Privacy

Taskgrove is a shared task board. You make boards, lists and cards, you write things on them, and other people in your workspace can read and change them. This page says what we store, where it is stored, who else can see it, and what you can get back or have removed.

A note on what this document is. It was written by reading the product and describing what it does, and it has not been through a lawyer’s review. We would rather publish something short and accurate than something long that describes a product we do not have. Where a thing is not built, this page says so.

Who we are

Taskgrove is a Yalintech product. For anything on this page — privacy questions, a copy of your data, or deletion — write to support@yalintech.com. That is the only address, and it reaches a person.

What we store

Your account. Through Google’s Firebase Authentication: your email address, and either a password (hashed and held by Google, in a form we cannot read) or the link to your Google account if you signed in with one. Whether your address is verified, and the usual account timestamps Google keeps.

Your profile. A record of our own holding your display name (up to 60 characters), your avatar address if your sign-in provider gave one, your locale, your light/dark and compact/comfortable preferences, the last workspace you had open, and which one-time tips you have already been shown.

What you put on your boards. This is the bulk of it, and it is whatever you type: workspace, board, list and label names; card titles, descriptions and checklist text; comments. Alongside it we store the structure — which list a card is in, its order, labels, priority, due date, cover colour, and whether it is active, archived or trashed — plus who is assigned and who is mentioned, as account identifiers, and who created or last changed each thing, and when.

Free text is free text. If you type a client’s name, a phone number or a price into a card description, we store it, because that is what a card description is. We do not scan it, index it for anyone outside your workspace, or use it to train anything.

Activity history. Each creation, move, rename, priority change and due-date change writes a short row: the kind of change, who made it, when, which board and card, and a one-line summary composed on our side. This is what card history is made of, and these rows are kept indefinitely — they are deliberately excluded from every automatic expiry, because the point of a history is that it is still there later.

Notifications. When you are mentioned or assigned, we write a record to your account: the kind, the workspace, board and card it points at, a title composed on our side, who did it, when, and whether you have read it.

Invitations. When an admin invites someone we store the invitee’s email address, a SHA-256 hash of it used only as an internal de-duplication key, the role offered, who sent it, the workspace name at the time, the created, expiry, accepted and revoked timestamps, and whether and when the invitation email was sent. Invitations expire after 14 days. The record is server-only: no browser can read it, including the workspace owner’s.

API tokens and connected apps. If you create an API token we store its label, the workspace and permissions it is for, a hash of it and its first few characters, and when it was made, expires, was revoked and was last used (a day, not a time). If you connect an app — an AI assistant, for example — we store the connection: the name the app gave itself, the web address it returns to, the workspace and permissions you approved, and the same dates. The credentials the app is issued are stored only as hashes.

Counters. Per-workspace tallies — how many active boards, members and pending invitations, plus write-rate counters that stop runaway automation — and a few “first time this happened” timestamps. Numbers and dates, not content.

What we do not store.

• No IP addresses or browser user-agent strings in our database, with one narrow exception. The endpoints an app uses to connect to Taskgrove are reached before anyone has signed in, so to rate-limit them we keep a small counter whose name is computed from the caller’s IP address and a random key that we replace every day. The address itself is not stored, and each day’s key is deleted when the next one is made, after which nobody — including us — can work back from a counter to an address. Nothing else in our application code reads or records an IP address or a user-agent. Google’s infrastructure logs requests as part of running the service, and those logs do contain IP addresses — see the next section.
• No files. Attachments are switched off and the storage bucket denies every read and write.
• No payment details. There is no payment path in the product at all — no card form, no processor, no subscription.
• No location data, no contacts, no device identifiers.

Where it is stored

Everything is in Google Cloud, in the United States, in a Firebase project we control.

• Boards, cards, comments, activity and profiles — Cloud Firestore, in the us-central1 region.
• Accounts, passwords and sign-in — Firebase Authentication, on Google-managed infrastructure in the US.
• The website and the server-side logic — Firebase Hosting and Cloud Functions, in us-central1.
• Operational logs — Google Cloud Logging, in the US. These are the platform’s own request logs and they contain IP addresses.

