Privacy policy

Taskpile is operated by Refleksion · Planlægning · Handling (CVR-no. DK45818659), the data controller for the information collected when you use the service. We collect only what we need to run the product.

What we store

• Email and display name from your account
• The tasks, projects, notes, and tags you create
• MCP tokens you generate (hashed - we never see the plain token after creation)
• Payment data is handled by Paddle - we only store reference IDs
• Technical usage data: IP address, browser, and analytics events about how Taskpile is used (pages viewed, features used). Before you sign in they are tied only to an anonymous session; once you are signed in they are linked to your account. To understand where visitors come from we also record campaign parameters (utm_*) and the referring site. All of it is first-party: we store it ourselves and share it with no analytics company. The session and the campaign parameters live in your browser's local storage, not in third-party cookies.
• If you turn on push notifications: a push token that lets us reach that browser or device
• If you sign in with Apple or Google: the account identifier they give us. With Apple also a token, kept only so that deleting your Taskpile account also revokes your Sign in with Apple
• Error reports, linked to your account when you are signed in. They never contain the content of your tasks
• When you dictate a task, your device or browser turns your speech into text (on iPhone, Apple's speech recognition). We receive only the text

Why

To deliver the service, send relevant notifications, and improve the product. We do not sell your data and do not share it with third parties for marketing.

Legal basis

We process your personal data on the following GDPR bases:

• Performance of a contract (Art. 6(1)(b)): delivering the service, account creation, billing.
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention, error monitoring, product improvement and analytics.
• Consent (Art. 6(1)(a)): marketing emails and optional notifications - always revocable.
• Legal obligation (Art. 6(1)(c)): accounting and tax law compliance.

Sub-processors

We use the following sub-processors to run Taskpile:

• Supabase - database and sign-in, hosted in the EU (Ireland)
• Paddle - payment processing and Merchant of Record
• Cloudflare - application hosting, edge delivery and DDoS protection
• Resend - email delivery (sign-in codes, welcome, digests, billing notifications)
• Google Firebase Cloud Messaging - delivers push notifications to the iOS app (a device token and the text of each notification)
• Apple - Sign in with Apple, and delivery of push notifications to iPhones
• Google - Sign in with Google

When you connect Taskpile to an AI assistant via MCP (Claude, ChatGPT, or others), that assistant accesses your task data on your behalf. We do not control what those services do with the data they receive - see the respective provider's privacy policy.

Retention

• Account and profile data: while your account is active, plus 90 days after deletion.
• Tasks, projects, notes: while your account is active. Deleted tasks are soft-deleted for 30 days, then purged.
• Analytics events: up to 24 months.
• Error reports: 30 days.
• Billing records: up to 5 years (Danish accounting law).
• Support correspondence: up to 24 months after last contact.

Security

• TLS / HTTPS on all connections.
• Encryption at rest of the database with our cloud provider.
• Row-Level Security in the database - users can only access their own data.
• Hashed passwords and secure session handling.
• Personal access tokens stored as SHA-256 hashes - the plain token is shown to you once at creation and never again.
• Continuous monitoring and dependency updates.

If we ever experience a breach posing a risk to your rights, we will notify the Danish Data Protection Authority within 72 hours and you without undue delay.

Your rights

Under GDPR you have the right of access, rectification, erasure, restriction, data portability, and objection. You can export your data and delete your account at any time under Settings > Data, or by writing to inbox@taskpile.app. You also have the right to complain to the Danish Data Protection Authority (datatilsynet.dk).

Cookies

We use only first-party cookies strictly necessary to run the service (session cookies for authentication and a theme preference cookie). We do not set marketing or third-party tracking cookies.

Contact

Refleksion · Planlægning · Handling - CVR-no. DK45818659. Privacy questions: inbox@taskpile.app.