Taskr Privacy Policy

Last updated: October 15, 2026 · Version 2.6

BMA Nexus

This Privacy Policy describes how Taskr ("we", "our", or "the app"), developed and operated by BMA Nexus, collects, uses, processes, stores and protects your personal data when you use the Taskr mobile application available on Google Play. It also describes your rights under the EU General Data Protection Regulation (GDPR) and how to exercise them.

1. Information We Collect

Taskr is built around the principle of data minimization. We only collect what is strictly necessary to provide the features you have chosen to use. The data we may collect is grouped below by the feature that triggers its collection.

1.1 Account data (only if you create an account)

• Email address — used only to authenticate you via Supabase Auth and to send transactional emails (account verification, password reset, confirming a change of e-mail address that you start in Settings, a security notice after a change of your password, and a security notice to your previous address after a change of your e-mail address), and, once your address is confirmed, to show you invitations to shared lists that were sent to that address (Section 5.1). Where such an e-mail contains a confirmation or reset link, that link ends on a web page hosted on GitHub Pages; like any website, GitHub receives your IP address and browser details when that page loads.
• Hashed password — stored only in Supabase Auth (bcrypt-hashed; we never see your plaintext password).
• Session token (JWT): stored locally on your device to keep you signed in; refreshed automatically. Supabase Auth keeps a record of each sign-in session on its side, with technical details such as when it started, when it was last refreshed, the IP address and the browser or app details of the device; such a record has no fixed end date. A session also starts when you open a confirmation or reset link from an account e-mail, and when the app checks your current password before a change of your e-mail address, which it does by signing in again on a separate, temporary connection that it does not use afterwards. A session record is removed when the session is ended, for example when you sign out in the app, and when your account is deleted.
• Account creation date: recorded by Supabase Auth when you register. Taskr uses it to determine your 14-day free trial, in the app and on our server (Section 1.9). While you are signed in, the app also keeps it on your device in the local trial and Pro-status record (Section 4.1). As of app version 1.8.0, when you register in the app, the app also keeps it on that device in the local record of a registration that awaits confirmation, until that record is removed (Section 4.1).

1.2 Task data

• Your lists, tasks, subtasks, deadlines, priorities, details (each task's free-text details field), locations, reminder times and timezone preferences. A task you create while signed in also stores your account identifier (your Supabase user ID, not your e-mail address) as its creator; once a task is in a shared list, Taskr uses it to tell your own tasks from those of other members (Section 5.2). A recurring task also stores a series identifier that links its repetitions, so that completed repetitions of the same series do not each count towards the free task limit.
• The contents of your Notebook: each note's title, text, optional list and pinned state. Notes are stored on your device under their own key (tf-notes, next to tf-v4) and, if you sign in, in the notes column of your own user_data row. Notes are never shared with members of a shared list. On the free plan you can create up to 15 notes with up to 200 characters of text each; Pro, or the 14-day trial, raises that to 200 notes with up to 5,000 characters each. Nothing is deleted when you are above a free limit, for example after a trial ends: the 15 oldest notes stay editable, newer notes can still be read, copied and deleted, and a longer text can be shortened but not extended.
• App settings, such as theme, language, default list and priority, sort order, display density and notification and reminder preferences, and two numbers that record how many lists and how many open tasks of your own stay fully usable on the free plan. These two numbers are set from the lists and open tasks you have the first time you use app version 1.7.0 or later (at least 5 and at most 30 lists, at least 20 tasks), also if you are on Pro or in the trial at that moment, and set again in the same way when your settings are reset, for example by signing out or by "Clear all data". They are synced and backed up with your other settings.
• Onboarding state (which tour-tips you have seen).

1.3 Shared-list data (only if you share or join a list)

• The email addresses of people you invite to a shared list (stored in our database so they can accept the invite even if they don't have a Taskr account yet).
• For each invitation e-mail that Taskr sends or tries to send on your behalf (Section 6.7): your account identifier, the shared list it concerns, a SHA-256 hash of the invitee's e-mail address (not the address itself) and the time. Our server uses this record only to apply the limits on invitation e-mails; it cannot be read from the app, and Section 8 describes when it is deleted.
• Your own e-mail address as a member of lists you join (the list owner's address reaches you only through the invitation e-mail, Section 6.7).
• Membership role (owner, accepted member, pending invite) and invitation timestamps.
• For tasks in a shared list, where available: the account identifier (Supabase user ID) of the member the task is attributed to and of the member who last changed it. These identifiers are stored with the task in our database and are received by everyone in that list (Section 5.2).

1.4 Attachments (only if you upload files)

• Files you attach to tasks (photos and documents; video and audio for Pro users) are uploaded to Supabase Storage with Row Level Security. Attachments are available on every account: a free account can attach 1 file of up to 10 MB per task, a Pro account up to 15 files per task with higher size limits (shown in the app).
• Each file is stored under your user ID and is only accessible to you and members of the shared list (if applicable).

1.5 Push notification token (if you are signed in and have allowed notifications)

• Firebase Cloud Messaging (FCM) device token — a unique identifier issued by Google to deliver push notifications to your device. Stored in our database and bound to your user ID. Taskr registers this token for every signed-in user who has granted the Android notification permission; there is no separate switch for shared-list push notifications. The token is only ever used to send notifications about shared lists you belong to (Section 6.2); if you are not in any shared list, nothing is sent to it.
• The token is generated by Google Play Services on your device. It changes when the app is reinstalled or app data is cleared.

1.6 Location data (optional, on-demand)

Taskr can attach a geographic location to individual tasks if you explicitly request it:

• Trigger: only when you tap the "Use current location" button in the task editor. Taskr never accesses your location in the background, while the app is closed, or for any other purpose (no geo-fencing, no automatic tagging, no analytics).
• Permissions: Taskr declares ACCESS_FINE_LOCATION (precise lat/lng) and ACCESS_COARSE_LOCATION (network-based approximation) in its Android manifest. Android 12+ users may grant approximate-only; this still works. Taskr requests the permission only the first time you tap the button; you may deny without affecting any other functionality.
• Data collected: latitude and longitude coordinates (device-provided). Taskr does not convert coordinates into an address (no reverse geocoding); the address or place name shown on a task is only the text you typed yourself in the location field.
• Storage: stored locally on your device as part of the task. If cloud sync is enabled, also stored in the user_data table (your private cloud row). For tasks in a shared list, the coordinates are also stored in shared_tasks and visible to the other members of that list.
• Sharing: never sent by us to third parties beyond Supabase storage. You can pass them on yourself: tapping "Open in Maps" hands the coordinates to the maps app on your device (Section 6.4), and a JSON backup you create contains them together with the other fields of your tasks (Section 6.6). We do not use this data for analytics, advertising, or profiling.
• Deletion: tap the red ✕ next to the coordinates in the task editor to remove the location from that task. "Clear all data" removes all location entries from device and cloud.

