, and how you found the site (for example, the name of a campaign in the link you followed).

If you sign up for the newsletter, the email course or a free download, we collect your email address, which form you used, and the campaign that brought you to the site, if any. We only add you after you confirm your address by clicking the link in our confirmation email. Every email includes an unsubscribe link, and you can also ask us to remove you at any time. Sign-ups are stored with our email provider, which processes them on our behalf.

Email

If you email us, we keep the conversation so we can help you and refer back to it later.

Cookies and local storage

This website sets no cookies. It saves one setting in your browser's local storage, and only if you use the theme switch: whether you chose light or dark mode. See the cookie page for details.

In the Tatask apps

Your account

To create an account we collect your email address and a password, or the details your chosen sign-in provider shares with us (Google or Apple: your name and email address, or with Apple, a private relay address if you choose). Sign-in is handled by Firebase Authentication, part of Google Cloud. We never see your password.

Your tasks and settings

We store the tasks you write, along with their dates, tags, repeats, order and completion status, plus your settings such as theme, accent colour, and any background image you upload. They're stored in Google Cloud Firestore and Firebase Storage, so they can sync between your devices. A copy is also kept on each device you sign in on so Tatask works offline. On the web, that copy is deleted from the browser when you sign out.

We don't look at the contents of your tasks except when you ask us to, for example to help with a support problem, and then only as much as needed.

Payments and subscriptions

On the web, payments are handled by Paddle, which acts as the merchant of record. Paddle collects your payment details, billing address and tax information under its own privacy policy. We receive your subscription status, plan and renewal dates, but never your card details.
In the iPhone and Android apps, purchases are made through Apple's App Store or Google Play under their terms. We use RevenueCat to check whether your subscription is active. RevenueCat receives your Tatask account ID and your purchase receipts, not your name or card details.

Analytics in the web app

The web app uses Fathom in the same cookieless way as this website. Page addresses are reduced to their general shape (for example /tasks) before they're counted, so task names, IDs and tags never leave your device in analytics.

The web app also uses PostHog to help us find bugs and improve the app. When you're signed in, PostHog links this activity to your account ID and email address so we can help if you report a problem. It's set up to protect what you write:

the text on the screen and in form fields is masked, so session recordings show the layout of the app, never your tasks;
page addresses are reduced to their general shape, as with Fathom;
network requests and their contents are never recorded.

The iPhone and Android apps don't contain any analytics.

We share personal information only with the services that help us run Tatask, and only what each needs:

Service	What for	Where
Google Cloud (Firebase)	Sign-in, storing and syncing your tasks and settings	Google's data centres
Paddle	Web payments, tax and invoicing (merchant of record)	UK
Apple, Google	In-app purchases	Under their own policies
RevenueCat	Checking in-app subscription status	US
Fathom Analytics	Cookieless visit counts	EU
PostHog	Product analytics (cookieless on this website)	EU
Our email provider	Newsletter and email course, if you sign up	Varies by provider
Cloudflare	Hosting and delivering this website	Global network

When information is transferred outside the UK or European Economic Area, we rely on the provider's adequacy decision or standard contractual clauses.

We may also disclose information if the law requires it.

Why we use your information (legal bases)

To provide the service you signed up for (contract): your account, your tasks, sync, and your subscription.
To keep Tatask working and improve it (legitimate interests): cookieless analytics, fixing bugs, and preventing abuse. We've chosen privacy-preserving setups so this has as little impact on you as possible.
To send the newsletter or email course (consent): only after you confirm your address. You can withdraw consent at any time.
To meet legal obligations, such as keeping payment records.

How long we keep it

Your account and tasks: for as long as your account exists. If you delete your account in Settings, your sign-in is removed immediately and your tasks and profile are marked as deleted, so no device shows them again. If you'd like the remaining records erased completely, email us and we'll do it.
Analytics: Fathom keeps aggregate counts only. PostHog events are kept in line with PostHog's retention settings and never contain the content of your tasks.
Newsletter: until you unsubscribe.
Payment records: as long as tax law requires (Paddle, Apple and Google keep their own records).
Support emails: as long as they're useful for helping you.

Your rights

Under UK and EU data protection law you can ask to see the personal information we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive a copy in a portable format. Email max@tatask.com and we'll respond within a month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.