Privacy

Taskgrove is a shared task board. You make boards, lists and cards, you write things on them, and other people in your workspace can read and change them. This page says what we store, where it is stored, who else can see it, and what you can get back or have removed.

A note on what this document is.It was written by reading the product and describing what it does, and it has not been through a lawyer’s review. We would rather publish something short and accurate than something long that describes a product we do not have. Where a thing is not built, this page says so.

Who we are

Taskgrove is a Yalintech product. For anything on this page — privacy questions, a copy of your data, or deletion — write to support@yalintech.com. That is the only address, and it reaches a person.

What we store

Your account.Through Google’s Firebase Authentication: your email address, and either a password (hashed and held by Google, in a form we cannot read) or the link to your Google account if you signed in with one. Whether your address is verified, and the usual account timestamps Google keeps.

Your profile. A record of our own holding your display name (up to 60 characters), your avatar address if your sign-in provider gave one, your locale, your light/dark and compact/comfortable preferences, the last workspace you had open, and which one-time tips you have already been shown.

What you put on your boards. This is the bulk of it, and it is whatever you type: workspace, board, list and label names; card titles, descriptions and checklist text; comments. Alongside it we store the structure — which list a card is in, its order, labels, priority, due date, cover colour, and whether it is active, archived or trashed — plus who is assigned and who is mentioned, as account identifiers, and who created or last changed each thing, and when.

Free text is free text. If you type a client’s name, a phone number or a price into a card description, we store it, because that is what a card description is. We do not scan it, index it for anyone outside your workspace, or use it to train anything.

Activity history. Each creation, move, rename, priority change and due-date change writes a short row: the kind of change, who made it, when, which board and card, and a one-line summary composed on our side. This is what card history is made of, and these rows are kept indefinitely — they are deliberately excluded from every automatic expiry, because the point of a history is that it is still there later.

Notifications. When you are mentioned or assigned, we write a record to your account: the kind, the workspace, board and card it points at, a title composed on our side, who did it, when, and whether you have read it.

Invitations.When an admin invites someone we store the invitee’s email address, a SHA-256 hash of it used only as an internal de-duplication key, the role offered, who sent it, the workspace name at the time, and the created, expiry, accepted and revoked timestamps. Invitations expire after 14 days. The record is server-only: no browser can read it, including the workspace owner’s.

Counters.Per-workspace tallies — how many active boards, members and pending invitations, plus write-rate counters that stop runaway automation — and a few “first time this happened” timestamps. Numbers and dates, not content.

What we do not store.

• No IP addresses or browser user-agent strings in our database. Nothing in our application code reads or records either. Google’s infrastructure logs requests as part of running the service, and those logs do contain IP addresses — see the next section.
• No files. Attachments are switched off and the storage bucket denies every read and write.
• No payment details. There is no payment path in the product at all — no card form, no processor, no subscription.
• No location data, no contacts, no device identifiers.

Where it is stored

Everything is in Google Cloud, in the United States, in a Firebase project we control.

• Boards, cards, comments, activity and profiles — Cloud Firestore, in the us-central1 region.
• Accounts, passwords and sign-in — Firebase Authentication, on Google-managed infrastructure in the US.
• The website and the server-side logic — Firebase Hosting and Cloud Functions, in us-central1.
• Operational logs— Google Cloud Logging, in the US. These are the platform’s own request logs and they contain IP addresses.

The database has point-in-time recovery enabled with a seven-day window, and delete protection turned on, so a mistake on our side or a bad deploy can be rolled back within that week. That is a safeguard against our own errors; it is not a personal backup service, and it does not undo something you deleted yourself.

If you are outside the United States, using Taskgrove means your data is stored and processed in the United States, by Google on our instructions.

Who else can see it

Google.Google is our only processor. Apart from the web framework the site is built on, the product has four third-party code dependencies: Firebase’s browser library, its two server libraries, and a validation library that makes no network calls. There is no other vendor, no other SDK and no other outbound connection. Google runs the database, the sign-in system and the servers, and sends the two sign-in emails described below.

People in your workspace.A shared board is shared, and this is the part that matters most in practice. Everyone in a workspace can see its boards, lists, cards, descriptions, checklists and comments, and the display name and avatar of every other member. Every change is attributed to you by name in the card’s history, and that history is kept indefinitely. Owners and admins can invite and manage; members can edit; observers can read and nothing more.

There is no user directory. Nobody can look you up, search for you, or learn that you have an account, unless you share a workspace with them or they hold an invitation addressed to your email address.

Nobody else. We do not sell your personal information. We do not share it with advertisers, data brokers or analytics vendors, and we do not use it to train machine-learning models. We have no affiliates or resellers to pass it to. We would disclose data if we were legally compelled to, and where we are permitted to tell you, we will.

Email

We do not send you email. There is no mail provider, no mail server and no templates anywhere in the product. Exactly two messages exist, both sent by Google’s Firebase Authentication and both triggered by you: the address-verification message when you sign up or ask for it again, and the password-reset message when you ask to reset your password.

Invitations are not emailed. When an admin invites a teammate, Taskgrove produces a link for the admin to send themselves — the invite screen says so in as many words. The link works only for the address it was issued to, and only for someone signed in with a verified account at that address.

Analytics, cookies and browser storage

Today there is no analytics, no advertising and no tracking of any kind. No third-party script loads on any page, and no request goes to a measurement or advertising host. This is not a sentiment: the analytics code needs a Google Analytics measurement id before it does anything, and no measurement id is set, so the module is a no-op and the Google Analytics code is not downloaded. A test in the repository asserts it.

