TaskWaffle Privacy Policy

Version 1.4, amended 17 October 2026 (section 6: Groq's training and retention terms, now reviewed) 21 October 2026 (section 2: the optional name; section 16: the age question) and 2 November 2026 (section 6: voice typing). Published 8 October 2026. Effective 8 October 2026.

This policy explains how TaskWaffle collects, uses, stores and discloses personal information.

TaskWaffle is provided by ALDEZARD (SMC-PRIVATE) LIMITED, a company incorporated in Pakistan, whose registered office is at House No. 182/2, Block-B, Muhala Military Accounts Housing Society, Lahore, Punjab, Pakistan. For data protection purposes the company is the controller of your personal data. Until 22 September 2026 the controller was Shaheer Ahmed, trading as TaskWaffle, who founded the company. The service, and your data with it, passed to the company unchanged: the same systems, the same processors and the same rules.

Contact for anything on this page, including privacy requests: contact@taskwaffle.com.

Version 1.0 of this policy described some things TaskWaffle intended rather than things it did. Several passages are narrower as a result. Version 1.2 is narrower again, and for a happier reason: three features were removed from the app, so three categories of data are no longer collected at all. Version 1.3 names the company that now runs TaskWaffle and one new processor, the service that sends account emails. Version 1.4 describes how we count visits to the public website, without cookies and without anything that identifies you. Section 14 lists every change in every version and says why.

1. The short version

Your data is yours. We do not sell it, we do not show you advertising, we run no third-party analytics, and we do not use your content to train models. TaskWaffle stores your workspace on your device first and syncs it to our servers so the same account opens elsewhere.

The assistant is the one part of TaskWaffle that sends your content to another company. It does nothing until you have chosen, module by module, what it may read. Section 6 is the whole story.

2. What we hold

Your account. Your email address, and your password held only as a hash by our authentication provider. We do not store your password in a form we can read, and our normal sign-in flow never shows it to us. If you choose to tell us what to call you, that name is stored with your account and shown in the app next to your email, so you can see which account you are signed in to. It is optional, you can change or remove it in Settings, and it is not sent to the AI assistant.

If you sign in with Google. Google tells us your email address, that Google has verified it, your name and a link to your profile picture. The email address becomes your account's address. The name and picture link stay in the sign-in record our authentication provider keeps and are not shown or used anywhere in TaskWaffle. We never see your Google password, and signing in this way gives TaskWaffle no access to your Gmail, Drive, Calendar or anything else in your Google account. Google knows that you signed in to TaskWaffle, under Google's own privacy policy. Connecting Google Calendar is a separate choice, described in section 7.

Your content. Whatever you put into TaskWaffle: tasks, events, timetable, goals, focus sessions, habits, trackers, lists, notes, ideas, reviews, journal entries, money records and reminders. The money module holds only what you type. TaskWaffle does not connect to a bank and does not ask for bank credentials.

No files. TaskWaffle does not accept file uploads and holds no file storage. Until 16 September 2026 the app contained a document vault; it was never reachable from any screen, held no files belonging to any account, and has been removed along with the storage it used. The same release removed the Contacts page and the Emergency card, so we no longer hold phone numbers, postal addresses, next-of-kin details, blood group, allergies or policy numbers either. Section 14 has the detail.

Your settings. Your appearance, which sections of the app you keep visible, and your assistant permissions are stored on your account so the app looks and behaves the same when you sign in elsewhere. A copy is kept in your browser so the app can paint before it reaches our server.

A history of your own edits. When you change or delete a record, the previous version is kept so you can look back at it in the app. See section 8 for how long.

Assistant conversations and actions. Your messages to the assistant and its replies are not stored on our servers as a transcript. What is stored is a record of each change you confirmed, which includes the details of that change, so there is an audit trail of what the assistant did to your workspace.

On your device. Because the app works offline, a copy of your workspace is written to your browser's storage on every device you sign into. That copy sits inside your browser profile and is protected by your device and browser, not by any additional TaskWaffle encryption. Section 9 says exactly what signing out does and does not remove.

Billing. If you subscribe, we hold your subscription status, plan, renewal date and the order identifier from our payment provider. Card details are entered with the payment provider and TaskWaffle does not receive or store card numbers through its normal payment flow.