1.7 What we DO NOT collect

• No Google Analytics, no Firebase Analytics, no Crashlytics, no Sentry, no Facebook SDK.
• No advertising IDs (no AAID / IDFA).
• No device fingerprinting, no statistics about what you do in the app, no background or continuous location tracking.
• No geo-fencing or automatic location tagging — location is only attached when you tap the "Use current location" button (see 1.6).
• No contact-list access, no calendar access, no microphone access (unless you choose to attach an audio file).
• Apart from our backend provider Supabase (Section 6.1) and Google Play itself (Sections 6.3 and 6.9), the only third-party SDKs that process any of your data are RevenueCat (Section 6.8) and Firebase Cloud Messaging (Section 6.2). Google Play also provides the in-app rating prompt: Taskr asks Google Play to show it at most once, after your tenth completed task in the app, and Google decides whether it actually appears. The RevenueCat SDK runs on every installation to determine whether your account has Pro status: it receives an anonymous app-user identifier and, once you sign in, your Taskr account identifier, together with technical metadata such as IP address, operating system and app version. Purchase data is processed only if you actually buy a subscription. From that purchase data RevenueCat may compute aggregate subscription metrics (e.g. how many users subscribe) on our behalf. Because every installation contacts RevenueCat, its dashboard also shows us totals of installations: how many are new, per day and per country, and how many were active in a recent period. We look at those totals, for example to see whether an advertising campaign leads to installations. These figures, together with simple counts from our own database such as the number of accounts (Section 3) and the aggregated figures that Google Play and, for our advertising campaign, Google Ads show us about Taskr, are the only sense in which an "analytics" purpose applies; they are totals, not records about individual users, and say nothing about what you do in the app. Google collects the Google Play and Google Ads figures itself, for example the number of installations per app version and per country and, from users who have chosen to share such data with Google, crash rates. Separately from these totals, Google Play can also show us reports of individual crashes of the app from those users, with technical details such as the device model, the Android version and the app version. Taskr does not send this data. Firebase Cloud Messaging processes only your device token and the shared-list notifications described in Section 6.2.

1.8 Notification content (lock-screen visibility)

Both local reminders and shared-task push notifications include the task text in the notification body:

• Local notifications: when you schedule a reminder, the notification body contains the task title only (not the task's details text). This is generated and stored entirely on your device by Android. The optional recurring reminder ("nudge") that you can switch on in Settings contains a fixed text and no task content.
• Shared-task push notifications (Firebase Cloud Messaging): when a member of a shared list adds or completes a task, the other members receive a push notification; editing a task does not trigger one. The title is the list name and the body is the task text preceded by "New task:" or "Task completed:" (in the app language of the member who acted). The notification does not name the member who acted. The body is capped at 240 characters and sanitized (control characters stripped) before being sent through Google's FCM servers.
• Lock screen visibility: by default, Android shows notification content on the lock screen. Anyone with physical access to your device may see the task text. If your tasks contain sensitive information, we recommend changing your Android notification settings to "Hide sensitive content" or "Don't show notifications at all" on the lock screen.
• Accessibility services: notification bodies are readable by Android accessibility services (e.g. TalkBack, third-party screen readers). Be aware that accessibility apps you have installed may receive your task text.

1.9 Subscription & purchase data

Taskr Pro is an optional paid subscription sold through Google Play's billing system (the current price is shown in the app and on Google Play before you confirm). The 14-day free trial involves no purchase data. If you are not signed in, the trial is tracked only in local app storage on your device and starts the first time you open the app. If you are signed in, it runs until 14 days after your account was created: the app reads the creation date of your account from Supabase Auth (Section 1.1), and our server applies the same rule to give accounts in their trial the member limit of Pro for shared lists (Section 5.1) and the storage quota of Pro. While you are signed in to an account that is older than 14 days, a trial still running on the device does not apply; after you sign out, the trial of the device applies again. To determine whether your account has Pro status, Taskr uses the RevenueCat SDK on every installation, whether or not you ever buy anything: it receives an anonymous app-user identifier and, once you sign in, your Taskr account identifier (Section 6.8). If you choose to subscribe:

• Google Play processes the payment and the underlying purchase token. We never receive or store your card number, billing address or other payment credentials.
• Subscription validation is handled by RevenueCat (see Section 6.8). For this, Taskr sends RevenueCat your Taskr account identifier (your Supabase user ID, used as RevenueCat's "App User ID" so your Pro status follows your account across devices); RevenueCat then tracks your purchase/transaction history — which product, purchase and renewal dates, and subscription status — validating it directly with Google Play.
• Pro status in our database: a single row in our pro_users table records that your account is Pro (a boolean flag, the renewal date and the time of the last update). Our server uses this row, together with the creation date of your account for the 14-day trial, to apply the storage quota and the member limit for shared lists (Section 5.1) that match your plan. This row contains no payment information.

2. Legal Basis for Processing (GDPR Art. 6)

Where the EU General Data Protection Regulation applies, we rely on the following legal bases to process your data:

• Performance of a contract (Art. 6(1)(b)) — to provide the Taskr service you signed up for: storing your tasks and notes, syncing them between your devices, processing your account, determining whether your account has Pro status (Section 6.8), and — if you subscribe — providing, validating and managing your Taskr Pro subscription.
• Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, abuse-prevention rate limits and routing FCM push notifications to the device tokens you registered.
• Consent (Art. 6(1)(a)) — for sending you push notifications (consent given via the system POST_NOTIFICATIONS prompt on Android 13+) and for using cloud sync (consent given by signing up for an account).
• Legal obligation (Art. 6(1)(c)) — when required by law, e.g. responding to lawful requests from authorities.

3. How We Use Your Information

• To save your task data and notes on your device and (if you sign in) sync them across your other devices.
• To deliver local reminder notifications scheduled by your device. These are processed entirely on-device — we never receive or store the content of local reminders.
• To enable shared-list collaboration: showing real-time updates to other members of a list you own or joined, and showing you in the app the invitations to shared lists that were sent to your confirmed e-mail address (Section 5.1).
• To deliver push notifications for shared-list activity (e.g. "A task was added to your shared list"). These pass through Firebase Cloud Messaging — see Section 6.2.
• To authenticate you (email + password) and maintain your signed-in session.
• To allow you to upload attachments to tasks and download them on your other devices.
• To determine whether your account has Pro status (via RevenueCat, on every installation) and, if you subscribe, to validate and manage your subscription and unlock Pro features across your devices.
• To apply the limits of your plan (free, trial or Pro), such as the number of lists, tasks and notes, the number of people you can share a list with, the attachments per task and your storage space. For this Taskr uses your Pro status, the creation date of your account, the account identifiers recorded on shared tasks, the series identifiers of recurring tasks and two numbers stored in your settings (Sections 1.1, 1.2, 1.3 and 1.9).
• To see, as totals only, how many installations, accounts and subscriptions there are, for example to judge whether an advertising campaign leads to installations, and to see the aggregated figures that Google Play and Google Ads show us about Taskr (Section 1.7). These totals do not show what any individual user does in the app.

We do not sell, rent, trade or share your personal data with third parties for marketing purposes. We do not profile users.

4. Data Storage & Security

4.1 On-device storage

When you use Taskr without signing in, your lists, tasks, Notebook notes and settings are stored only on your device, using Capacitor Preferences (Android's SharedPreferences), which is sandboxed to the Taskr app and protected by the operating system. This content never leaves your device, unless you hand it to another app yourself, for example by exporting, sharing or opening a link (Sections 6.4 to 6.6). Separately, the RevenueCat SDK sends an anonymous identifier and basic technical metadata to RevenueCat on every installation (Section 6.8). If you allow notifications, Google Play services also issues a push token for your device; Taskr only stores that token once you sign in (Section 1.5).

