Privacy Policy

Last updated: 16 August 2026

TaskPin is an Android app that pins your due Google Tasks to an ongoing notification. This policy explains exactly what data the app and its backend handle, why, where it is stored, and how to get it deleted. It covers the Android app com.gettaskpin.taskpin and the TaskPin backend service.

TaskPin is operated by the developer of TaskPin, reachable at privacy@gettaskpin.com. For the purposes of the GDPR, we are the data controller for the data described below.

1. What we collect, and why

Data	Why	Where it lives
Your email address, first name and display name, and your Google account identifier (the stable `sub` value)	To sign you in and to identify your account on our backend	On your device; the account identifier is also stored on our backend as your user key
A Google ID token	Proves to our backend that a request really comes from you	On your device only; sent with each backend request, never stored by us
A Google OAuth refresh token for Google Tasks	Lets our backend check your tasks on a schedule so pins can update while the app is closed	On our backend, encrypted (see Security). Never stored on your device
A push notification token for your device (Firebase Cloud Messaging)	So we can deliver pin and unpin updates to that device	On our backend, and on your device
Your pin settings and time zone — whether to pin tasks due today, which lists you always pin, and your device's time zone name	The backend needs these to work out which tasks are due for you	On our backend, and on your device
Your task content — title, notes, due date, and list name	To decide what to pin and to render the notification text	Cached on your device. On our backend this is processed in memory only and not stored — see below

On task content specifically. Our backend reads your Google Tasks, works out which ones should be pinned, and sends the resulting notification content to your device as a push message. Task titles, notes, and due dates pass through the backend in the course of doing that, but they are not written to our database. What we do keep is a small record of which task identifiers are currently pinned and why, so we can tell when something has changed and avoid sending you duplicate notifications.

We do not collect your location, contacts, photos, files, calendar, messages, health or financial information, browsing history, or an advertising identifier. TaskPin contains no analytics SDK, no crash-reporting SDK, and no advertising SDK.

Android permissions

The only permission TaskPin asks you to approve is permission to post notifications, which is how the app does its one job. The remaining permissions it declares are granted automatically and exist so push messages and the background refresh can be delivered reliably: internet access, network state, wake lock, foreground service, and start-on-boot. None of them give TaskPin access to your location, contacts, storage, camera, or microphone.

2. Google account and Google Tasks access

Signing in uses Sign in with Google. Separately, TaskPin asks your permission for the Google Tasks scope https://www.googleapis.com/auth/tasks, which allows reading and modifying your task lists. TaskPin uses that access to read your tasks in order to decide what to pin, and to write back the changes you make from the notification — such as marking a task complete.

Because pins need to stay correct while the app is closed, TaskPin's backend holds an encrypted Google refresh token and uses it to check your tasks on a recurring schedule, currently about once a minute. It fetches only your task lists and tasks. No other Google service is accessed.

TaskPin's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide the app's features or to comply with the law, and we do not allow humans to read it except with your explicit consent, to resolve a specific support request you have raised, for security purposes, or where required by law.

We do not sell your data and we do not share it with advertisers or data brokers. We do not use your data to train machine-learning models. The only third parties involved are the infrastructure providers that run TaskPin on our behalf:

Google Cloud Platform / Firebase — hosts the TaskPin backend, its database, and the push notification delivery service (Firebase Cloud Messaging).
Google Tasks API — the source of your tasks, which is your own Google account.
Google Fonts — serves the typeface used on this website. Viewing these web pages requests the font from Google, so Google receives your IP address. This applies to the website only; the Android app does not load anything from Google Fonts.

We may also disclose data where we are legally required to do so, or where necessary to investigate abuse or protect the security of the service.

4. Security and retention

All network traffic between the app, our backend, and Google's APIs uses HTTPS/TLS.
Your Google refresh token is encrypted at rest with AES-256-GCM before being written to our database, and the encryption key is held in a managed secret store, separate from the database.
Our database rules deny all direct client access. Only the backend service can read or write your records.
Data stored on your device — your session details and the cached copy of your tasks — is held in the app's private storage, protected by Android's app sandbox.
We keep the data described in section 1 for as long as your account remains connected. When you disconnect or ask us to delete your data, it is removed as described below.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data, we will notify affected users and the relevant authorities where the law requires it.

5. Deleting your data

You can remove your data in either of two ways.

From inside the app

Open TaskPin, go to Connected accounts, and choose Disconnect. This revokes TaskPin's access to your Google account at Google, and deletes the stored refresh token, your recorded pin state, and your device's push notification token from our backend. Signing out clears the session and cached tasks from your device. You can also revoke TaskPin's access at any time from your Google Account permissions page.

By email

Email privacy@gettaskpin.com from the address you signed in with and ask us to delete your account. We will erase everything associated with your account, including the remaining settings record — your pin preferences and time zone — within 30 days, and confirm when it is done.

Uninstalling the app removes the on-device copy of your data, but does not by itself delete the records held on our backend. Use one of the two routes above for that.

6. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we process it, or receive a copy in a portable format. Email privacy@gettaskpin.com and we will respond within the period the applicable law requires. Where we rely on your consent — for example, your grant of Google Tasks access — you can withdraw it at any time by disconnecting, without affecting processing that already took place.

We process your data to provide the service you asked for, which under the GDPR is performance of a contract, and on the basis of the consent you give when you grant Google Tasks access.

7. Children

TaskPin is not directed to children. It is intended for users aged 18 and over, and we do not knowingly collect personal data from children. If you believe a child has provided us data, email us and we will delete it.

8. International transfers

TaskPin's backend runs in Google Cloud's us-east1 region in the United States. If you use TaskPin from outside the United States, your data is transferred there and processed subject to this policy.

9. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes will be announced in the app before they take effect.

10. Contact

Privacy questions, data requests, or anything else about this policy: privacy@gettaskpin.com