Technical. A device identifier generated in your browser and sent with your requests so device limits work; push-notification subscriptions for devices where you turn reminders on; standard server logs including IP address, held by our hosting provider for security and abuse prevention; assistant request and token counts per day; and a record of which permission policy produced each assistant reply, by module name only.

Crash reports. Crash reporting is off unless a reporting key is configured. When it is on, our crash reporter receives a stable account identifier and technical error context. Request URLs are reduced, and headers, bodies, cookies, query strings, breadcrumbs and session replays are removed before anything is sent. Your account identifier means a crash report is linked to you, so it is personal data even though the text you type does not travel with it. You can turn crash reports off in Settings, under "Crash reports". The choice is per device and takes effect immediately; it does not recall a report already sent.

When you visit the public website (taskwaffle.com's pages, not the app once you are signed in), our own server counts the visit: the day, the page, the campaign or website that linked you there if there was one, and whether you are on a phone, tablet or computer. Nothing is stored on your device for this, no cookie is set, and we do not record your IP address, your browser details or any identifier, so a count cannot be tied to you. If your browser sends Global Privacy Control or Do Not Track, nothing is counted. When you then create an account in the same visit, we keep that campaign or referring website with your account, so we know which places bring people who stay.

If you join the waiting list instead of signing up, we store the email address you gave, which page it came from, the time, and a salted hash of your network prefix used only to stop one machine flooding the list. We do not store your raw IP address or your browser user agent, and no account is created.

3. What each thing is for, and why we are allowed to hold it

Where the UK and EU GDPR apply, this is the mapping. "Contract" means Article 6(1)(b), "legitimate interests" Article 6(1)(f), "consent" Article 6(1)(a) and "legal obligation" Article 6(1)(c).

What · Why we hold it · Legal basis · Who else sees it · How long

Email and password hash · To create and secure your account · Contract · Supabase · Until you delete your account

Your content and settings · To provide the app and sync it between your devices · Contract · Supabase · Until you delete it, then up to 30 days (section 8)

Edit history · So you can see and restore a previous version · Contract · Supabase · 90 days

Confirmed assistant actions · So there is a record of what the assistant changed · Legitimate interests: being able to answer "what did it do" · Supabase · 90 days

Assistant requests to the provider · To generate the reply you asked for · Consent (section 6) · Groq · See section 6

Assistant usage counts and policy records · To apply plan limits and to evidence which permission rule was applied · Contract, and legitimate interests in being able to show the rule · Supabase · 12 months

Device identifier · To enforce the device limit on the free plan · Contract · Supabase · Until you delete your account

Push subscriptions · To deliver the reminders you turned on · Consent · Your browser's push service · Until you turn reminders off, or the session on that device ends for any reason

Server logs including IP · Security, abuse prevention, rate limiting · Legitimate interests · Supabase · Held by Supabase under its own schedule

Crash reports · To find and fix faults · Legitimate interests · Sentry · Under Sentry's schedule for our project

Billing status and order id · To give you the plan you paid for · Contract · Lemon Squeezy · 12 months after the record is created, except where longer is required

Website visit counts (anonymous) · To know which pages and links bring visitors · Legitimate interests: running and promoting the service, with no identifiers · Supabase · 400 days

How you found us (campaign or referring site) · To know which places bring people who stay · Legitimate interests · Supabase · Until you delete your account

Waiting list entry · To send you one notice when TaskWaffle opens · Consent · Supabase · 30 days after that notice; 365 days if no notice is ever sent; or on request

Withdrawing consent does not make the processing we did beforehand unlawful.

Where we rely on legitimate interests, we have considered whether our reason outweighs your interests and rights. You can ask us to explain that assessment, and you can object, at contact@taskwaffle.com.

Tax records. Lemon Squeezy is the merchant of record for your purchase. Tax record-keeping for that sale is their obligation under the law that applies to them, not ours, and they keep those records under their own policy. Any obligation TaskWaffle itself has is under Pakistani law, and we do not present it here as an EU or UK legal obligation.

4. Who else processes it

Each of these is a separate company with its own role. A processor acts on our instructions; an independent controller decides for itself.