Local key structure: the primary storage key is tf-v4 (Capacitor Preferences / Android SharedPreferences). It contains your lists, tasks, app settings, and onboarding state in a single JSON document. The same document also holds a local copy of the full content of every task in every shared list you belong to (field sharedTasks, including tasks written by other members); this copy is used by the home-screen widgets and for reminders while the app is closed. This copy also contains the account identifiers (Supabase user IDs, not e-mail addresses) recorded on shared tasks (Section 5.2). Your Notebook is stored under a separate key, tf-notes. Two further items can hold task content: edits to shared tasks that you make while offline wait in a local queue (tf-shared-queue-v1) until they are sent, and a video or document of up to 20 MB that you open is temporarily copied into the app's private cache folder (taskr-open) so the viewer app can read it. While a registration waits for confirmation of your e-mail address, the address you typed is kept in the app's local storage (taskr-pending-signup), together with the time the confirmation e-mail was last requested from this device, so that opening the confirmation link on this device signs you in directly; for this, the record is ignored 48 hours after that time, and it is removed as soon as you sign in. As of app version 1.8.0, the same record is also written, with a new time and so for another 48 hours, when you ask for the confirmation e-mail again from the sign-in screen, also on a device where you did not register; the app also uses it to keep that button switched off for a minute. As of that version, a record written when you register also keeps when your account was created, as reported by our server, and while no account is signed in on this device, the app shows the address from the record in a red row under the header that asks you to confirm your account and sign in; tapping the row opens the sign-in screen with that address filled in. The row is shown until 30 days after your account was created or 7 days after the last confirmation e-mail requested from this device, whichever is later (for a record that was written only because you asked for the e-mail again, until 7 days after that e-mail). From that version, the app removes the record when it runs after that date, and also when it cannot read the record. Also as of app version 1.8.0, when you sign in or open a confirmation link, the app sets a small marker (tf-pull-pending: a time and a reason word, no account identifier) so that it first fetches your account's data from the cloud; the marker is normally removed once your data is in sync and is not synced itself. All of this is removed when you sign out, delete your account or use "Clear all data" (Section 10.1). Images, audio files and files larger than 20 MB that you open are not copied but shown in your device's browser through a temporary signed link to the file (valid for 10 minutes; for an image, the link already made for its preview, valid for up to 24 hours, can be used instead); the same happens with a video or document when no app on your device can open it or the copy fails. The link may remain in the browser's history, which Taskr cannot clear, but stops working when it expires.

Trial and Pro-status record: a separate key, tf-pro-v1, holds the local record of your trial and Pro status. It contains when the free trial on this device started; the subscription status last received from RevenueCat, the subscription product last seen on this device and the moment this device first saw an active subscription; the latest time the app has seen, to detect a clock that was set back; while you are signed in, the last confirmed status of your account (its account identifier, its creation date and whether it has permanent Pro), so that your plan is still known when the app cannot check your session, for example offline; which account, or the trial of the device, last had Pro on this device and in what form (trial, subscription or permanent); and one-time markers, such as when, and for which account, the notice about the end of Pro was last shown or skipped. Where it records an account, it uses the account identifier (Supabase user ID), never your e-mail address or task content. This record is not synced and is not removed when you sign out or use "Clear all data"; deleting your account in the app removes that account's identifier from it. Section 8 describes what stays in it.

Corruption backups: if Taskr detects a JSON parse error on startup (e.g. partial write during a crash), the raw corrupted data is preserved under tf-v4-corrupt-<timestamp> (or tf-notes-corrupt for the Notebook) as a debugging safeguard and, if you are signed in, Taskr restores your data from your cloud copy instead of starting empty. These backups are removed when you use Settings → "Clear all data", sign out or delete your account; they are not otherwise auto-deleted.

4.2 Cloud storage (only if you sign in)

If you create an account, your task data is synced to a Supabase PostgreSQL database in the EU region (Ireland). Your own row in the user_data table holds your lists, tasks, settings and onboarding state, and your Notebook in a separate notes column; tasks in shared lists live in the shared_tasks table (Section 5). Supabase is SOC 2 Type II compliant. Your data is protected by:

• Row Level Security (RLS) — database-level policies that ensure only you can read or write your own records.
• TLS in transit — all communication between the app and our servers is encrypted with HTTPS/TLS 1.2+.
• Encrypted at rest — Supabase encrypts the underlying database storage using AES-256.
• JWT authentication — every call the app makes to our database, file storage and server functions while you are signed in carries a short-lived signed JWT bound to your user ID; an attachment file itself is then loaded through a temporary signed link (Section 4.1). Looking up the name and icon of a list through an invite link (Section 5.1) needs no sign-in.

4.3 Attachments storage

Attachments are stored in Supabase Storage (S3-compatible object storage hosted by Supabase in Ireland). Each file is namespaced under your user ID and protected by RLS policies that mirror your list access.

4.4 Notification tokens

FCM device tokens are stored in our database (table fcm_tokens), bound to your user ID. They are used solely to route shared-list push notifications to your device. Tokens are deleted when you sign out or delete your account.

4.5 Subprocessors

Supabase, our infrastructure provider, hosts its EU region on Amazon Web Services (AWS) in Ireland. AWS is therefore a subprocessor of Supabase. Supabase's full subprocessor list is available at supabase.com/privacy.

4.6 Realtime sync for shared lists and invitations

While you have a shared list open in the app (as its owner or as a member), Taskr maintains a Supabase Realtime channel for that list (over a secure WebSocket connection to wss://qgeuniiclrzndzmayekt.supabase.co) to receive instant updates from other members. Edits you make while offline are queued locally and flushed when connectivity returns. The channel transmits only task content for that specific shared list, including the account identifiers described in Section 5.2, plus the time of the last change; your private tasks never traverse this channel.

As of app version 1.8.0, while you are signed in and Taskr is open on your screen, the app also keeps a Realtime channel for invitations open, also when you have no shared list open, so that a new invitation to a shared list can appear without you having to return to the app (Section 5.1). It uses the same secure WebSocket connection to wss://qgeuniiclrzndzmayekt.supabase.co as the channel of a shared list; when no shared list is open, the app opens this connection for the invitation channel alone. To receive only what concerns you, the app subscribes to this channel with your own e-mail address as a filter; Supabase receives this filter together with your sign-in token, keeps them with the channel while it is open, and uses them to send you only changes to entries that our server lets you read. Our server sends a message on this channel when an entry with your address in the member list of a shared list is added or changed, for example a new invitation, your own entry when you share a list, or your entry when you accept an invitation. Each such message contains that entry: its identifier and that of the shared list, your e-mail address, the role, the status, the time of the invitation and, once the entry belongs to your account (your own entry when you share a list, or after you accept), your account identifier. The app does not use the content of such a message, but fetches your open invitations again. No task content travels over this channel. The app closes it when Taskr goes to the background or you sign out, and opens it again when you return to the app or the connection returns.

5. Sharing Data With Other Users (Shared Lists)

Taskr lets you collaborate on lists with other people. Sharing a list is fully opt-in and only happens when you explicitly create a share link or send an email invite.

5.1 What happens when you invite someone

• The invitee's email address is stored in the shared_list_members table (lowercase, trimmed). The member list, including e-mail addresses, is visible only to you as the list owner; members do not see each other's addresses.
• If the invited address is the confirmed e-mail address of a Taskr account, the invitation also appears in the Taskr app while that account is signed in. The app shows the name and icon of the list, and the invited person can accept the invitation there or decline it; declining removes the invitation. For this, our server compares the address of the invitation with the confirmed e-mail address of the signed-in account. Through our server, that account can also read the color of the list and the other basic details that members can read (Section 5.2); the app does not show these. The app looks for invitations at moments such as when you start it or sign in and, as of app version 1.8.0, also each time you return to it and, through a realtime channel, while it is open on your screen (Section 4.6).
• The invitee receives an invite link of the form https://bma-nexus.github.io/taskr-invite/?token=<UUID>. The token is not one-time: there is one token per list, it is reused for every e-mail invite to that list, it does not expire, and it is only replaced (rotated) when an accepted member is removed from the list or leaves it (including when a member clears their data or deletes their account). Until then, anyone with a Taskr account and a confirmed e-mail address who has the link can join the list as long as it is not full (see Member cap below), so share it only with people you want in the list.
• Invite link security: the token currently appears in the URL. Be aware that URLs may be retained in browser history, server-access logs (CDN, ISP), and referrer headers when the recipient opens the link. The link opens a web page hosted on GitHub Pages; like any website, GitHub receives the visitor's IP address and browser details. That page shows the name and icon of the list to anyone who opens the link, also without a Taskr account: it sends the token to our server and gets back only the list name and icon. Treat invite links like passwords — do not share them publicly or post them in chat groups.
• Member cap: the limit does not count you as the owner. On the free plan you can share a list with 2 people; with Pro, or during the 14-day trial, with 20 people. Invitations that have not been accepted yet count towards the limit. The limit is enforced on our server and applies in the same way to people who join through the share link. From app version 1.7.0, someone who tries to join a full list is told the limit that applies to that list. It follows the plan of the list owner: our server applies the higher limit when the owner's account has active Pro status in our database (Section 1.9) or was created less than 14 days ago. If the limit later becomes lower, for example when a trial or subscription ends, people who are already in the list stay in it and invitations that were already sent can still be accepted.