The database has point-in-time recovery enabled with a seven-day window, and delete protection turned on, so a mistake on our side or a bad deploy can be rolled back within that week. That is a safeguard against our own errors; it is not a personal backup service, and it does not undo something you deleted yourself.

If you are outside the United States, using Taskgrove means your data is stored and processed in the United States, by Google on our instructions.

Who else can see it

Google. Google is the only company we have engaged to process your data. It runs the database, the sign-in system and the servers, carries every email described below, and runs reCAPTCHA Enterprise, which the section on your browser below describes. The product’s own code libraries — the web framework, the text editor, Firebase’s libraries, a validation library and a mail library that hands invitation and notification emails to Google’s Gmail servers — make no connection to anyone else. There are two ways data leaves for somewhere other than Google, and both are started by a person, not by us: an app somebody connects, and an image somebody puts in a card. Both are described below.

People in your workspace. A shared board is shared, and this is the part that matters most in practice. Owners, admins, members and observers can see the workspace’s boards, lists, cards, descriptions, checklists and comments — except a board that has been made private, which only the people added to it and the workspace’s owners and admins can open. A guest can open only the boards they have been added to. Owners, admins, members and observers see the display name and avatar of every other member. Every change is attributed to you by name in the card’s history, and that history is kept indefinitely. Owners and admins can invite and manage; members, and guests on their boards, can edit; observers can read and nothing more. Owners and admins can also download the whole workspace as one file — every board, card and comment in it, including yours, and each member’s name and role, but no one’s email address.

Apps you or your teammates connect. A person can give an outside app — an AI assistant such as Claude, or a script of their own — access to one workspace, by approving a connection or by creating an API token. That app can then read, and change if the person allowed it, whatever that person can reach in the workspace: the boards, lists, cards, descriptions, checklists and comments on them, including what other members wrote, and the names of the people on them. We send it what it asks for through that connection and nothing else. What the app then does with it is up to its provider and is covered by that provider’s terms, not ours. So if you share a workspace, your cards and comments can reach an app a teammate connected. Your own connections and tokens are listed under Your account, where you can disconnect or revoke each one; it stops working on the app’s next request.

Images in card descriptions. A description can show an image by its web address. When someone opens that card, their browser fetches the image from wherever it is hosted, so that host learns their IP address and when. We send it no referring address, and we do not copy or store the image.

There is no user directory. Nobody can look you up, search for you, or learn that you have an account, unless you share a workspace with them or they hold an invitation addressed to your email address.

Nobody else. We do not sell your personal information. We do not share your task content with advertisers or data brokers. Optional product analytics goes to Google as described below, and we do not use it to train machine-learning models. We have no affiliates or resellers to pass it to. We would disclose data if we were legally compelled to, and where we are permitted to tell you, we will.

Email

We send no newsletters, marketing or digests. Exactly four kinds of message exist. Two are sent by Google’s Firebase Authentication and triggered by you: the address-verification message when you sign up or ask for it again, and the password-reset message when you ask to reset your password.

The third is an invitation. When an admin of a workspace invites your email address, Taskgrove emails that address, through Google’s Gmail: the message names the person who invited you, the workspace, the role you are offered and when the invitation expires, and carries the link to accept it. An admin can resend the same invitation a few times if it did not arrive; nothing else is sent to an invited address, and no message is sent after the invitation is accepted, revoked or expired. The link works only for the address it was issued to, and only for someone signed in with a verified account at that address. If the email does not go out, the invite screen tells the admin so and gives them the link to send themselves.

The fourth is a notification email. When a card is assigned to you, someone mentions you in a comment, a card assigned to you is due soon or overdue, or (if the board has it on) a card you follow gets a comment or moves to another list, Taskgrove can email your sign-in address, through Google’s Gmail. The email carries the card’s title and a link to it; for a mention or a comment it also carries the text of that comment and its author’s display name, and for a move it names the list the card moved to. It does not carry the card’s description. Replies to your comments are not emailed. It is on by default for workspace members and off by default for guests, and you can turn it off, or on, under Preferences → Notifications; a notification kind you switch off there is not emailed either. It is only sent to an address you have verified.