• Supabase (processor). Database, authentication and the server functions the app calls. Your records are held in the European Union (Frankfurt). Supabase's own logging, support and infrastructure may involve other locations; the Frankfurt region describes where your data is stored, not every place any related processing occurs.
• Groq, Inc. (processor), for AI inference, and only when you use the assistant and only for the modules you chose. Groq, Inc. is a company incorporated in Delaware with its principal place of business in California, and we send assistant requests to its United States endpoint (api.groq.com). We do not select a region and cannot tell you which data centre serves a given request. See section 6.
• GitHub, Inc. (processor). Our nightly backup runs as a scheduled job on GitHub's infrastructure, and the resulting archive is stored there as a build artifact for 30 days. The archive is encrypted before it leaves the job with a passphrase GitHub does not hold, so what GitHub stores is ciphertext; the job itself does hold our database credentials while it runs, which is why GitHub is named here rather than treated as a place files merely pass through.
• Resend (processor). Sends the account emails TaskWaffle sends you: the link that confirms your address, a password reset, and a sign-in link. It receives your email address and the content of that email, which is a link and a few lines of text, never anything from your workspace. We send through its European Union region (Ireland). Resend, Inc. is a company in the United States, so its own support and operations may involve access from there.
• Lemon Squeezy (independent controller for the sale). Payments, as merchant of record. They take and hold your payment details; we do not. Their own privacy notice governs what they do with them.
• Hostinger (processor). Serves the website files. It receives the ordinary connection information any web host receives, including your IP address.
• Sentry (processor). Crash and error reporting, reduced as described above, and only when a reporting key is configured.
• Google (processor for the calendar data we read), if and only if you connect your Google Calendar yourself. See section 7.
• Google Fonts. The site loads its typefaces from Google's font service. This happens on every page, including this one, whether or not you have an account, and Google receives your IP address and the page request as a result. We are working to serve these files ourselves.
• Your browser's push service. If you turn on reminders, the notification is delivered through whichever push service your browser uses, which will be operated by Google, Mozilla, Apple or Microsoft depending on your browser. The notification text includes the title of the event or reminder, so that text passes through that service and can appear on a lock screen.
• Currency rate services (open.er-api.com and api.frankfurter.dev). If you use more than one currency in the money module, your browser fetches published exchange rates directly from these services. They receive your IP address. They receive none of your records.

We do not add a processor that receives your content without updating this page.

5. Cookies and storage on your device

TaskWaffle sets no cookies and uses no tracking technologies. What it does use is your browser's own storage, all of it for the app to function:

What · Where · Why · How long

Sign-in session · localStorage · Keeps you signed in · Until you sign out

Your workspace copy · IndexedDB · Offline use and fast loading · Until you sign out deliberately, or delete the account

Device identifier · localStorage · Device limit on the free plan · Until browser data is cleared

Appearance, layout and dismissed prompts · localStorage · Remembers your preferences · Until browser data is cleared

Cached plan status · localStorage · So a paying user keeps working offline · Refreshed when online

App files and fonts · Cache storage · Offline loading · Fonts up to one year; app files replaced on update

Your appearance, the sections you keep visible and your assistant permissions are also stored on your account, not only here, so they follow you to another device. The copy in this table is a cache that lets the app paint before it has heard from our server.

Counting visits to the public website (section 2) adds nothing to this table: it stores nothing on your device.

None of this is shared with anyone or read by us. Some regions treat storing and reading information on a device as needing consent even when it is not a cookie; everything in this table is used to deliver a feature you asked for, and we do not use any of it for analytics or advertising.

6. The AI assistant

This, and voice typing when you choose it, are the only parts of TaskWaffle that send your content to another company.

It does nothing until you have chosen what it may read. The first time you use the assistant it stops and asks. That screen names Groq, says that what it reads and what you type are sent there, and lists every module with its own tick box. Every box starts empty, including ordinary ones such as Tasks and Calendar, because a box we ticked for you would not be your answer. The same screen asks separately whether you are 18 or over, because Groq's published terms require that. Nothing is sent until both are answered and stored.

A module you have not ticked is not read. Not summarised, not anonymised, not sent. This is applied by our server, which reads your stored permission itself rather than trusting the app, so a modified copy of the app cannot widen its own access. A request may ask for less than you allowed, never more. An account with no stored permission has every assistant request refused before anything is read and before anything is sent anywhere.