5.2 What accepted members can see and do

• The list name, color and icon. Through our server, members can also read the other basic details of the list: when it was shared, its internal identifiers and the account identifier (Supabase user ID, not the e-mail address) of the list owner; the app does not show these. Members do not see the member list or each other's e-mail addresses; only the owner sees who is in the list (Section 5.1).
• The full content of every task in the list: text, subtasks, details, deadlines, priorities, locations, attachments, completion state, recurring rules. Each shared task can also carry two account identifiers (Supabase user IDs, not e-mail addresses): that of the member the task is attributed to, which is the member who created it or brought it into the shared list (for tasks created with an older version of the app, the member who had last changed it), and that of the member who last changed it. Each attachment also contains the identifier of the member who uploaded it, as part of its storage path (Section 1.4). Taskr uses the first two identifiers to count each member's own tasks towards the limits of that member's plan. All of these identifiers are part of the task data that is sent to, and stored on, the devices of everyone in the list, the owner included (Section 4.1). The app does not display them and does not show members which identifier belongs to whom; only the list owner's app receives, with the member list, each member's identifier next to their e-mail address (Section 5.1).
• Members can add, edit, complete and delete tasks. There is no per-field, per-task, or read-only permission system: on our server, every accepted member has equal access. Within the app, the limits of each member's own plan still apply to the tasks attributed to that member (see the bullet above): a member on the free plan who has reached the free task limit cannot add tasks to the list, and that member's own tasks above the limit can only be changed in a limited way, for example checked off, rescheduled or deleted.
• When one member adds or completes a shared task, all other members receive a push notification via Firebase Cloud Messaging; editing a task does not trigger one. The notification contains the list name and the task text, not the name of the member who acted (see Section 1.8).

5.3 Stopping sharing

• If you are the owner, you can stop sharing the list at any time. This is a cascade delete: the shared-list record, its members, and its shared tasks are removed from the shared tables in the cloud. When you stop sharing (rather than delete the list), the app first downloads the list's tasks, including tasks that members added, and after the cascade delete puts them back into your own list; from then on they are part of your private task data (Sections 1.2 and 4.2), without the identifiers of the member each task was attributed to and of its last editor (Section 5.2). Attachments that members added stay listed on those tasks, with the uploader's identifier in their storage path. Every member loses access immediately. Members' local copies of the list's tasks disappear at their next refresh: straight away if they have that list open at that moment (realtime channel), otherwise the next time the app reloads their shared lists, at the latest at the next app start.
• If you are a member, you can leave the list at any time (open the list, tap the people icon to open its share sheet, then "Leave"). Your membership is removed; the owner and other members keep their access. Your past edits to shared tasks remain in the shared list, because we cannot retroactively delete them without affecting other members' tasks. Tasks attributed to you or last changed by you, and attachments you added there, keep your account identifier (Section 5.2) after you leave; Section 10.2 describes what happens to it if you delete your account.
• The owner can also remove individual members from a shared list at any time.

You are responsible for choosing who to invite and for the content you place in a shared list. We recommend not putting sensitive personal information of third parties into shared tasks unless those parties have consented.

6. Third-Party Services

Taskr uses the following third-party services. Each link points to that provider's own privacy policy.

6.1 Supabase

• Purpose: authentication, cloud database (PostgreSQL), file storage (S3-compatible), realtime subscriptions (updates in shared lists and, as of app version 1.8.0, new invitations to shared lists; Section 4.6), server functions (joining a shared list through an invite link, showing the list name and icon on the invite web page, sending shared-list push notifications and invitation e-mails, and receiving subscription updates from RevenueCat), transactional emails (account verification, password reset, confirming a change of e-mail address, and security notices after a change of your password or e-mail address).
• Region: EU (Ireland) for the database, file storage and authentication. Our server functions run in the Ireland region as well: as of app version 1.7.0 the app asks for this on every call, and so do the invite web page and the address that receives RevenueCat's notifications. Calls from app versions older than 1.7.0 may run in the Supabase region closest to the caller; the data these functions write to our database is stored in Ireland.
• Privacy policy: supabase.com/privacy

6.2 Firebase Cloud Messaging (FCM) — Google

• Purpose: delivering push notifications for shared-list activity to your device.
• Data shared with Google: the device FCM token and the notification payload: the title (the list name), the body ("New task:" or "Task completed:" in the app language of the member who acted, followed by the task text) and three data fields (listId, sharedListId, taskId) that let the app open the right task. The payload does not contain the name or e-mail address of the member who acted. Sent only when a co-member of a list you own/joined adds or completes a task.
• Region: Google's FCM is a global service. Google may route notifications through servers worldwide.
• Privacy policy: policies.google.com/privacy

If you do not want push notifications, you can deny the POST_NOTIFICATIONS permission when prompted, revoke it later in Android Settings → Apps → Taskr → Notifications, or simply not sign in (push notifications are only used for shared lists).

6.3 Google Play Services

• Purpose: required by Android to use Firebase Cloud Messaging. Provided by the device manufacturer / Google.
• Privacy policy: policies.google.com/privacy

6.4 External maps applications (your choice)

If you add a location to a task and tap "Open in Maps", Taskr launches your device's default maps application (Google Maps, Apple Maps, etc.) with the address you entered or, if the task has coordinates, with those coordinates (the text you typed is then passed along as a label). We do not send the location to any server — we simply hand off to your maps app. The maps app's privacy policy applies once the handoff occurs.

6.5 External browser (URL handoff)

Taskr automatically detects URLs in your task text, subtask text, task details and Notebook notes (matching https://... and www.... patterns). When you tap such a link:

• Taskr opens the URL in your device's default external browser (Chrome, Samsung Internet, etc.) via the Capacitor Browser plugin.
• Taskr does not validate, preview, or pre-fetch the URL — no network call is made by Taskr itself.
• Taskr does not track which links you tap. URL detection runs entirely on-device using a regular expression.
• Once the external browser opens the link, that browser's privacy policy applies (not Taskr's). The destination website may log your IP address, User-Agent, and other request metadata as with any normal web visit.

If you do not want a URL to open externally, simply do not tap it. URL detection is purely visual; the text itself is not modified.

6.6 Android share sheet (export and invite links)

Two features hand data to the Android share sheet, which allows you to forward it to any other app on your device (Email, SMS, WhatsApp, cloud storage apps, etc.):

• "Share via link" (in the Share modal): hands the list name and the invite URL (containing the token, see Section 5.1) to the share sheet. The receiving app — and any app installed on the device — may briefly see this data while the share dialog is open.
• Exports (in Settings): "Export data" (a CSV of your tasks), "Export notes (CSV)" and "Create backup (JSON)" (a restorable backup of your lists, tasks, settings, tour state and notes) each first write the file to your device's public Documents folder. The two CSV exports then open the share sheet straight away, so you can save the file to cloud storage, e-mail it to yourself, etc. After "Create backup (JSON)" the app first shows the folder and the file name, which contains the date and the time to the minute (for example taskr-backup-2026-10-03-14.30.json, or taskr-backup-2026-10-03-1430.json before app version 1.8.0), so a new backup is kept next to earlier ones instead of replacing them, unless both are made in the same minute; the backup only goes to the share sheet if you tap "Share" in that window. If a file cannot be saved, the app hands its content to the share sheet as text instead. The files stay in Documents even if you cancel or skip sharing (the app tells you where they are), other apps with access to that folder can read them, and signing out, "Clear all data" and deleting your account do not delete them; they stay there until you delete them yourself. The files contain your full task and note content. The JSON backup also contains your settings (including the two numbers described in Section 1.2), the account identifier (Supabase user ID, not your e-mail address) stored as creator on tasks you created while signed in (Section 1.2), and for each attachment its file name, type, size, upload time and storage location, which begins with the account identifier of the person who uploaded it; the attachment files themselves are not included. Treat these files as you would any backup of personal data.