Analytics, cookies and browser storage

Analytics cookies are optional. There is no advertising. We load Google Analytics 4 using Advanced Consent Mode on eligible visits. Before you choose, and if you continue without analytics cookies, Google receives sanitized cookieless measurement requests with analytics storage denied. Allowing analytics cookies changes analytics storage to granted. Either choice leaves advertising storage, advertising user data and ad personalisation denied and does not affect your use of Taskgrove.

We send route templates and product events from a closed list of thirty-one event types. For example,/w/acme/board/aG7xK2 is reported as/w/[wsSlug]/board/[boardId]. We do not send account IDs, Firebase installation IDs, card titles, comments, names, email addresses, search terms, external referring domains or raw page addresses. Google receives your IP address, timestamp, screen and browser information when your browser contacts its servers; its tag may include temporary or random identifiers in cookieless measurement requests. We do not describe those requests as anonymous or identifier-free.

Analytics storage stays denied unless you allow analytics cookies, so the tag does not write analytics cookies before that choice or after rejection. If you allow them, Google may create the pseudonymous _ga cookies listed below; these are not Taskgrove account identifiers. Google Signals, ad personalisation, advertising consent and automatic enhanced measurement remain disabled. Do Not Track and Global Privacy Control stop measurement entirely, even after a previous grant. Your choice is stored only in this browser; clearing browser storage asks you again. Event data in our Google Analytics property is retained for 14 months and processed by Google in the United States.

reCAPTCHA and App Check. The home page, this page and the terms do not load reCAPTCHA. The analytics tag is separate and follows the consent behavior above. The sign-in, sign-up, password reset, email verification, invitation and connect-an-app pages, and every page inside the app load Google’s reCAPTCHA Enterprise, through Firebase App Check: a check that requests reaching our servers come from the real Taskgrove site rather than from a script imitating it. It runs invisibly — there is no puzzle — and it works by collecting information about your browser and device and how the page is used, which it sends to Google. Google’s Privacy Policy and Terms of Service apply to that. It sets the cookie and storage entries marked as Google’s below.

These are the other sites your browser contacts because of a Taskgrove page:

• www.googletagmanager.com — Google Analytics. Loads the analytics tag under Advanced Consent Mode. Contacted on every eligible page; DNT and GPC remain complete stops.
• www.google-analytics.com — Google Analytics. Receives sanitized product events and route templates, cookieless while analytics storage is denied. Contacted on every eligible page; DNT and GPC remain complete stops.
• region1.google-analytics.com — Google Analytics. Regional endpoint for the same measurement. Contacted when selected by the Google tag.
• www.google.com — Google (reCAPTCHA Enterprise). Loads reCAPTCHA's script and its invisible frame. Contacted on the sign-in, sign-up, password reset, email verification, invitation and connect-an-app pages, and every page inside the app.
• www.gstatic.com — Google (reCAPTCHA Enterprise). reCAPTCHA's code and styles. Contacted on the sign-in, sign-up, password reset, email verification, invitation and connect-an-app pages, and every page inside the app.
• fonts.gstatic.com — Google. A font the reCAPTCHA frame loads for itself. Contacted on the sign-in, sign-up, password reset, email verification, invitation and connect-an-app pages, and every page inside the app.
• csp.withgoogle.com — Google (reCAPTCHA Enterprise). Where reCAPTCHA's own code reports its security-policy errors to Google. Contacted on the sign-in, sign-up, password reset, email verification, invitation and connect-an-app pages, and every page inside the app, occasionally.
• content-firebaseappcheck.googleapis.com — Google (Firebase App Check). Exchanges the reCAPTCHA result for an App Check token. Contacted on the sign-in, sign-up, password reset, email verification, invitation and connect-an-app pages, and every page inside the app.
• identitytoolkit.googleapis.com — Google (Firebase Authentication). Signing in, signing up, password reset and verification. Contacted when you sign in or change your account.
• securetoken.googleapis.com — Google (Firebase Authentication). Keeps your session's short-lived token fresh. Contacted while you are signed in.
• firestore.googleapis.com — Google (Cloud Firestore). Reads and writes your boards. Contacted from pages inside the app.
• us-central1-taskgrove-prod.cloudfunctions.net — Google (Cloud Functions, run by us). Taskgrove's own server functions — creating boards, invitations, export and so on. Contacted from pages inside the app.
• accounts.google.com — Google. The Google sign-in window. Contacted only if you choose Continue with Google.
• apis.google.com — Google. Code Firebase Authentication loads to open the Google sign-in window. Contacted only if you choose Continue with Google.

