Useful software without the ad-tech trade-off.

TASKjiq is a product of GT3 Custom SoftDesign. GT3 Custom SoftDesign decides what happens to the data this page describes and is responsible for it - the data controller, in the words of the GDPR. You can reach us at info [at] taskjiq. app or through the contact page.

TASKjiq is a product of GT3 Custom SoftDesign, the data controller for everything described on this page ("we" below). For privacy questions write to info [at] taskjiq. app.

TASKjiq has no advertising, no analytics trackers and no profiling. We do not sell your data and we do not share it with advertisers or data brokers. Everything below is what the app needs to work, and nothing else.

• Without an account, your tasks, notes, events, files and scratchpad pages stay on your device. The only thing that leaves it is an error report when something breaks, and you can switch those off.
• With a paid plan, your content is stored on our servers in Germany so it can sync between your devices and be shared with people you choose.
• The AI helpers send only the text you point them at, through our servers to OpenAI, and we keep none of it.
• You can export everything as a zip at any time, and delete your account from the app or from this site.

The whole app works without an account, on the device you install it on. Your content is stored only on that device and is never uploaded. A few technical things do leave the device even then:

• Error reports, described in their own section below. You can switch them off.
• Push notifications are set up only once you sign in to a paid plan. Until then the app does not register with Google’s or Apple’s push services, and they are given nothing about your device.
• Handwriting recognition in the scratchpad (Android and iPhone) runs on your device. The first time you use a language, the app downloads that language’s model from Google.
• Dictation uses the speech recognition built into your phone or computer, not a service of ours. Depending on your device and its settings, your operating system may process your voice on Apple’s or Google’s servers under their terms.
• When you open a link or a file in another app, that app sees it. When you link a Google Calendar, see the section on it below.

An account exists for the parts of TASKjiq that need a server: sync, sharing, cloud storage for documents and the AI helpers. It comes with a paid plan. To run it we keep:

• Your email address and the name you give. Your name is shown to people you share lists with.
• When you sign up, the account is created only once you enter the code we email you. Until then we keep the name, email address and password hash you entered for at most 24 hours, and delete them if the code is not entered.
• How you sign in: a password, which we store only as a one-way hash, or your Sign in with Apple identifier. Apple may give us a relay address instead of your real email if you choose to hide it. Signing in by emailed code sends a code to your address.
• If you turn on two-step sign-in, the secret that checks your codes, stored encrypted, and your recovery codes, stored as hashes that cannot be shown again, even by us.
• Session tokens for the devices you are signed in on, stored as hashes, and the time each was last used. They are removed when you sign out of that device or delete your account.
• Your subscription: the plan, its period, when it renews or ends, and what is needed to check it with the store you bought it from (see "Payments").
• Your settings and, if you set one, a profile photo.
• The app lock PIN of the web version, stored as a one-way hash, with a count of failed attempts; after ten wrong PINs the web session ends. In the apps the PIN and the Face ID, Touch ID, fingerprint or Windows Hello checks stay on your device and we never see them.

On a paid plan your tasks, notes, events, documents, scratchpad pages, tags, projects and the links between them are stored on our servers so that every device you sign in on has the same copy. Documents, and the photos, recordings and videos in notes and scratchpad pages, are stored as files in our object storage. Everything is hosted on infrastructure run by Hetzner in Germany, in the European Union.

The text inside PDFs, Word and text documents is extracted on the server so that search can find a file by what is written in it. Nothing is analysed for any other purpose: not for advertising, not for profiling, and not to train anything.

• Shared lists: when you share a task, note or document list by email, the people you invite get an email with your name, and once they accept they see the list’s content and each other’s names and email addresses. Assigning a task stores the assignee’s email with it. Removing someone removes their copy.
• Other people’s email addresses that you type in, as invitees, assignees or event participants, are stored with the item they belong to. They are used only for that purpose.
• Deleted items go to the trash and are kept for six months, on the server and on your devices, so they can be restored. Then they are erased. Emptying the trash erases them sooner.
• A copy of your content stays on each signed-in device so the app works offline. Signing out removes that device’s copy.

The AI helpers are part of the paid plans. When you use one, the text you act on, such as a note, a list of tasks, an event with its participants, or the sentence you type as a prompt, is sent through our servers to OpenAI, which generates the result. We send text only: never your photos, recordings, videos or files, and never your name or email address.

We do not store what you send or what comes back. We keep a record of each request’s type, time and size in tokens, because the plans have daily and monthly allowances. OpenAI processes the text under its API terms, which do not allow it to be used to train their models; OpenAI may keep it for a limited time to detect misuse. OpenAI is in the United States; the transfer is covered by the EU–US Data Privacy Framework and standard contractual clauses.

Handwriting recognition is not an AI helper in this sense: it runs on your device and sends nothing to us or to OpenAI.

Without an account, reminders are scheduled on your device and never leave it.

With a paid plan, reminders and sharing notifications are delivered to the device you are using through the push service of its platform: Google’s Firebase Cloud Messaging on Android, Apple’s Push Notification service on iPhone and iPad, and your browser’s push service on the web, where the message is encrypted so the browser vendor cannot read it. On Android and Apple devices the notification carries the title of the task or event and its notes in readable form, so Google or Apple handle that text in transit.

To deliver them we store each device’s push token, platform and app version. A device that has not been seen for 30 days is forgotten, and delivery records are kept for 30 days. You can refuse the notification permission at any time; reminders then show only while the app is open.