Taskr does not control what the receiving app does with the data once you tap "share". Choose the receiving app carefully.

6.7 Resend (transactional email service)

When you send an invite to a shared list using the e-mail field (instead of the share-link button), Taskr sends an automated invitation e-mail to the invitee through Resend (operated by Resend Labs Inc., USA, with EU region in Ireland). The same Resend service is also used to deliver Supabase Auth e-mails such as account confirmation and password reset.

• Data shared with Resend: the invitee's e-mail address, the inviter's e-mail address (it appears in the subject line, which inbox previews and lock screens may show, and inside the message; the sender address itself is noreply@bma-nexus.com), the shared-list name and icon, and the list's invite token (embedded in the link; see Section 5.1 for how long it stays valid). For Supabase Auth e-mails: your e-mail address (when you change it, also the new address) plus the confirmation or reset link. When you change your e-mail address, the confirmation link is sent to the new address only; after the change, a security notice that names the old and the new address is sent to the old address. After a change of your password, a security notice is sent to the address of your account. As of app version 1.8.0, you can also ask for the account confirmation e-mail again from the sign-in screen (Section 4.1).
• Region: Taskr uses Resend's eu-west-1 (Ireland) region so that e-mail processing remains within the EU. Resend's full data-processing policy: resend.com/legal/privacy-policy. DPA: resend.com/legal/dpa.
• Retention: Resend retains delivery logs (recipient, send timestamp, delivery status) for up to 30 days for operational and abuse-prevention purposes. E-mail body content is not retained after successful delivery.
• Limits on invitation e-mails: Taskr only sends an invitation e-mail for an invitation that is still open, and limits how many invitation e-mails can be sent per list owner (per hour and per day), per invitation (per day) and for all Taskr users together (per day). This prevents abuse and keeps e-mail capacity free for account confirmation and password reset; the legal basis is our legitimate interest in preventing abuse (Section 2). To apply these limits, our server keeps a short-lived record of each invitation e-mail (Section 1.3); this record stays in our database and is not sent to Resend. If a limit is reached, the invitation is still created but no e-mail is sent, and the app suggests sharing the invite link instead.
• Legal basis: Art. 6(1)(b) — performance of contract (delivering the invite you initiated). For Supabase Auth e-mails: Art. 6(1)(b) for account confirmation and for a change of e-mail address that you request, and Art. 6(1)(f) (legitimate interest in account security) for password reset and for the security notices after a change of your password or e-mail address.

If you do not want an invite e-mail to be sent, use the "Share via link" button instead (Section 6.6) — that pathway never touches Resend.

6.8 RevenueCat (Pro subscription management)

Taskr uses RevenueCat (operated by RevenueCat, Inc., United States) to determine whether your account has Pro status and, if you subscribe, to validate the purchase with Google Play, keep your subscription status up to date, and unlock Pro across your devices. The RevenueCat SDK is initialised on every installation, whether or not you ever buy anything. RevenueCat acts as our data processor / service provider — it processes this data only on our instructions, not as an independent party for its own purposes (which is why, in Google Play "Data safety" terms, this is disclosed as collected but not shared).

• Data Taskr sends to RevenueCat: an anonymous app-user identifier generated by the SDK on installation and, once you sign in, your Taskr account identifier (Supabase user ID, used as the "App User ID"). This applies to every signed-in user, not only to buyers. Taskr does not send RevenueCat your e-mail, name, password or payment-card details.
• Data RevenueCat processes: basic technical metadata its servers receive from every installation, such as IP address, operating system and app version, and, only if you buy a subscription, your purchase/transaction history (the product, purchase and renewal dates, and subscription status, validated directly with Google Play).
• Purpose: validating and managing your subscription, plus aggregate subscription metrics and the totals of installations described in Section 1.7, on our behalf. It is not used to show or target advertising, or for behavioural profiling.
• Region: RevenueCat stores data on Amazon Web Services in the United States (see Section 7 for the transfer safeguard).
• Safeguards: RevenueCat processes your data under its Data Processing Addendum. Per that DPA and RevenueCat's privacy policy, RevenueCat acts as a data processor and does not sell personal data.
• Backend webhook: RevenueCat notifies our Supabase backend when your subscription changes, so we can keep your Pro status, your storage quota and the member limit of your shared lists (Section 5.1) in sync. To record the current status, our backend may also retrieve the subscription status of the account concerned from RevenueCat's API (when a purchase moves to another account, of both accounts); the only information about you in that request is the account identifier, and from the answer our backend uses only whether Pro is active and until when. In our database the backend stores your account identifier, whether Pro is active, until when, and when this was last updated (Section 1.9). The notification itself is RevenueCat's standard event message about the subscription change; besides your account identifier it describes the event, for example its type, the product and entitlement, the end date, the price and country of purchase and the store's transaction identifiers, and it contains no card or payment-method details.
• Restore: when you tap "Restore purchases", Taskr asks RevenueCat to re-check your account's subscription status; no new data is collected.
• Privacy policy: revenuecat.com/privacy · DPA: revenuecat.com/dpa

6.9 Google Play Billing (payments)

Payments for Taskr Pro are processed entirely by Google Play's billing system. Google handles your payment method, the transaction and the purchase token, and any billing or refund support. We never receive your card number or billing details — only confirmation (via RevenueCat) that a valid subscription exists. Google's processing of your payment is governed by the Google Privacy Policy.

We do not embed any advertising networks, behavioural-analytics platforms, profiling SDKs or social-media SDKs. Apart from our backend provider Supabase (Section 6.1) and Google Play itself (Sections 6.3 and 6.9, including its in-app rating prompt, Section 1.7), the only third-party SDKs that process your data are RevenueCat (Section 6.8, Pro status and subscription management) and Firebase Cloud Messaging (Section 6.2, shared-list push notifications).

7. International Data Transfers

Your account data and task data are stored in the EU (Ireland), and our own server functions run in Ireland as well. Only calls from app versions older than 1.7.0 may still be handled in a Supabase region outside the EU (Section 6.1); updating the app ends this.

However, push notifications sent via Firebase Cloud Messaging may transit through Google servers located outside the EU. Google relies on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission to comply with EU data protection law for these transfers. Details: policies.google.com/privacy/frameworks.

The identifiers and technical metadata described in Section 6.8 are sent by the RevenueCat SDK, on every installation, to RevenueCat's servers in the United States; if you subscribe to Taskr Pro, your subscription and purchase data are processed there as well. RevenueCat relies on the European Commission's Standard Contractual Clauses (and, where applicable, the EU–US Data Privacy Framework), as set out in its Data Processing Addendum, to provide an adequate safeguard for this transfer.