That is one environment variable, so treat it as the current state rather than a permanent property. If we turn analytics on, this page will say so first, and the following limits are already written into the code rather than being intentions: a closed list of thirty event types; no parameter shape that can carry free text, so a card title, comment, name or address cannot be sent; no identifiers of any kind; route templates instead of page addresses, so /w/acme/board/aG7xK2 is reported as /w/[wsSlug]/board/[boardId]; Google Signals and ad personalisation off; and “Do Not Track” and Global Privacy Control honoured with no override. Under UK and EU rules, switching it on also needs your consent first, and that gate has to be built before the variable is set.

Cookies. One cookie, set by us:

• __session, value 1, Path=/, SameSite=Lax, 30 days, cleared when you sign out. It tells the site you are probably signed in, so you get a sign-in page instead of an empty app screen. It carries no account identifier, no role, no signature and no personal data, and nothing is allowed to make a security decision from it.

Firebase Authentication may also set cookies of its own while signing you in. Because that functional cookie is the only one, there is no consent banner on this site — and there is nothing hiding behind its absence.

Browser storage. A few things live in your own browser and are not sent anywhere: tg-theme (light, dark or follow the device), tg-density (compact or comfortable), tg.analytics (present only if you opt out), and tg.firstTouch — two words from a fixed list describing roughly how you first arrived, such as search|organic or direct|none. That last one is written on your first visit even though analytics is off; the referring address itself is classified into one of those words and discarded, and the raw value is not stored or transmitted.

Your browser also keeps two IndexedDB stores: Firestore’s offline cache, which is a copy of the boards you have opened so the app loads fast and works offline, and Firebase Authentication’s record of your signed-in session. When you sign out, Taskgrove clears the __session cookie and wipes that Firestore cache from the browser, so the next person using the same computer does not find your boards in it.

Your rights

Wherever you are, and in the UK and EU as a matter of law, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the data we hold for you;
• give you your data in a portable form — there is now a control for this in the product; see below for exactly what it hands you;
• stop or limit a particular use of it, or object to it.

Write to support@yalintech.com and we will answer within one month. If you are in the UK or EU and you are not satisfied with how we handled it, you can complain to your national data protection supervisory authority; in the UK that is the Information Commissioner’s Office.

On portability.Your account → Your data → Prepare my export produces a single JSON file and hands it straight to your browser. It is built when you ask for it, it is not stored anywhere afterwards, and there is no link that keeps working once you close the page. The section below says exactly what is in it. If your account is large enough that one file cannot carry it, the control refuses and says so rather than giving you a partial file that looks complete — and in that case, email support@yalintech.com and we will assemble it another way.

Deleting your data

What you can delete yourself.Cards, lists and boards go to Trash, where they stay for 30 days and can be restored by anyone who can edit the board. A scheduled job runs every 24 hours and permanently removes anything past its 30 days, taking the card’s description, checklist, comments and activity with it. That window is the same 30 days for every account. One deliberate safety behaviour: if you trash a list but some of its cards are still live, the purge refuses rather than taking cards you did not delete.

Deleting your account.Your account → Delete account. It runs immediately, it is not a request to us, and there is no recovery window— the control says so before you confirm. One case is refused rather than obeyed: if you are the only owner of a workspace other people are in, we stop and name those workspaces, because deleting your account would strand everybody else’s work. Transfer ownership or delete the workspace first.

Deleting a workspace.Preferences → Workspace → Delete this workspace, for workspaces you own. Also immediate, also not reversible.

What deletion does not reach.Content you wrote inside a workspace somebody else owns is part of their working record and stays there. Your name is removed from it — those rows keep an opaque account id and no display name — but the words remain. Activity history is kept by design. We would rather say this plainly than imply a deletion is more total than it is.

Taking a copy first. Your account → Your data hands you a single JSON file containing what we hold for you: your profile and sign-in details, your notifications, the labels and dates of any API tokens you made, and your workspaces. A workspace you are the only person in comes out in full — boards, lists, cards, descriptions, comments, history and Trash. In a workspace you share with other people you get everything youwrote there — your cards, your comments, your activity — together with the board, list and card names that give them context. Other people’s cards and comments in that workspace are their data in someone else’s record, so they are not in your file; the file itself lists what it leaves out and why. Token secrets are not in it either: we do not hold them, and the hash that identifies a token is left out deliberately because an exported file travels further than a screen does.

If it will not fit, we refuse rather than trim. The export is built and returned in one request, so a very large account can exceed what that request can carry. When that happens the control says so and gives you nothing, instead of a shortened file that looks complete — a partial copy is worst exactly when you need it, which is after the original is gone. In that case, email support@yalintech.com and we will assemble it another way. The same address is the route for anything the control does not cover, including content you wrote inside a workspace somebody else owns and has since removed you from.

Security

• Everything sits behind Firestore security rules that deny by default. There is no rule in the product that grants a broad read; access is granted only to members of the workspace a document belongs to.
• Your profile is readable only by you. Other members of your workspace see a separate, small projection of your name, avatar and role.
• API tokens, if you create one, are stored as a hash. We cannot recover one; a lost token is revoked and replaced.
• Invitation records and every other server-only collection are unreadable by any browser.
• The file-storage bucket denies all access.
• Signing out clears the local cache on that computer.

No system is perfectly secure, and this is a small early-access product. Please weigh that when you decide what to put here.

Children

Taskgrove is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, write to support@yalintech.com and we will remove it.

Changes to this page

If we change this policy we will update the date at the top, and a change that materially affects what we do with your data will be described here rather than quietly folded in. We send no email, so this page is the notice — it is worth reading again if you come back after a while.

Contact

support@yalintech.com for anything on this page. The terms cover the rest.