01Who we are
TaskSync is operated by [Janisha Bindal], registered at [D-152 Preet Vihar Delhi 110092 India] ("we," "us," "TaskSync"). TaskSync is built for use within India and is available as a web app at tasksync.co.in/app and, where released, as a mobile app for Android and iOS — both connect to the same account and the same data.
For any privacy question, request, or complaint, our Grievance Officer is reachable at the address in Section 14.
02Information we collect
Account information. Full name, email address, a password stored only as an irreversible cryptographic hash, your role (Employer or Employee), and your team.
Task and work data. Task titles, descriptions, deadlines, priority, repeat schedules, comments, voice notes, photos, documents, contact details you attach to a task, and reschedule requests.
Identity verification documents. Where an Employer has switched this on for their team, an Employee may be asked to upload a copy of their Aadhaar card, PAN card, and a profile photo, for employment verification. See Section 11 for an important note specific to Aadhaar.
Device and diagnostic information. Device or browser type, operating system, app version, and crash/error logs — never used to build an advertising profile, and never shared with advertisers.
Browser-specific data, web app only. The web app uses your browser's local storage solely to keep you signed in between visits (an authentication token managed by our login system). We do not use third-party tracking cookies, advertising cookies, or analytics scripts. No data is collected before you create an account or sign in.
Permissions, mobile app. Camera, photo gallery, microphone, file storage, and notifications — each requested only for the matching in-app feature (attaching a photo, recording a voice note, alerting you to a deadline). You can deny or revoke any of these in your device settings at any time.
| What we don't collect |
|---|
| Precise GPS location, your phone contacts (only details you manually type into a task), advertising identifiers, or any data via third-party tracking SDKs. We run no ads. |
03How we use it
| Purpose | Data used |
|---|---|
| Operate task assignment, tracking, and completion | Account info, task data |
| Send task and deadline alerts | Account info, deadlines |
| Verify employee identity, at the Employer's request | Identity verification documents |
| Generate performance analytics, visible only to the relevant Employer | Task completion history |
| Diagnose and fix technical issues | Device/diagnostic info |
| Respond to support and grievance requests | Account info, your message |
| Comply with a lawful request from a court or authority | Whatever is specifically required |
We never sell, rent, or trade your information. We never use task content, files, or identity documents for advertising, profiling, or any purpose unrelated to running TaskSync.
04Who can see it
Data is organized strictly by Team. An Employer can see tasks they assign, all tasks within their Team, their members' names and roles, and — only where they've turned on identity verification — that Team's identity documents. An Employee can see tasks assigned to them, tasks they create, and their own profile. No one can see another Team's data, full stop.
TaskSync staff don't routinely access your task content or documents. Encrypted fields (Section 6) aren't human-readable by us even if our own systems were accessed.
05Where it's stored
| Provider | Purpose | Data involved |
|---|---|---|
| Google Firebase | Account login, task database | Account info, encrypted task data |
| Cloudinary | File and media storage | Encrypted photos, documents, voice notes, identity documents |
These providers may run data centers outside India as part of their global infrastructure. We haven't given any party beyond these two infrastructure processors access to your raw data, and both are bound by their own security and confidentiality obligations to us.
06How it's protected
We encrypt the following with AES-256-GCM before it ever leaves your device: task titles and descriptions, comments, contact names and numbers, uploaded files and photos and voice notes, and identity verification documents.
The encryption key is derived on-device for each Team using a PBKDF2 key-derivation function and is never transmitted to or stored on our servers. Even unauthorized access to our database wouldn't make these fields readable without the Team's own device-derived key. Passwords are hashed, never stored as plain text.
No method of storage or transmission is perfectly secure. If we become aware of a breach affecting your information, we'll notify you and the Data Protection Board of India without undue delay, as required by law.
07Retention
- Active accounts — retained as long as your account is active.
- Account deletion — your profile is deleted within 30 days. Task data you created stays visible to your Team as a historical record unless your Employer separately deletes it.
- Team deletion — all associated tasks, files, and identity documents are permanently deleted within 30 days.
- Identity documents — kept only while your Employer keeps you active on their Team, or until you request deletion.
- Backups — may persist up to 90 days post-deletion for disaster recovery only.
08Your rights
You can:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Request erasure of your information
- Withdraw consent for anything based on consent, at any time
- Nominate someone to exercise these rights on your behalf if you pass away or become incapacitated
- Lodge a grievance with us, and if unresolved, approach the Data Protection Board of India
Email our Grievance Officer (Section 14) to act on any of these. We may verify your identity first. If you're an Employee, some records (like identity documents collected for your Employer's own compliance) may need to be actioned by your Employer directly, since they determine why and how that data is collected within their Team.
09Children
TaskSync is built for working adults. You must be at least 18 to create an account, matching the definition of a "child" under the Digital Personal Data Protection Act, 2023. We don't knowingly collect data from anyone under 18; if we learn we have, we delete it promptly.
10Legal framework
This policy is designed around two layers of Indian law: the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, which currently govern sensitive personal data handling in India, and the Digital Personal Data Protection Act, 2023, whose substantive provisions the Government of India is bringing into force in phases. We intend to stay aligned as each phase takes effect.
11A note on Aadhaar
12Third parties
Beyond the two infrastructure providers in Section 5, we don't share your data with anyone. TaskSync contains no advertising networks and no third-party analytics or tracking SDKs, on web or mobile.
13Changes to this policy
We may update this policy as TaskSync evolves or legal requirements change. If a change is material, we'll notify you in the app before it takes effect. The date at the top of this page always reflects the latest revision.
14Contact us
We acknowledge complaints within 48 hours and aim to resolve them within 30 days.