What is sent with a request. Your message; the recent conversation, up to about thirty turns, which means earlier messages in the same conversation are sent again with each new one; selected fields from the modules you ticked, with long free text shortened; any facts you asked the assistant to remember, if you ticked Memory; and, if you ticked Calendar and connected Google, your upcoming Google events.

Two things are sent whatever you tick, because a planning assistant cannot answer "tomorrow" without them: today's date and your time zone offset, and the names of the modules you did *not* allow, so the model is told it is working with less rather than inventing an answer for a module it cannot see. Neither carries any of your content. Nothing else is sent from a module you left unticked.

Some fields are exact rather than shortened: dates, times, amounts, currencies and titles go as written. Journal entries, reviews and note bodies are truncated.

Voice typing. The mic beside Quick capture and Notes has two ways of turning speech into text. If you have allowed the assistant (above, including the 18+ question), the first time you use the mic it asks whether to send your recording to Groq to be transcribed by its Whisper model. If you say yes, each clip you record (up to about three minutes) goes from our server to Groq, the words come back into the box you were typing in, and the recording is not stored by us. Groq's terms for it are the same as for the assistant, described under "What Groq does with it" below: no training, and fault or abuse logs for up to 30 days. No module is read for voice typing. If you say no, or have not allowed the assistant, the mic uses your browser's own speech service instead: in Chrome that sends the audio to Google's speech service and TaskWaffle only receives the words. Your choice is kept on that device; clearing the site's data asks again.

What the assistant can do. It proposes. Anything that would change your workspace is shown to you first and happens only when you confirm it. It cannot send an email, invite anyone to anything, write to your Google Calendar, or change anything outside your own TaskWaffle records. Confirmed changes are recorded server-side.

Changing your mind. Settings, then AI assistant, is where you change which modules are allowed or withdraw the permission entirely. Withdrawing puts the account back to refusing every assistant request. Withdrawal applies to anything sent afterwards; it cannot recall a request that has already gone.

When we ask again. If the module list changes, if the provider changes, or if what this page discloses about the assistant changes, the stored permission becomes stale and you are asked again from a blank sheet. This happened on 16 September 2026: three modules were removed from the app entirely, so the permission everyone gave against the longer list is void and everyone is asked once more. A module added to the app after you answered stays unavailable to the assistant until you are asked again. You will never find a new module switched on for the assistant because we added it.

What Groq does with it. Groq is a separate company in the United States. Our account is on Groq's standard Services Agreement, which we reviewed on 17 October 2026. Section 4.2 of it says Groq may not use what we send, or its replies, to train or fine-tune any model unless we instruct it to, and we have not. Groq's documentation says it keeps no customer data from a request by default, except logs it may keep for up to 30 days when it needs them to fix a fault or investigate abuse. We have not switched on Groq's zero-retention setting, so those logs can exist. We have no separately negotiated agreement with Groq; what applies is that standard agreement, which Groq can change.

What the permission cannot protect you from. If somebody is using your signed-in session, they can switch the modules back on. The permission governs what leaves the account. Keeping other people out of the account is what your password and your device are for.

7. Google Calendar

This is optional and off unless you connect it.

• What we ask Google for. Read-only access to your calendar events, plus your email address for identifying the connection. We request no permission to write, and the app makes no write calls.
• What we store. Access and refresh tokens, and a copy of the events we read so they appear alongside your plan offline. **Since 16 September 2026 the stored tokens are encrypted**, with a key held by our database provider and not present in any backup or export of the database itself, so a copy of our database that went astray would carry no usable Google credential. They are also protected by database access controls, which allow no application role to read them at all. Two narrower places are still plain: while a connection is being set up the tokens sit in a holding row for at most fifteen minutes, and when you disconnect the refresh token is copied into a short-lived queue so we can ask Google to revoke it, which is impossible without the credential itself. Both copies are deleted as soon as they have done their job.
• Where those events can go. If you tick Calendar in the assistant permission, your Google events are included in what the assistant sends to Groq. If Calendar is unticked, they are not.
• Disconnecting. Disconnecting deletes our stored tokens and clears the copied events from your device. We also ask Google to revoke the token, but Google does not confirm that to us, so we tell you plainly to check the third-party access list in your own Google account if you want certainty. Disconnecting does not delete anything you created in TaskWaffle from an event.