Cookies.

• _ga / _ga_… — set by Google Analytics (taskgrove.app). Pseudonymous analytics client and session identifiers. Created only after you allow analytics cookies; never contains a Taskgrove account id. Kept: up to 2 years, refreshed while analytics cookies remain allowed.
• __session — set by Taskgrove (taskgrove.app). Value 1. Tells the site you are probably signed in, so you get a sign-in page instead of an empty app screen. It carries no account identifier, no role and no signature, and nothing makes a security decision from it. Kept: 30 days, cleared when you sign out.
• _GRECAPTCHA — set by Google reCAPTCHA (www.google.com). Set by Google's reCAPTCHA on its own domain while it checks that the request comes from the real Taskgrove site (see App Check below). Kept: about 6 months.

Choosing Continue with Google opens Google’s own sign-in window, where Google’s cookies apply. Our analytics banner asks whether analytics cookies may be used; disclosed cookieless measurement starts with storage denied. Sign-in, security and preference storage are listed separately from optional analytics below. None of it is used for advertising.

Browser storage. These live in your own browser. Taskgrove’s entries are not sent anywhere; the Firebase and reCAPTCHA entries are used by those libraries to talk to Google as described above.

• tg-theme — set by Taskgrove. Light, dark or follow the device. Kept: until you clear it.
• tg-density — set by Taskgrove. Compact or comfortable. Kept: until you clear it.
• tg.firstTouch — set by Taskgrove. Two words from a fixed list describing roughly how you first arrived, such as search|organic or direct|none. Written on your first visit before any analytics choice; the referring address is classified and discarded, and is not stored or sent. Kept: until you clear it.
• tg.firstTouchReport — set by Taskgrove. The first landing page type, whether you arrived from another site, and whether that coarse attribution has been reported after your analytics permission. No page address or identifier is stored. Kept: until you clear it.
• tg.verifyPending — set by Taskgrove. Only when analytics is on: the internal id of an account this browser has seen with an unconfirmed email address, so that confirming it is counted once. Removed when the address is confirmed; never sent. Kept: until the address is confirmed.
• tg.analytics — set by Taskgrove. Your analytics-cookie choice: on permits analytics storage; off keeps it denied while disclosed cookieless measurement continues. Kept: until you clear it.
• tg.boardView.… — set by Taskgrove. Which view (board or table) you last used on a board, per board. Kept: until you clear it.
• tg.command.recents.… — set by Taskgrove. The last few commands you ran from the command palette, per account, so they are offered first. Kept: until you clear it.
• firestore_zombie_… — set by Cloud Firestore. A time stamp the database library leaves when a tab running the app closes, so the next tab knows that tab's offline copy is no longer in use. Kept: until the library clears it.
• _grecaptcha — set by Google reCAPTCHA. reCAPTCHA's own working value for the App Check check. Kept: until you clear it.
• firebaseLocalStorageDb — set by Firebase Authentication. Your signed-in session, so you stay signed in. Kept: the session is removed from it when you sign out.
• firestore/[DEFAULT]/… — set by Cloud Firestore. A copy of the boards you have opened, so the app loads fast and works offline. Taskgrove wipes it when you sign out. Kept: until you sign out.
• firebase-app-check-database — set by Firebase App Check. The short-lived App Check token, so it is not fetched on every page. Kept: the token is short-lived; the store stays.
• firebase-heartbeat-database — set by Firebase. A per-day note of which Firebase library versions this browser used (no account or content), sent to Google with Firebase requests. Kept: at most 30 daily entries.
• rc::… — set by Google reCAPTCHA (inside its www.google.com frame). reCAPTCHA's own short working values. Kept: some for the tab, some until cleared.

