TaskBuzz Privacy Policy
Last updated: 25 May 2026
TaskBuzz (“we”, “us”, “our”) operates the TaskBuzz mobile application (the “App”). This policy explains what data we collect, why we collect it, and the rights you have over your data.
Contact: support@taskbuzz.org
1. Data we collect
| Category | Data | Why we need it | Required? |
|---|---|---|---|
| Account | Phone number (E.164 format) | To create and sign you in to your account via Firebase phone OTP. One account per phone number. | Required |
| Account | Display name | Shown on your profile and when friends see your shared tasks. | Required |
| Account | Short status text (optional) | Shown on your profile if you set one. | Optional |
| Device | Firebase Cloud Messaging (FCM) token | To deliver push notifications for assigned tasks and Buzzes. | Required for notifications |
| Contacts | Phone numbers from your device contacts | Matched locally or via hashed lookup to let you find friends who already use TaskBuzz. We never upload your full contact list, names, emails, or photos. | Optional — only if you grant the permission |
| Content | Task lists, tasks, due dates, recurrence schedules, priority, assignments you create | To store and sync your tasks across devices. | Required (you control what you enter) |
| Content | Comments you post on tasks (text, author, timestamps) | To support the per-task conversation feature. Visible to the task’s creator, current assignee, and (for tasks on shared lists) accepted members of the parent list. | Required (only created when you post a comment) |
| Content | Friend relationships | To support the friend-request, task-sharing, and Buzz features. | Required (you initiate each friendship) |
| Content | Shared task list memberships (which lists you’ve been invited to or joined) | To support shared task lists where multiple users collaborate on the same list. Stored as a row linking your user ID to a list ID with a status of pending or accepted. | Required (only created when an owner invites you) |
| Usage | Buzz send/receive log (sender, receiver, task, timestamp) | To enforce rate limits (2 buzzes per task per day) and show you how many Buzzes you have sent and received. | Required |
| Technical | App version, OS version, anonymous crash stack traces | Sent to Google Firebase Crashlytics so we can diagnose crashes and improve reliability. No task content, list titles, or messages are included. | Required |
1.1 Shared task lists — what other members see
When you join a shared task list, other members of that list see:
- Your display name.
- Tasks you create or are assigned to in that list, plus your status updates on those tasks.
- Your name attached to any task you create or assign while you are in the list (this is how “By X → assigned to Y” attribution works inside a shared list).
- Comments you post on tasks in that list — see section 1.3 for the full rules.
Other members do not see your phone number, your friends list, your other task lists, or any data outside the shared list.
Names of co-members are visible by default so it is clear who is in the list — even if they are not in your friends list. Your phone number is never shown to co-members who are not your friend. If you and a co-member are not friends, you can send them a friend request inline from the assign sheet without ever seeing their phone number; the request is processed by user ID against the shared list you are both part of.
Only the task’s creator or the list owner can assign a task to another member. Any other member can self-assign (“take”) a task or unassign themselves.
When you leave a list, are removed from it, or unfriend the list owner, your membership is deleted, your assignments in that list are cleared, and the authorship of any tasks you created in that list transfers to the list owner. The tasks remain in the list so the other members keep their workflow, but they're no longer attributed to you. You lose access immediately.
If you are the list owner and you remove every other member, the list becomes effectively private again and any task you had assigned to yourself is automatically unassigned (a self-assignment in a one-person list isn’t meaningful).
1.2 Pasting tasks from your clipboard
The “Paste tasks” feature reads your device clipboard once when you open the dialog, splits the text by line, and shows the resulting list for your review. Only the task titles you confirm are sent to our servers; the raw clipboard content is never transmitted. iOS and Android each show their own system-level “pasted from…” indicator when an app reads the clipboard.
1.3 Comments on tasks
Every task has a built-in comment thread. Anyone who can see the task — the task’s creator, its current assignee, the list’s owner, and (for tasks on shared lists) all accepted members of that list — can read and post comments on that task. Other people cannot read or post on a task they don’t have access to.
When you post a comment:
- The text, your user ID, and the timestamp are stored on our servers.
- The text is encrypted at rest (see section 2).