8. How long we keep it

These windows are enforced by a scheduled job, not by intention.

• Your content: until you delete it. A deleted record is recoverable for **30 days**, then permanently removed.
• Edit history: 90 days.
• Record of confirmed assistant actions: 90 days.
• Assistant usage counts and policy records: 12 months.
• Billing event records we keep for operational purposes: 12 months. Records the payment provider keeps as merchant of record are under their policy.
• Waiting list email: 30 days after we send you the launch notice, or when you ask, whichever is first. If we never send that notice, the entry is deleted after 365 days regardless, because consent cannot outlive the purpose it was given for.
• Deleted account: removed from our live systems when you ask, in one operation. Our nightly backup is kept for 30 days, so a copy can persist in an encrypted backup for up to that long before it expires. Backups are used only to recover from a failure, never for ordinary processing, and a deletion is reapplied if we ever restore one.
• Server logs and crash reports: held by Supabase and Sentry under their own schedules for our projects. We do not control those windows and do not state a number here that we cannot enforce.

9. Your device, signing out, and shared computers

Signing out deliberately, using the sign-out control, clears your workspace copy and your assistant module preferences from that browser. It does not remove your appearance settings, dismissed prompts, the device identifier, or the offline copy of the app itself, and it does not touch other devices.

If you are signed out involuntarily, because a session expired or you signed out elsewhere, the local copy is deliberately left in place so that edits you made offline are not lost before they sync.

Reminders stop either way. A reminder is delivered to the browser rather than to the session, and the notification carries the title of the event, so a browser left subscribed would go on showing one person's appointments to whoever used the machine next. Any sign-out, deliberate or not, unsubscribes this browser before anything else happens.

Each account gets its own separate local database, so signing in as a second person on the same browser does not show them the first person's records.

Signing out does not erase files you exported, anything in your device's backups, or copies you made yourself. On a shared or lost device, sign out deliberately, and clear site data in your browser if you want everything gone.

10. Your rights

If the UK or EU GDPR applies to you, you have the right to access your data, correct it, erase it, restrict or object to our use of it, and receive it in a portable form. Similar rights exist in other places.

Most of it you can do yourself, immediately, without asking:

• Export is in Settings, then Your data. It includes every record in your account. It is available on every plan, including the free plan and including an account that has stopped paying, and we do not restrict it.
• Deletion is in Settings. An active subscription does not block it. If you have a subscription that could still bill you, deleting your account cancels it with the payment provider first, so you are never left with a renewing charge and no way to stop it. If that cancellation fails, we stop and tell you rather than deleting the account and leaving the subscription running.

For anything you cannot do yourself, write to contact@taskwaffle.com.

Timing. We respond without undue delay and within the period the applicable law requires, which under the UK and EU GDPR is normally one month from when we receive the request. If an extension is permitted and necessary, we will tell you why and when, within that first month. We may ask for proportionate information to check you are who you say you are, and we will not use that as a way of delaying a request we can answer.

Scope. An access request covers your personal data. It does not extend to another person's data, or to security records where disclosing them would compromise the security of the service or somebody else. If we have to restrict something, we will say so and give you a way to get what you are entitled to.

If you are in the UK or the EU and you think we have got this wrong, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office.

11. Other people's information

Event details, task descriptions, notes and journal entries can contain information about people who never signed up to TaskWaffle. Only add information about someone else where you have an appropriate reason or permission to do so, and take particular care with anything sensitive about them. If your information has been added to somebody's TaskWaffle account and you want it addressed, write to contact@taskwaffle.com and we will deal with it.

12. Sensitive information

TaskWaffle does not ask you for sensitive information, but a planning app collects whatever you put in it. A task can name a hospital appointment, a calendar can name a religious service, a habit can be part of a recovery.

• We do not scan your records to detect or categorise this, and we do not filter it. We cannot promise to spot it, so we do not claim to.
• Storing and syncing your records is part of providing the account you asked for. If you are in a place whose law requires a further condition before sensitive information may be processed, your act of entering it into your own private workspace is the relevant one, and you can remove it at any time.
• Sending it to the AI provider is different, and it is why the assistant asks before it reads anything, why the modules most likely to hold sensitive material are the ones people most often leave unticked, and why we spell out above exactly which fields travel.