8. Data Retention

• Local data on your device is kept until you uninstall the app, use Settings → Clear all data, sign out, or delete your account from within the app. Signing out and in-app account deletion wipe your task data and your sign-in session on that device: tasks, lists, settings, the Notebook, corruption backups, the offline queue and cached attachments (Section 4.1). Technical app state without task content is kept, such as a counter used to ask you once for a rating on Google Play (Section 1.7), a one-time maintenance marker for reminders and the local trial and Pro-status record tf-pro-v1 (Sections 1.9 and 4.1). That record keeps, among other technical markers, when the free trial on this device started, the subscription product last seen on this device and the moment this device first saw an active subscription. When you sign out, the last confirmed status of your account is removed from it. If the trial of the device itself has ended, the record can still keep the account identifier (Supabase user ID, not your e-mail address) of the account that last had Pro or a trial on this device; the app uses it to show the notice about the end of Pro if you sign in to that account again after its Pro has ended. That identifier stays until another account with Pro or a trial is used on this device, until that account is deleted in the app on this device, or until you uninstall the app or clear its storage. In-app account deletion removes the identifier of the deleted account from the record; the identifier of another account that had Pro on this device earlier can remain.
• Cloud account data is kept as long as your account is active.
• Accounts that were never confirmed: an account whose e-mail address was never confirmed cannot be used to sign in, so our database holds no tasks, notes or other content of its own (an invitation that another user sent to its address is described in Section 10.2); Supabase Auth holds its e-mail address, its hashed password and technical details of the registration, such as when it was created and when a confirmation e-mail was sent. Such an account may be deleted once it is more than 30 days old and no confirmation e-mail has been sent for it in the last 7 days. You can register again with the same address after that.
• After account deletion (see Section 10): the in-app "Delete account" button removes your account, your task data and notes, your attachments that are still linked to a task you have access to (Section 10.2) and your FCM tokens from our active systems immediately; after an e-mail request we do so within 7 days, and the e-mail route also deletes your other uploaded files (Section 10.2). Backups may retain a copy for up to 30 additional days before being overwritten in the normal backup-rotation cycle.
• Email invitations you sent that have not yet been accepted are deleted when you delete your account or when the invited person declines the invitation.
• Invitation e-mail records (Section 1.3) are deleted in a clean-up that removes all records older than two days. The clean-up runs each time our server checks the limits for a new invitation e-mail from any user, so a record can stay longer if no invitation e-mails are requested for a while. All records for a list are deleted straight away when the list stops being shared (Section 5.3), and all your records when you delete your account.
• Other technical counters: to limit how often shared-list notifications can be sent, our server records your account identifier and the time of each request that it lets through. Records older than an hour are removed the next time you trigger such a notification. Our server also keeps a running total of the storage space your attachments use (Section 1.9). Both are deleted when you delete your account.
• Server logs: Supabase keeps logs of the requests to our backend, of sign-in and account actions, of the database, of realtime connections and of our server functions, for operational reasons. How long they are kept is decided by Supabase (Section 6.1); at the time of writing, we can view about the last month of them. They may contain technical details of a request, including the IP address; an approximate location that Supabase's network derives from that IP address (such as the country, region, city, postal code and time zone) and the name of the network that the IP address belongs to (for example your internet or mobile provider); the technical identification of the browser or of the app's built-in browser component (user agent), which can include the version of the operating system and the device model; and the requested address with its search values, for example your e-mail address when the app looks up or accepts invitations sent to you, your push token when the app removes it as you sign out, or the invite token of a list when someone opens an invite link and the invite web page asks our server for the name and icon of that list (Section 5.1). They may also contain your e-mail address and account identifier in the logs of sign-in and account actions, account identifiers (for the subscription notifications of Section 6.8 also whether Pro is active and until when), identifiers of lists, tasks and attachments, the first characters of a push token, and technical error details, which can include a value that was sent, for example the e-mail address of an invitation that already exists. Our own server functions are written not to log task content.
• Subscription & purchase records (your Pro flag in pro_users and the subscription data held by RevenueCat) are kept while your subscription is active and afterwards only as long as needed for legitimate business and legal/accounting purposes. The purchase record held by Google Play is governed by Google's own retention policy and is outside our control.

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland, you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data (you can do this yourself from within the app, or contact us).
• Right to erasure (Art. 17) — request deletion of your account and all associated data (see Section 10).
• Right to restriction of processing (Art. 18) — ask us to limit how we use your data while a dispute is being resolved.
• Right to data portability (Art. 20) — receive your data in a machine-readable format. You can export your data yourself from Settings: "Export data" gives a CSV of your personal task list (without coordinates, attachments, per-task timezone or shared tasks), "Export notes (CSV)" a CSV of your Notebook, and "Create backup (JSON)" a restorable backup of your lists, tasks (all fields), settings, tour state and notes. Attachment files and shared lists are not part of any export; attachments can be opened and saved one by one from the task. For anything not covered, contact us.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)) — withdraw consent for processing where consent is the legal basis (you can disable notifications, which also cancels the reminders already scheduled on your device, sign out, or delete your account at any time).
• Right to lodge a complaint (Art. 77) — file a complaint with your national supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (AP).

To exercise any of these rights, contact us at bmanexusapps@gmail.com. We will respond within 30 days as required by GDPR Art. 12.

10. Account & Data Deletion

Creating an account is entirely optional. The app works fully offline without one.

10.1 Clear all data (in Settings)

Open the app → Settings → Clear all data. As of app version 1.8.0, if you are signed in (or a sign-in session is still stored on your device) and your device reports that it is offline, "Clear all data" does not start: the app tells you that a connection is needed, because your cloud data is cleared as well. Without an account it always runs. Taskr performs a synchronous wipe in this order:

1. Attachments (if you are signed in): every file you uploaded that is still linked to a task you can reach at that moment (your personal tasks and tasks in the shared lists you are still in) is deleted from Supabase Storage. Files on tasks in lists you left earlier are no longer reachable from the app; they are removed only when your account is deleted through the e-mail route (Section 10.2). The same applies to files that are no longer linked to any task.
2. Shared lists you own: each is unshared (cascade delete — see Section 5.3). All members lose access.
3. Shared lists you joined: you leave each (your membership is removed; the list survives for the owner and other members).
4. On-device data: tf-v4, tf-notes, all corruption backups, the local copy of shared tasks, the offline queue, the cache of opened attachments, the record of a registration awaiting confirmation, with its e-mail address, and the marker tf-pull-pending (Section 4.1) are removed. Not removed are your sign-in session (if you are signed in, you stay signed in) and technical records without task content, such as the local trial and Pro-status record tf-pro-v1 (Section 4.1), the rating counter (Section 1.7) and a one-time maintenance marker for reminders. While you stay signed in, tf-pro-v1 can still hold the last confirmed status of your account, including its account identifier and creation date.
5. Cloud user data (if you are signed in): your user_data row is wiped (lists, tasks, notes and settings set to empty).

This action is irreversible. Local notifications you previously scheduled are also cancelled. Note that "Clear all data" does not delete your Supabase Auth account itself (your e-mail + password remain) — see 10.2 for full account deletion.

10.2 Delete your account and all remaining cloud data

You can delete your authentication account itself (e-mail + password in Supabase Auth) and any remaining cloud data in two ways.

In the app: sign in, open Settings → Delete account and confirm. Taskr then, immediately and without a confirmation e-mail:

• Deletes every attachment you uploaded that is still linked to a task you have access to at that moment (personal tasks and tasks in the shared lists you are still in) from Supabase Storage. Files on tasks in lists you left earlier are not removed by this button; they are removed only if you delete your account through the e-mail route below instead. The same applies to files that are no longer linked to any task, for example after you cleared completed tasks that had attachments.
• Runs a server function (delete_my_account) that removes the shared lists you own together with their tasks and memberships (all members lose access), your memberships in other people's lists, your user_data row (tasks, notes, settings), your FCM tokens, your Pro flag in pro_users and finally your Supabase Auth account. Tasks you created in, or moved to, other people's shared lists stay in those lists, because they belong to those lists. In our database, the function replaces your account identifier as the creator of those tasks with a neutral marker, and the reference to you as the member who last changed a task is cleared. Copies that other members' apps already hold can still contain your identifier, and a change sent later from such a copy (for example an edit made offline before your deletion) can store it in the task again. If you attached a file to a task in another person's shared list, that task can still list the file's name and storage path, which contains the identifier of your deleted account (the file itself is deleted as described in the first point above); that identifier no longer belongs to any account.
• Wipes your task data and your sign-in session on the device and removes the identifier of your deleted account from the local trial and Pro-status record, as described in Section 8. The rest of that record and the other technical records described there stay on the device.