On iPhone, iPad, Mac and Android, plans are bought through the App Store or Google Play. The store takes your payment and we never see your card. We receive the receipt or purchase token, the plan and period bought and the transaction identifiers, which we check with the store and keep to know what you are entitled to. We give the store a random identifier for your account, never your email.

On the web, Windows and Linux, plans are bought through Stripe, which is the merchant of record: it charges you, handles VAT and issues your receipt. Stripe receives your email address, your account identifier and the plan you chose, and processes your card under its own privacy policy. We keep the invoice: your name, email, the amount, the transaction identifier and a link to the receipt.

An account that never gets a plan is closed after a week. A closed account’s data is kept for 180 days, so that paying again restores everything, and is then erased.

If you link a Google Calendar, you sign in with Google and grant TASKjiq access to your calendars. The access tokens Google gives are kept on your device, and the events TASKjiq reads from Google stay on your device; they are not uploaded to our servers. On the web and in the desktop apps, our server relays the token exchange with Google, so the app never has to carry Google’s credentials, and stores nothing from it. What syncs between your devices is the link itself: the Google account’s email, the names and addresses of the calendars you chose.

TASKjiq’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can unlink a calendar in the app at any time, and revoke TASKjiq’s access in your Google account settings.

When something in the app breaks, TASKjiq sends a report so it can be fixed. This is on by default, and you can turn it off at any time in the app under Account → Error reports. Turning it off stops new reports.

A report describes the fault, not your work: the error, where in our own code it happened, the version of the app, the kind of device, its operating system and language, and an anonymous identifier the reporting library gives the installation so repeated crashes can be counted. The library also counts app sessions, so we know how many starts a crash affects.

Our servers send their own error reports in the same way. Those can contain your account identifier and the request that failed, but not the content of the request.

• Never your content: no note, task, document, event or scratchpad page, and no file you have stored.
• Never a screenshot, and never a copy of what is on screen.
• Never your name, email address or IP address.
• Reports are processed by Sentry on servers in the European Union, and are used only to find and fix faults.

taskjiq.app has no analytics and no advertising scripts. It stores your theme preference in your browser and nothing else.

The contact form, the account-deletion form and signing up in the web app are protected by Cloudflare Turnstile, which checks that a request comes from a person; Cloudflare sees your IP address and browser details for that check, under its own privacy policy. A contact message, with your name, email address, subject, message and the IP address it was sent from, is emailed to info [at] taskjiq. app and kept in that mailbox for as long as the conversation needs.

Deleting an account from this site asks for your email address, sends a code to it, and schedules the deletion exactly as the app does.

Everything travels over HTTPS. Passwords, session tokens and the web PIN are stored as one-way hashes; two-step secrets are encrypted. Our servers record IP addresses to limit how often an address may try to sign in or call the service; those records last at most a day. The web routes of the service keep a session record with the IP address and browser for two hours. Server logs hold technical details of requests for a limited time and are not used for anything but operating and securing the service.

Backups of the service are kept for a limited time and then overwritten; your data disappears from them on that schedule after it is deleted from the service.

• Your account and content: until you delete the account. Deletion is scheduled seven days ahead so it can be cancelled, then removes everything, including your files.
• Deleted items in the trash: six months.
• A closed, unpaid account: 180 days.
• Push device records: 30 days after the device was last seen.
• Invoices: as long as accounting law requires.

These companies process data for us, on our instructions, and only for the purpose named. None of them may use it for their own purposes.

• Hetzner Online GmbH, Germany: the servers and object storage where accounts and content live.
• Sentry (Functional Software, Inc.), EU data region: error reports.
• OpenAI, L.L.C., United States: the AI helpers.
• Google LLC: push notifications on Android, the handwriting model download, and Google Calendar when you link one.
• Apple Inc.: push notifications on iPhone and iPad, Sign in with Apple, and App Store purchases.
• Google Play and the App Store: purchases made there.
• Stripe, Inc.: payments on the web, Windows and Linux, as merchant of record.
• Cloudflare, Inc.: the form check on this website.
• Our email provider: the codes, invitations and account emails we send you.
• Where a provider is outside the European Union, the transfer rests on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission’s standard contractual clauses otherwise.

Under the GDPR, every use of personal data needs a legal basis. Ours are these.

• To provide the service you asked for, including the account, sync, sharing, payments and the AI helpers: performance of a contract.
• To keep the service secure and working, including rate limiting, logs and error reports: our legitimate interest in running a reliable service, which you can object to for error reports by switching them off.
• For the permissions you grant on your device, such as notifications, the camera, the microphone and a linked Google Calendar: your consent, which you can withdraw in your device or account settings.
• To keep invoices: a legal obligation.

You can see and take your data at any time: Account → Your data in the app exports your whole account as a zip of CSV, JSON, Markdown and your files as they were. You can correct your name and email in the app. You can delete your account under Account → Security, or on this site at taskjiq.app/delete-account; both ask for a code sent to your email and allow seven days to change your mind.

You also have the right to ask us for access, rectification, erasure, restriction or portability of your data, to object to processing based on our legitimate interests, and to complain to the data protection authority of the country you live in. Write to info [at] taskjiq. app; we answer within a month.

TASKjiq is not directed at children under 16, and we do not knowingly keep an account for one. If you believe a child has created one, write to us and we will remove it.

When we change what TASKjiq does with data, we change this page in the same release, and the date at the top with it. Changes that matter are also announced in the app.

Questions about this page or about your data: info [at] taskjiq. app, or the contact page.