13. Sending data outside your country

Our database is in the European Union. Account emails are sent through Resend's European Union region; Resend is a United States company. Assistant requests are processed in the United States by Groq. Payments are processed by Lemon Squeezy. Crash reports go to Sentry. TaskWaffle itself is operated from Pakistan, which has no EU adequacy decision, which means the operator's own administrative access to the database is itself an international transfer.

We are not yet able to state the safeguard for each of those flows. Version 1.0 of this policy said the transfers rely on Standard Contractual Clauses in our agreements. We have not verified that for every flow, and we are not going to assert it until we have. We are collecting the executed agreements and will state each mechanism here, per flow, with the version moved so the change is visible. If you want to know where this stands for your own data, write to contact@taskwaffle.com and we will tell you what we have, including a redacted copy of an agreement where we are able to share one.

14. What changed, and what got narrower

We would rather you heard this from us than found it.

2 November 2026 (still version 1.4).

• Voice typing can use Groq. Section 6. Only if you allowed the assistant, and only after the mic asks you.

21 October 2026 (still version 1.4).

• An optional name. Section 2. You can tell us what to call you, and the app shows it with your email.
• One age answer at sign-up. The sign-up box now records that you are 16 or older, instead of asking which of three age bands applies. The assistant still asks its own 18+ question. Section 16.

Version 1.4, 8 October 2026.

• We now count visits to the public website. It is done on our own server, with no cookie, nothing stored on your device, no third party and no IP address or other identifier kept, and not at all if your browser sends Global Privacy Control or Do Not Track. Section 2 says exactly what is recorded.
• New accounts keep the link that brought them. If you arrive from a campaign link or another website and create an account in the same visit, that source is kept with the account. It applies only to accounts created from this version on; nothing is added to existing accounts.

Version 1.3, 22 September 2026.

• TaskWaffle is now run by a company. ALDEZARD (SMC-PRIVATE) LIMITED, set up by TaskWaffle's founder, is now the controller of your personal data in place of the founder as a sole trader. Your data stays where it was, with the same processors, under the same rules.
• Account emails now go through Resend. Until this version, the emails that confirm your address and reset your password were sent by our database provider's built-in mail service, which allows a handful of messages an hour and is not meant for a live product. They now go through Resend, named in section 4 as a processor. It receives your email address and the email itself, nothing from your workspace.
• You can sign in with Google. Section 2 says what Google tells us when you do (your email address, name and profile picture link) and what it does not give us.
• Nothing else about what we collect, why, or how long we keep it has changed. The Terms of Service moved to version 1.3 on the same day, for a change to the free plan that does not touch your personal data.

Version 1.2, 16 September 2026.

• Google Calendar tokens are now encrypted where they are stored. Added to this version later the same day, before anyone had accepted it. Until then this page said, correctly, that those tokens sat in ordinary text columns and were not separately encrypted. They now sit in an encrypted store whose key is held by our database provider and is not present in a backup or export of the database, so a stray copy of our database carries no usable Google credential. Nothing about what we ask Google for, what we read, or how long we keep it has changed; only how well the credential is protected. Section 7 says which two short-lived copies are still plain, and why.
• **Three features were removed, so three kinds of data are no longer held at all.** A document vault, a Contacts page and an Emergency card existed in the code but had never been reachable from any screen in the app. None of them held a single row belonging to any account. All three are gone, along with the file storage the vault used, and TaskWaffle now accepts **no file uploads of any kind**. We no longer hold, and cannot hold, phone numbers, postal addresses, next-of-kin details, blood group, allergies or policy numbers.
• The assistant's permission list is shorter, so everyone is asked again. Those three modules were on the consent screen, which means people were being asked to allow the assistant to read pages that did not work. Removing them makes every existing permission void by our own rule in section 6.
• Two recipients are now named that were not before. GitHub, because our nightly encrypted backup runs there and is stored there for 30 days, and Groq is now described precisely: a Delaware company operating from California, with requests going to its United States endpoint.
• Section 6 now says what is sent even when you tick nothing: the date, your time zone, and the names of the modules you withheld. It always was; we had not written it down.
• **Section 15 no longer claims that privileged database functions cannot be called by a signed-in user.** A small set of them can be, by design, and the section now says which and why.
• Reminders now stop on any sign-out, not only a deliberate one. Section 9.
• The waiting list has a hard end date even if we never write to you: 365 days.

