Privacy Policy

Last updated: October 16, 2026

Plain-language summary first; the full terms follow.

We collect what we need to run Taskeni: your account details, what you and your team put in, and basic technical records.
We don't sell personal data, show ads, or use advertising or tracking cookies.
Workspace content belongs to the workspace. For that content, the workspace's owner or organization decides, and we process it on their behalf.
Your data is stored by Convex in the United States. A short list of other providers helps us run the service.
AI helpers are off by default. When a workspace turns them on, only the data a request needs goes to Google Gemini.
You can export your data, correct it, or delete your account at any time. For anything else, email support@taskeni.app.

Who we are

Taskeni is run by an independent developer. In this policy, "Taskeni", "we", and "us" mean that operator and the service. You can reach us at support@taskeni.app.

This policy covers the website at taskeni.app, the web app at app.taskeni.app, the Taskeni apps, the emails we send, and the developer features (REST API, MCP server, webhooks, calendar feed, email-to-task, and request forms).

Our two roles

Controller. For your account, your use of the website, and support conversations, we decide how personal data is used.
Processor. For the content inside a workspace, the customer who owns the workspace is the controller and we process that content on their instructions. If you're a member of a workspace someone else owns, send requests about its content to that workspace's owner. We'll help them respond. Business customers can read our data processing summary.

What we collect

Your account

Your name, email address, and password. Passwords are stored only as a salted hash.
Profile details you choose to add: job title, profile photo, avatar color, and time zone.
Your preferences, such as theme and notification settings.
Security records: sign-in sessions, whether your email address is verified, your two-step verification secret, and your backup codes (stored as hashes).

Workspace content

Everything you and your team add: workspaces, boards, lists, tasks, descriptions, checklists, subtasks, comments, reactions, mentions, files, image feedback pins, custom fields, time logs, reminders, recurring schedules, automations, saved filters, and templates. We also keep each task's history (who changed what, and when), notifications, and a record of members, roles, and invitations, including the email addresses of people you invite.

Data from people outside your workspace

Request forms. When someone submits a board's public form, we collect their email address, what they wrote, and an optional file. We email them a receipt, and another email when the task is done.
Email-to-task. When someone emails a board's address, we receive the sender's address, the subject, the text, and up to five attachments. We only turn an email into a task when the sender is a workspace member who can see that board.

Integrations and developer features

API tokens. A name, scope, a short prefix so you can recognize the token, when it was created and last used, and a hash of the token. We never store the token itself.
Webhooks. The URL, the signing secret, and a log of recent deliveries, including what was sent.
Slack. The Slack workspace and channel names and the access token Slack gives us.
GitHub. A webhook secret, and the title, number, link, and status of pull requests that mention a task.
Calendar feed. A hash of your private feed address.

Devices and notifications

Browser notifications. If you allow them, the push address and encryption keys your browser gives us.
iPhone, iPad, and Mac apps. A device identifier, the device name, a token that links the app to your account, and an Apple push token.
Presence. Who is looking at a board or task right now. This clears about 30 seconds after you leave.

Email records

We send email through Resend. For invitations, we record whether the email was delivered, bounced, or marked as spam, so we can tell the person who sent it. We also keep the date of your last daily digest and a token that lets you unsubscribe in one click. Resend keeps its own delivery logs.

Usage and technical records

AI usage. When AI helpers are on, we record which member used which AI feature, which model ran, and how much it used, so we can count AI credits. We don't keep the AI request or answer.
Service logs. Our hosting providers record technical details such as IP address, browser type, requested pages, and errors.
Website analytics. We use Vercel Web Analytics to count page views. It doesn't use cookies and doesn't identify you.

Payments

Paid plans and AI credit packs are sold through Polar, our merchant of record. Polar collects your billing details and payment information under its own privacy policy. When you start a checkout, we send Polar your name, your email address, the workspace it's for, the plan, and the number of members. We keep only what we need to manage your plan: Polar's customer and subscription IDs, the plan, its status, the number of seats, and the renewal and trial dates. We never receive your card details.

How we use personal data, and our legal bases

If you're in the European Economic Area, the UK, or another place with similar laws, here is why we use your data and the legal basis for each use.