- A push notification is sent to the other people with access to the task (task creator, current assignee, prior commenters on the thread, and — for shared lists — up to 50 accepted members other than you).
- Editing a comment is allowed only by the original author.
- Deleting a comment is allowed by the original author or by the parent list’s owner (so list owners can moderate their shared lists).
Deleted comments leave a tombstone (“X deleted a message”) in the thread so the conversation gap reads cleanly. The original text is removed from API responses and cannot be read or restored from within the app after deletion.
Read-state is local. Whether you’ve “seen” a particular comment is tracked on your device, not on our server, so there is no cross-device read-receipt and we cannot tell who has or has not read which comment.
1.4 What we DO NOT collect
- We do not collect your precise or approximate location.
- We do not collect your device contacts’ names, emails, photos, or anything beyond phone numbers you look up.
- We do not sell any data to third parties.
- We do not show advertising, and we do not use advertising SDKs.
2. How we store and protect your data
- Encryption in transit. All traffic between the App and our servers uses HTTPS / WSS (TLS 1.2+).
- Encryption at rest. Sensitive fields are encrypted at rest in our database using AES-256-GCM. This includes your phone number, push notification tokens, the content of your task lists and individual tasks (titles and descriptions), and the content of comments you post. A separate salted SHA-256 hash of your phone number is stored solely for efficient friend lookup — the plaintext is never queried directly.
- Access controls. Our servers authenticate every request with a short-lived signed token. Sessions can be revoked at any time by signing out.
- Rate limiting and abuse protection. Sensitive endpoints are rate-limited per user and per IP.
- Hosting. Application servers and managed databases run on cloud infrastructure based in the United States.
3. Third-party services we use
| Provider | Purpose | Data shared |
|---|---|---|
| Google Firebase Authentication | Phone-number verification via SMS OTP | Phone number |
| Google Firebase Cloud Messaging (FCM) | Push notifications to Android devices | FCM registration token, notification payload |
| Google Firebase Crashlytics | Anonymous crash reporting and diagnostics | Stack traces, app version, OS version, device model. No task content or messages. |
| Apple Push Notification service (APNs) | Push notifications to iOS devices | APNs device token, notification payload |
Each provider processes data under its own privacy policy:
- Google / Firebase: https://policies.google.com/privacy
- Apple: https://www.apple.com/legal/privacy/
4. Data retention
- Account data (phone number, display name, profile fields) is kept while your account is active.
- Tasks, task lists, and friendships are kept until you delete them or delete your account.
- Comments are kept for the life of their task. If a comment is deleted, a tombstone row remains so the thread reads cleanly; the original text is no longer returned by our API. The full row is removed when the parent task is deleted or when you delete your account.
- Buzz logs are kept for 90 days, then automatically purged.
- Sessions are kept until they expire or you sign out.
When you delete your account we erase your personal data within 30 days. Backups that may contain historical copies are purged on our standard 35-day backup-retention cycle.
5. Your rights and controls
- Access / export. Contact support@taskbuzz.org to request a copy of the personal data we hold about you. We respond within 30 days.
- Correction. Update your display name or status directly in the App (Profile → Edit display name).
- Delete your account. Open the App and go to Profile → Delete account. After a two-step confirmation, your user record, tasks, task lists, friendships, comments you authored, buzz log, and push tokens are removed. Tasks you created that were assigned to a friend become unassigned for that friend (their copy of the task stays intact so their workflow is not broken). For assisted deletion if you have lost device access, email support@taskbuzz.org.
- Revoke contacts permission. Any time, via Android Settings → Apps → TaskBuzz → Permissions.
- Revoke notifications. Any time, via the system notification settings.
6. Children
TaskBuzz is not directed to children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has created an account, email support@taskbuzz.org and we will delete it.
7. International transfers
If you use TaskBuzz from outside the United States, your data is transferred to and processed in the United States, where privacy laws may differ from your home country. By using the App you consent to that transfer.
8. Changes to this policy
We will post any changes to this page and update the “Last updated” date. Material changes will be announced via an in-app notice at least 14 days before they take effect.
9. Contact
Privacy questions, access requests, and deletion requests:
support@taskbuzz.org