Version 1.1, 15 September 2026.

• Retention now happens. Version 1.0 said content is kept until you delete it, logs for 90 days, assistant records for 12 months. None of that was implemented: nothing was ever purged. It is now, on a nightly schedule, at the windows in section 8.
• The assistant now asks first. Version 1.0 described module permissions as though you had chosen them. In fact most modules were readable unless you turned them off, and a module added later would have been readable without anyone agreeing to it. Everyone is now asked from a blank sheet.
• Deleting your account no longer requires cancelling first. It cancels for you.
• Signing out does less than we said. Section 9 now describes what it really clears.
• The waiting list holds slightly more than we said, and now has an end date.
• Three recipients were missing from the list: Google Fonts, your browser's push service, and the currency rate services.
• Two claims were withdrawn rather than repeated. We no longer assert Standard Contractual Clauses for every transfer, and we no longer state Groq's retention as a contractual guarantee, because we have not verified either. Both are marked in sections 13 and 6 and both will be resolved.

15. Security

Data in transit is encrypted. Access to your rows is enforced by row-level security in the database, which is enabled on every table, so one account cannot read another's. The assistant's module permission is applied on the server, which reads your stored permission itself rather than trusting the app.

On privileged database functions. Version 1.1 said a signed-in user cannot call them. That was too broad. A small number of helper functions are deliberately callable by a signed-in user, because the app needs the answers: what plan you are on, whether this device is within your device limit, whether you have accepted the current terms, whether your account is being deleted, and the one that records your acceptance. Each of them answers only about the caller's own account: they take no account identifier, they read your identity from your sign-in token, and there is no argument you can pass to point one at somebody else. Everything that writes on behalf of the assistant is owner-only and callable by no signed-in role at all.

Administrative access is limited to the operator named at the top of this page, together with the staff of our infrastructure providers under their own contracts and controls.

Backups are encrypted with a passphrase held outside the systems being backed up.

No service is perfectly secure. If a personal data breach occurs we will assess it and notify the relevant supervisory authority and affected individuals where the applicable law requires, within the time that law requires. Under the EU and UK GDPR that is generally 72 hours to the authority for a reportable breach, and without undue delay to individuals where the risk to them is high.

16. Children

TaskWaffle is for people aged 16 and over. The assistant is for 18 and over, because the AI provider's terms require it, and it asks separately. Everything except the assistant works either way.

Age is self-declared at sign-up and recorded. We do not ask for a date of birth or any proof, because collecting identity documents to police an age limit would create a worse privacy problem than the one it solves. If we learn that an account belongs to someone under 16 we will delete it, and if we have got that wrong you can tell us at contact@taskwaffle.com and we will put it right.

17. Getting your data back

Your exported archive can be imported again, in Settings, then Your data, then Import. It shows what it would change before it writes anything, merges by record rather than overwriting, and does not replace something newer than what is in the file. An archive from a different account is imported as a transfer, with new identifiers, and cannot reach the other account's data. An older archive that still contains uploaded files will tell you those files were skipped, because there is nowhere to put them any more.

Note that an import can restore your saved assistant module choices, so importing an old archive can widen what the assistant may read. Check Settings afterwards.

Said plainly, because this is the part that matters: restore has been tested by us, not by years of real accounts on real devices. Keep an independent copy of anything you cannot afford to lose, and do not rely on export and re-import as your only route back.

18. Changes

We publish changes here with a new version number and date. Where a change materially affects you, we will tell you by email at least 30 days before it takes effect, unless a change is needed sooner to meet a legal or security requirement, in which case we will make it and explain it. Where a change needs your consent, we ask for it rather than treating notice as agreement. A change does not apply retroactively to something that already happened.

Contact

contact@taskwaffle.com ALDEZARD (SMC-PRIVATE) LIMITED House No. 182/2, Block-B, Muhala Military Accounts Housing Society, Lahore, Punjab, Pakistan