This is irreversible. Your RevenueCat customer record (Section 6.8) is not removed by this button; e-mail us if you want it deleted as well. Deleting your account does not cancel a Taskr Pro subscription that you bought through Google Play; you cancel it in Google Play (Section 6.9). As of app version 1.8.0, if your Pro comes from such a subscription, the confirmation dialog says so and offers a button that opens your subscriptions in Google Play.

By e-mail: send an email to bmanexusapps@gmail.com with the subject "Account Deletion Request" and from the email address registered with Taskr. We will:

• Verify the request (we may ask you to confirm from the registered email address).
• Delete your Supabase Auth row, your remaining user_data row, your FCM tokens and any shared-list memberships you forgot to leave, within 7 days.
• Delete your Pro flag (pro_users row) and, on request, delete your RevenueCat customer record from RevenueCat's dashboard.
• Delete any attachments you uploaded that are still in Supabase Storage, including files on tasks in lists you left earlier.
• Backups containing residual copies are overwritten within 30 additional days.
• Send you a confirmation email once deletion is complete.

If you are the owner of a shared list at the moment of account deletion, that list is unshared (cascade delete) and all members lose access.

An invitation that another user sent to your e-mail address and that you have not accepted is not removed with your account: it stays with that list, with your e-mail address, until the owner removes it or the list stops being shared. If your address is confirmed, you can decline such an invitation in the app before you delete your account; declining removes it (Section 5.1).

11. Children's Privacy

Taskr is suitable for users aged 13 and older.

In the European Economic Area, processing the personal data of a child under 16 on the basis of consent requires authorization from a parent or legal guardian (GDPR Art. 8). If you are under 16 in the EEA, please ask a parent or guardian to create the account on your behalf or to confirm your use of Taskr.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, please contact bmanexusapps@gmail.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• The "Last updated" date at the top of this page will change.
• The version number will be incremented.
• The version history below (Section 12.1) describes what changed, and significant changes are also mentioned in the release notes of the corresponding app update on Google Play.

Continued use of the app after changes constitutes acceptance of the updated policy. You can always review the latest version at the URL where this page is published.

12.1 Version history

Version 2.6 (October 15, 2026):

• Described invitations in the app: an invitation to a shared list that was sent to the confirmed e-mail address of a Taskr account also appears in the app of that account, where it can be accepted or declined; our server compares the address of the invitation with the confirmed address of the account, and the invited account can read the same basic details of that list as its members, which are now listed (Sections 1.1, 3, 5.1, 5.2, 8, 10.2). As of app version 1.8.0, the app also looks for invitations each time you return to it and, while it is open, keeps a realtime channel for new invitations with your own e-mail address as the filter, also when you have no shared list open (Sections 4.6, 5.1, 6.1).
• Described the account e-mails more precisely: a change of e-mail address is confirmed through a link sent to the new address only, a security notice is sent after a change of your password, and a security notice is sent to your previous address after a change of your e-mail address; the legal basis for these notices is our legitimate interest in account security (Sections 1.1, 6.1, 6.7).
• Described that Supabase Auth keeps a record of each sign-in session, also of a session that starts from a link in an account e-mail and of the extra sign-in with which the app checks your password before a change of your e-mail address, and when such a record is removed (Section 1.1).
• Described changes in app version 1.8.0: you can ask for the confirmation e-mail again from the sign-in screen, which writes the local record of a registration again (Sections 4.1, 6.7); that record also keeps, where known, when your account was created, and while no account is signed in on the device, the app shows its address in a red row under the header until you sign in, at the latest until 30 days after the account was created or 7 days after the last confirmation e-mail from that device, whichever is later, and removes the record when it runs after that date (Sections 1.1, 4.1); a local marker makes the app fetch your account's data first after you sign in (Sections 4.1, 10.1); “Clear all data” does not start while you are signed in, or a sign-in session is still stored on your device, and your device reports that it is offline (Section 10.1); the name of a JSON backup has a dot between hour and minute (Section 6.6); and the dialog for deleting your account tells you when a subscription bought through Google Play keeps running, which deleting your account does not cancel (Section 10.2).
• Added that Google Play and, for our advertising campaign, Google Ads show us aggregated figures that Google collects itself, and that Google Play can show us reports of individual crashes (Sections 1.7, 3), and that an account whose e-mail address was never confirmed may be deleted once it is more than 30 days old and no confirmation e-mail was sent for it in the last 7 days (Section 8).
• Described more fully what server logs may contain: technical details of a request, including the IP address, an approximate location and the name of the network derived from it, the technical identification of the browser or of the app's built-in browser component, and the requested address with its search values, such as your e-mail address when the app looks up or accepts invitations, your push token when the app removes it, or the invite token of a list when the invite web page looks up that list; that our own server functions are written not to log task content, instead of the earlier statement that server logs never include task content; and how long they are kept (Section 8).
• Made clear that “Delete account” and “Clear all data” in the app remove only the attachments that are still linked to a task you can reach, and that other files you uploaded are removed through the e-mail route (Sections 8, 10.1, 10.2).

Version 2.5 (October 8, 2026):