When you sign out, Taskgrove clears the __session cookie, signs your browser out of Firebase and wipes the Firestore copy of your boards, so the next person using the same computer does not find your boards in it. The other entries above stay until you clear this site’s data in your browser.

Your rights

Wherever you are, and in the UK and EU as a matter of law, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the data we hold for you;
• give you your data in a portable form — there is now a control for this in the product; see below for exactly what it hands you;
• stop or limit a particular use of it, or object to it.

Write to support@yalintech.com and we will answer within one month. If you are in the UK or EU and you are not satisfied with how we handled it, you can complain to your national data protection supervisory authority; in the UK that is the Information Commissioner’s Office.

On portability. Your account → Your data → Prepare my export produces a single JSON file and hands it straight to your browser. It is built when you ask for it, it is not stored anywhere afterwards, and there is no link that keeps working once you close the page. The section below says exactly what is in it. If your account is large enough that one file cannot carry it, the control refuses and says so rather than giving you a partial file that looks complete — and in that case, email support@yalintech.com and we will assemble it another way.

Deleting your data

What you can delete yourself. Cards, lists and boards go to Trash, where they stay for 30 days and can be restored by anyone who can edit the board. A scheduled job runs every 24 hours and permanently removes anything past its 30 days, taking the card’s description, checklist, comments and activity with it. That window is the same 30 days for every account. One deliberate safety behaviour: if you trash a list but some of its cards are still live, the purge refuses rather than taking cards you did not delete.

Deleting your account. Your account → Delete account. It runs immediately, it is not a request to us, and there is no recovery window — the control says so before you confirm. One case is refused rather than obeyed: if you are the only owner of a workspace other people are in, we stop and name those workspaces, because deleting your account would strand everybody else’s work. Transfer ownership or delete the workspace first.

Deleting a workspace. Preferences → Workspace → Delete this workspace, for workspaces you own. Also immediate, also not reversible.

What deletion does not reach. Content you wrote inside a workspace somebody else owns is part of their working record and stays there. Your name is removed from it — those rows keep an opaque account id and no display name — but the words remain. Activity history is kept by design. We would rather say this plainly than imply a deletion is more total than it is.

Taking a copy first. Your account → Your data hands you a single JSON file containing what we hold for you: your profile and sign-in details, your notifications, the labels and dates of any API tokens you made, the apps you connected and when, and your workspaces. A workspace you are the only person in comes out in full — boards, lists, cards, descriptions, comments, history and Trash. In a workspace you share with other people you get everything you wrote there — your cards, your comments, your activity — together with the board, list and card names that give them context. Other people’s cards and comments in that workspace are their data in someone else’s record, so they are not in your file; the file itself lists what it leaves out and why. Token secrets are not in it either: we do not hold them, and the hashes that identify a token or an app’s credential are left out deliberately because an exported file travels further than a screen does.

If it will not fit, we refuse rather than trim. The export is built and returned in one request, so a very large account can exceed what that request can carry. When that happens the control says so and gives you nothing, instead of a shortened file that looks complete — a partial copy is worst exactly when you need it, which is after the original is gone. In that case, email support@yalintech.com and we will assemble it another way. The same address is the route for anything the control does not cover, including content you wrote inside a workspace somebody else owns and has since removed you from.

Security

• Everything sits behind Firestore security rules that deny by default. There is no rule in the product that grants a broad read; access is granted only to members of the workspace a document belongs to.
• Your profile is readable only by you. Other members of your workspace see a separate, small projection of your name, avatar and role.
• API tokens, and the credentials a connected app is issued, are stored as hashes. We cannot recover one; a lost token is revoked and replaced.
• Invitation records and every other server-only collection are unreadable by any browser.
• The file-storage bucket denies all access.
• Signing out clears the local cache on that computer.

No system is perfectly secure, and this is a small early-access product. Please weigh that when you decide what to put here.

Children

Taskgrove is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, write to support@yalintech.com and we will remove it.

Changes to this page

If we change this policy we will update the date at the top, and a change that materially affects what we do with your data will be described here rather than quietly folded in. We do not email you about changes, so this page is the notice — it is worth reading again if you come back after a while.

Contact

support@yalintech.com for anything on this page. The terms cover the rest.