To provide Taskeni: your account, syncing your work, notifications and emails you've chosen, and integrations you've connected. Basis: performing our contract with you.
To keep Taskeni secure: throttling sign-in attempts, rate limits, checking that email-to-task senders are who they say they are, and investigating abuse. Basis: our legitimate interest in protecting users and the service.
To send service emails: email verification, password reset codes, invitations, and receipts for request forms. Basis: contract, or our legitimate interest in running the service.
To send notification emails, daily digests, and push notifications. Basis: contract, following the settings you choose. Push notifications also need your permission in the browser or app. You can turn any of these off.
To run AI helpers when a workspace owner or admin turns them on. Basis: the workspace customer's instructions and our contract.
To answer support requests. Basis: contract, or legitimate interest.
To understand how Taskeni is used, using page view counts and totals such as AI credits used. Basis: legitimate interest in improving the service.
To bill and meet legal duties, such as tax records or lawful requests. Basis: legal obligation and contract.

We don't send marketing email today. If we start, we'll ask first or give you a clear way to opt out, as the law requires. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

People in your workspace. Members see your name, email address, photo, and what you add to boards they can see. Guests see the boards shared with them.
Service providers. A short list of providers host and run Taskeni for us under contracts that limit how they use data. See our subprocessors.
Polar, for payments. When you buy a paid plan or AI credits, Polar handles the purchase as merchant of record. See Payments above.
Integrations you connect. When you connect Slack, GitHub, an AI assistant, a webhook, or a calendar app, we send it the data that connection needs.
When the law requires it. We may disclose data to comply with a valid legal request, or to protect the rights and safety of users, the public, or Taskeni. Where we can, we'll tell the affected customer first.
If Taskeni changes hands. If Taskeni is sold or transferred, personal data may move with it under this policy. We'll tell you before that happens.

We don't sell personal data, and we don't share it for advertising.

International transfers

Taskeni is run from Bangladesh, and your data is stored in the United States. Some providers may process data in other countries. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data processing terms, or another lawful transfer mechanism.

How long we keep it

Your account: for as long as you have it. When you delete your account, we delete your sign-in records, sessions, profile details, two-step verification secrets, and notifications right away. A placeholder named "Deleted user", with no name or email address, stays so that past comments still show an author.
Content you added to shared workspaces: it stays with the workspace after you leave or delete your account, because it belongs to the workspace.
Workspace content: until the workspace deletes it. Deleted tasks wait in Trash for 30 days and are then permanently deleted, with their comments and history. Files removed from tasks are deleted from storage after the same 30 days, once no task uses them. Deleting a workspace deletes its boards, lists, tasks, comments, and history.
Webhook delivery logs: 30 days.
Short-lived links and codes: password reset codes expire after 15 minutes, email verification links after 3 days, and invitations after 7 days.
AI usage records: kept to account for AI credits. They don't contain the content of requests.
Backups and logs: our providers keep backups and service logs for limited periods. Deleted data can remain there until it's overwritten on their normal schedule.
Billing records: kept as long as tax and accounting law requires.

Cookies and local storage

Taskeni doesn't use advertising or tracking cookies. The app keeps your sign-in and a few preferences in your browser's local storage. Details are on our cookies page.

Your rights

Depending on where you live, you can ask to access, export, correct, or delete your personal data, to restrict or object to how we use it, and to withdraw consent at any time.

Much of this you can do yourself:

Correct: edit your name, title, photo, and time zone in your profile.
Export: download your personal data (profile, workspaces, tasks assigned to you, your comments, and notifications) from Settings → Account. Export a whole workspace as JSON from Settings → Data.
Delete: delete your account from Settings → Account.
Object to emails: use the unsubscribe link in any notification or digest email, or change your settings in Settings → Notifications.

For anything else, email support@taskeni.app. We'll reply within one month and may ask you to confirm your identity first. If your request is about content in a workspace someone else owns, we'll pass it to the workspace owner and help them respond.

If you're in the EEA or the UK, you can also complain to your local data protection authority. We'd appreciate the chance to fix the problem first.

If you're in California or another US state with a privacy law: we don't sell personal information or share it for cross-context behavioral advertising. You can make the requests above, and we won't treat you differently for doing so.

Children

Taskeni isn't for anyone under 16, and we don't knowingly collect their personal data. If you think a child has given us personal data, email support@taskeni.app and we'll delete it.

Security

We protect accounts with two-step verification, sign-in throttling, hashed tokens and backup codes, and server-side access checks on every change. Data is encrypted in transit and at rest by our hosting providers. Read more on our security page. If something goes wrong that affects your personal data, we'll tell you without undue delay.

Changes to this policy

We may update this policy. We'll post the new version here with a new date. For material changes, we'll tell account holders by email or in the app before they take effect.

Contact

Questions or requests: support@taskeni.app, or the form at taskeni.app/contact.