• Added the Notebook: notes (title, text, optional list, pinned state) are stored next to your tasks under their own local key and cloud column, are never shared with members of a shared list, and follow the same deletion rules as tasks (Sections 1.2, 4.1, 4.2, 10.1). On the free plan you can create up to 15 notes of up to 200 characters each, with Pro or during the trial up to 200 notes of up to 5,000 characters each, and nothing is deleted when you are above a free limit (Section 1.2). The free-text field of a task is now called its details (Sections 1.2, 1.8, 5.2, 6.5).
• Described the free plan, the 14-day trial and Pro as they work as of app version 1.7.0 and on our server: when you are signed in, the trial runs until 14 days after your account was created, and our server applies the same rule (Sections 1.1, 1.9); the limits of your plan are applied with your Pro status, the creation date of your account, the account identifiers on shared tasks, the series identifiers of recurring tasks and two numbers in your settings (Sections 1.2, 3); within a shared list, each member's own plan applies to the tasks attributed to that member (Section 5.2); your Pro status in our database, or during the trial the creation date of your account, also sets your storage quota and the member limit of your shared lists (Sections 1.9, 6.8).
• Updated the member limit to how it works as of this version: it does not count the owner, it is 2 people on the free plan and 20 with Pro or during the trial, invitations that have not been accepted yet count towards it, it follows the plan of the list owner, and our server applies it in the same way to people who join through the share link, who also need a confirmed e-mail address; when the limit becomes lower, people already in the list stay and invitations already sent can still be accepted (Section 5.1).
• Disclosed the account identifiers (Supabase user IDs, not e-mail addresses) stored with tasks: a task you create while signed in records you as its creator (Section 1.2); a shared task can carry the identifiers of the member it is attributed to and of the member who last changed it, and an attachment carries the uploader's identifier in its storage path; everyone in the list receives them, also over the realtime channel, which is open while you have a shared list open in the app, and they are kept in the local copy of shared tasks (Sections 1.3, 4.1, 4.6, 5.2). Also described what happens to them when a member leaves, when the owner stops sharing and the list's tasks return to the owner's own list, and when you delete your account (Sections 5.3, 10.2), and what the JSON backup contains (Section 6.6).
• Described what stays on your device: the local trial and Pro-status record (tf-pro-v1), what it contains, that signing out and “Clear all data” do not remove it, and that in-app account deletion removes the deleted account's identifier from it (Sections 4.1, 8, 10.1, 10.2); the e-mail address of a registration that awaits confirmation (Sections 4.1, 10.1); that “Clear all data” does not sign you out (Section 10.1); and that images, audio files and large files open in your browser through a temporary link that can remain in the browser's history (Section 4.1).
• Added the limits on invitation e-mails and the short-lived record our server keeps to apply them, which holds a SHA-256 hash instead of the invitee's address (Sections 1.3, 6.7, 8). The invite web page now shows the name and icon of the list to anyone who opens the link; this page, and the pages that the links in account e-mails lead to, are hosted on GitHub Pages (Sections 1.1, 5.1).
• Listed the server functions we run at Supabase and where they run: in Ireland, except for calls from app versions older than 1.7.0 (Sections 6.1, 7). Our backend may also retrieve the current subscription status from RevenueCat's API, and the content of RevenueCat's notifications is described more fully (Section 6.8).
• Added the confirmation e-mail for changing your e-mail address in Settings, with the data sent through Resend and the legal basis (Sections 1.1, 6.1, 6.7).
• Updated the exports: after “Create backup (JSON)” the app first shows the folder and the file name, which contains the date and time, and shares the backup only if you ask; if a file cannot be saved, its content is shared as text; export files are not deleted by signing out, “Clear all data” or account deletion (Section 6.6).
• Documented behaviour the app has as of the update this version accompanies: the push token row is deleted when you sign out (Section 4.4); “Clear all data” and in-app account deletion delete every attachment you uploaded that is still linked to a task you can reach, including files on tasks in the shared lists you are still in (Sections 10.1, 10.2); corruption backups, the offline queue and the cache of opened attachments are removed on clear-all, sign-out and account deletion (Sections 4.1, 8, 10.1); turning notifications off cancels the reminders already scheduled (Section 9); a restorable JSON backup exists next to the CSV exports (Sections 6.6, 9).
• Corrected statements about data collection that did not match the app: RevenueCat runs on every installation and receives the account identifier of every signed-in user, not only of buyers (Sections 1.7, 1.9, 2, 3, 6.8, 7); the push token is stored for every signed-in user who allowed notifications, there is no separate shared-list push switch (Section 1.5); attachments are not a Pro-only feature (Sections 1.4, 3, 4.3); Firebase Cloud Messaging is a second third-party SDK next to RevenueCat, and Google Play provides the in-app rating prompt, which Taskr asks for at most once (Sections 1.7, 6, 8); shared-list pushes are sent when a task is added or completed, not edited, do not name the member who acted and carry three data fields that let the app open the right task (Sections 1.8, 5.2, 6.2); local reminders show only the task title, and the optional recurring reminder contains no task content (Section 1.8); coordinates are not converted into an address (Section 1.6); the local cache holds the full content of all shared tasks, not just badges (Section 4.1); without an account your content stays on the device, but the RevenueCat SDK and, if you allow notifications, Google Play services still receive an identifier (Section 4.1).
• Corrected statements about sharing, exports and deletion: the invite link is one non-expiring token per list, rotated only when an accepted member is removed or leaves (Sections 5.1, 6.7); only the owner sees the member list, and members receive the owner's e-mail address only through the invitation e-mail (Sections 1.3, 5.1, 5.2); a member leaves a list via its share sheet, not via Settings, and members' local copies disappear at the next refresh after the owner stops sharing (Section 5.3); the inviter's e-mail address also appears in the invite e-mail's subject line (Section 6.7); exports are first saved to the Documents folder and stay there (Section 6.6); the CSV export omits coordinates, attachments, per-task timezone and shared tasks (Section 9); signing out wipes your task data on the device (Section 8); the app has its own “Delete account” button next to the e-mail route (Sections 8, 10.2).
• Removed the promised in-app notice for policy changes, which the app does not have; changes are announced through this version history and the Play Store release notes (Section 12). Also removed the announced POST-based join flow for invite links, for which no work is planned (Section 5.1).
• Made several statements more precise after a final check against the app and our server: “Open in Maps” hands a task's coordinates to your maps app when the task has them, and a JSON backup contains them (Sections 1.6, 6.4, 6.6); RevenueCat's dashboard shows us totals of installations, which we look at together with simple counts from our own database (Sections 1.7, 3, 6.8); our server keeps a record of recent shared-list notification requests and a running total of your attachment storage, and its logs can contain account identifiers (Section 8); from app version 1.7.0, someone who tries to join a full list is told its limit (Section 5.1); an open invitation that another user sent to your address is not removed with your account (Section 10.2); and which calls carry your sign-in token (Section 4.2).

Version 2.4 (September 8, 2026):

• Corrected the stated hosting region. Supabase (database, file storage, authentication) and Resend both run in the AWS eu-west-1 region, which is Ireland. Earlier versions of this policy described eu-west-1 as “Frankfurt, Germany” — Frankfurt is a different AWS region (eu-central-1). Nothing about the actual processing changed: your data has been stored and processed inside the European Union the whole time, and still is. Only the description of which EU location was inaccurate, and it has now been corrected in Sections 4.2, 4.3, 4.5, 6 and 7.

Version 2.3 (June 29, 2026):

• Disclosed the optional Taskr Pro subscription: new Section 1.9 (subscription & purchase data, with the payment handled by Google Play and the on-device-only 14-day trial), Section 6.8 (RevenueCat, Inc., USA as subscription-management processor — data sent, IP/metadata, processor role + DPA, backend webhook, restore flow) and Section 6.9 (Google Play Billing).
• Added the matching US international-transfer safeguard (Section 7, SCCs / EU–US DPF), a retention bullet for subscription records (Section 8), a deletion step for the RevenueCat customer record (Section 10.2), and a Pro bullet in both the contract legal basis (Section 2) and "How we use your information" (Section 3).
• Clarified (Sections 1.7 and 6) that RevenueCat is the only third-party SDK, processes purchase data only, and that the sole "analytics" purpose is aggregate subscription metrics — not behavioural or app-usage analytics.
• Stopped stating exact prices in the policy (shown in-app / on Google Play instead) and attributed third-party claims (no data sale, transfer mechanism) to RevenueCat's own DPA.

Version 2.2 (May 27, 2026):

• Added Section 6.7 disclosing Resend as transactional e-mail subprocessor (Resend Labs Inc., USA, EU region eu-west-1 in Frankfurt). Used for shared-list invite e-mails initiated via the e-mail field, and for Supabase Auth e-mails (account confirmation, password reset).
• Detailed data shared with Resend (invitee + inviter e-mail, list name and icon, invite token), retention (30 days for delivery logs, no body content retained after delivery), legal basis (Art. 6(1)(b) and 6(1)(f)).
• Linked Resend's own privacy policy and DPA.
• Clarified that users can avoid Resend entirely by using the "Share invite link" button (Section 6.6) instead of the e-mail field — that pathway never touches Resend.

Version 2.1 (May 26, 2026):

• Added Section 1.6 disclosing on-demand location data collection (lat/lng via "Current location" button), including both ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION permissions.
• Renumbered "What we DO NOT collect" to 1.7, with explicit statements about no background tracking, no geo-fencing, no automatic tagging, no advertising IDs, no analytics SDKs.
• Added Section 1.8 disclosing notification content (task text visible on lock screen, accessible to screen readers).
• Updated Section 4.1 with local storage key structure (tf-v4) and corruption-backup retention.
• Added Section 4.6 disclosing realtime WebSocket sync channel scope.
• Rewrote Section 5 with explicit disclosure of: invite-link security (token in URL), member access scope (no per-field permissions), cascade-delete semantics, owner-vs-member differences, Free/Pro member cap.
• Added Section 6.5 disclosing external browser handoff for URL taps.
• Added Section 6.6 disclosing Android share sheet for invite links and data export.
• Rewrote Section 10 with explicit "Clear all data" scope (5-step wipe order) and the distinction between "Clear all data" and full account deletion.

Version 2.0 (May 10, 2026): initial GDPR-compliant rewrite with Supabase + FCM disclosure. Superseded v1.0 (April 2026).

13. Contact & Data Controller

The data controller for the personal data we process is:

BMA Nexus
Email: bmanexusapps@gmail.com

For any privacy questions, data-subject access requests or complaints, please use the email address above. We aim to respond within 30 days as required by GDPR Art. 12.