Privacy Policy

Creating a sync account does not require an email address. TaskVault uses an anonymous-account model: your account is identified by a randomly generated ID, secured by a passphrase and a one-time recovery key you're shown at setup. If you never enter an email during setup, we never have one for you.

What our server stores for a sync account:

• A random account ID
• A cryptographic salt and key-derivation parameters (needed to verify your passphrase without ever seeing it — this is not your passphrase and cannot be reversed into it)
• A hash of your one-time recovery key (again, one-way — not reversible)
• Subscription status (free, active, etc., for billing purposes — see clause 05)
• Nothing else, unless you voluntarily provide an email

Each device you pair for sync stores, on our server:

• A device ID and a name you (or your device) assign it, e.g. "Sarah's Pixel" — this is the one piece of plaintext metadata our server holds, needed to show you a human-readable device list when managing sync
• A public key used to verify that device's encrypted sync traffic
• The last time it connected

Every task, note, checklist, subtask, and attachment is encrypted on your device using keys derived from your passphrase before it's sent anywhere. Our server stores:

• Opaque encrypted blobs (ciphertext only)
• A blob's size and timestamp (needed for sync to work at all)
• For attachments: an opaque attachment ID and encrypted file bytes

Filenames, file contents, task titles, descriptions, and all other content stay encrypted inside these blobs — including attachment filenames, which can themselves be sensitive (e.g. medical_report.pdf) and are treated with the same protection as task content, never stored as plaintext metadata.

We cannot read your tasks. A breach of our server, or a legal order compelling us to hand over data, would produce only unreadable ciphertext.

Your local task database is encrypted at rest. The one narrow exception: opening an attachment type your device has no built-in viewer for (e.g. certain PDFs) briefly decrypts it to a temporary file so your OS can hand it to another app, then deletes that file immediately after. This exception does not apply to images, which are decrypted only in memory.

Paid sync is billed through Google Play Billing. We receive a billing account identifier from Google (stored only as a one-way HMAC, not the raw identifier) and real-time subscription status notifications from Google, used solely to enable or disable sync access. We do not receive your payment card details, billing address, or other information Google collects to process the payment itself — that's handled entirely between you and Google under Google's own privacy policy.

TaskVault includes optional AI-assisted features (task categorization, priority suggestions, subtask breakdown). These are off by default and require you to paste in your own API key for a provider you choose (currently Anthropic or OpenAI). When you use these features:

• The relevant task title/description is sent directly from your device to your chosen provider's API — never through TaskVault's servers
• Your API key is stored only on your device, in your OS's secure keychain
• Saving a key is how you opt in; you can remove it at any time to stop this data flow entirely
• Use of these features is subject to your chosen provider's own privacy policy, since they process that data as an independent party you've selected

Task reminders are scheduled and delivered entirely by your device's operating system. TaskVault does not use any remote push notification service (no Firebase Cloud Messaging, no Apple Push Notification service) — no push token or reminder content is ever sent to us or to any third party for this feature.

TaskVault's sync server is open source and can be self-hosted. If you connect to a self-hosted server instead of ours, that server operator — not us — controls that infrastructure, and this policy describes our hosted service specifically.

You can delete your account and all associated data at any time from within the app. This is self-service and immediately removes your encrypted blobs and account record from our server — no support request required. See how to delete your account for the exact steps, what gets removed, and what to do if you've lost access to the app.

If you're in the EU/UK or another jurisdiction with similar protections, you have the right to:

• Erasure — delete your account and data at any time (clause 09)
• Portability — export your data at any time directly from the app; because TaskVault is local-first, your full dataset already lives on your device in an exportable form
• Access — request a copy of the limited metadata we hold about your account (clauses 01–02)

To exercise these rights or ask questions, contact us (clause 12).

TaskVault is not directed at children under 13, and we do not knowingly collect data from them.

We'll update the effective date above if this policy changes, and post the updated version at this same URL.

Questions or requests: privacy@bytebleeder.com