TaskFlow AI ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web service (collectively, the "Service"). Please read this policy carefully. By using the Service, you consent to the data practices described in this policy.
1. Information We Collect
1.1 Information You Provide
| Data Type | Examples | Purpose |
|---|
| Account Information | Name, email address | Account creation, authentication, communication |
| User-Generated Content | Tasks, notes, projects, reminders, documents, chat messages | Core app functionality — managing your productivity |
| Health & Wellness Data | Sleep hours, sleep quality, mood entries, yoga progress | Wellness tracking features; stored locally on your device |
| Employment/Shift Data | Employee names, client names, work hours, signatures | Timetable and shift tracking features |
| Financial Data | Budget categories, transaction descriptions (no bank credentials) | In-app finance tracking; never shared externally |
| Resume/Career Data | Work experience, skills, education details | Resume builder and career matching features |
1.2 Information Collected Automatically
| Data Type | How Collected | Purpose |
|---|
| Device Information | User-agent, screen size, OS version | Responsive UI optimization |
| Usage Data | Pages visited, features used, timestamps | Improving the Service and debugging |
| Location Data | GPS coordinates (only when logging shifts, with explicit permission prompt) | Verifying employee shift check-in locations |
1.3 Third-Party Service Data
- Clerk Authentication: We use Clerk for secure sign-in. Clerk may process your name, email, and authentication tokens. See Clerk's Privacy Policy.
- Google OAuth (optional): If you connect Google Workspace, we request read-only access to Gmail labels and Google Calendar events. We do NOT store your Google password. Access tokens are stored securely on our server and can be revoked at any time from your Google Account settings.
- AI/LLM Providers (optional): If you configure an AI key (OpenAI, Google Gemini, etc.), your prompts are sent directly to the provider's API. We do not store AI conversation logs on our servers beyond the current session.
2. Device Permissions
TaskFlow AI may request the following device permissions. Each is optional — the app functions without them, but certain features require them:
| Permission | Feature | When Requested |
|---|
| Notifications | Proactive AI reminders, task alerts, shift nudges | On first app launch |
Microphone (android.permission.RECORD_AUDIO) | Voice Assistant — speech-to-text transcription of your spoken commands so the assistant can create tasks, set reminders, open pages, and respond hands-free | Only when you tap the Voice AI mic button or enable Voice Mode in the assistant. Mic stays off otherwise. |
| Location (GPS) | GPS stamp on employee shift check-ins | When you submit a shift record |
| Camera (future) | Document scanning (planned feature) | Not currently requested |
Important: You can revoke any permission at any time through your device's Settings app. Revoking a permission will disable only the specific feature that depends on it.
2.1 Microphone & Voice Data Disclosure
The TaskFlow AI mobile app declares the android.permission.RECORD_AUDIO permission solely to power the on-device Voice Assistant. We are explicit about what happens with your voice:
- When the microphone is active: only while you are actively interacting with the Voice Assistant — i.e. you have tapped the mic button or enabled Voice Mode and the in-app mic indicator is showing. The mic is closed the moment you stop speaking, exit the screen, leave Voice Mode, or close the app. There is no always-on listening, no wake-word service, and no background audio capture.
- What we do with the audio: we pass it to your device's built-in speech-to-text recognizer (Android
SpeechRecognizer / Google's on-device speech service or whichever provider your device uses) to transcribe your spoken command into text. Once we have the text, the audio buffer is discarded.
- What we do NOT do: we do not record, store, upload, or transmit raw audio to TaskFlow AI servers. We do not retain audio after transcription. We do not share audio with advertising or analytics providers. We do not use audio to identify you, build a voice profile, or train AI models.
- Where the transcript goes: the resulting text command is processed by our on-device assistant. By default it stays on the device. If you have explicitly enabled "Hybrid" or "BYOK" assistant mode in Settings, the text command is sent to your chosen LLM provider (OpenAI / Anthropic / Google Gemini, using your own API key) for a richer reply — same as if you had typed the command. In "Offline" or "Privacy" mode, the transcript never leaves the device.
- Your control: you can revoke microphone permission at any time via your device Settings. The rest of the app continues to work; only the Voice Assistant is disabled.
- Children's audio: the app is not directed at children under 13 (see Section 7). We do not knowingly collect audio from children.
3. How We Use Your Information
- To provide, maintain, and improve the Service.
- To authenticate your identity and secure your account.
- To send proactive AI notifications (task reminders, wellness nudges, missed deadline alerts).
- To generate AI-powered insights (wellness tips, task strategies, auto-scheduling).
- To enable team collaboration features (live chat, task sharing) between consenting users.
- To generate shift reports, timesheets, and analytics.
- To respond to your support inquiries.
4. Data Storage & Security
- Server-side data (tasks, reminders, projects, shifts) is stored in a JSON-based database on our secure server infrastructure.
- Client-side data (sleep logs, yoga progress, meditation history, wellness preferences) is stored in your browser's
localStorage and is never transmitted to our servers.
- Encryption: All data in transit is encrypted using TLS/HTTPS. Passwords are managed by Clerk and are never stored on our servers.
- Access control: Each user can only access their own data. Data is filtered by authenticated user ID on every API request.
5. Data Sharing & Disclosure
We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:
- Service Providers: Clerk (authentication), and any AI provider you configure (only your prompts, sent directly to their API).
- Legal Requirements: If required by law, regulation, legal process, or governmental request.
- Safety: To protect the rights, property, or safety of TaskFlow AI, our users, or the public.
- Business Transfers: In connection with a merger, acquisition, or sale of assets (with prior notice).
No Advertising: We do not use your data for advertising purposes. We do not share your data with advertising networks or data brokers.
6. Data Retention & Deletion
- Your data is retained for as long as your account is active.
- Account deletion: You may request complete deletion of your account and all associated data by contacting us at [email protected]. We will process deletion requests within 30 days.
- Local data: Client-side data (localStorage) can be cleared at any time by clearing your browser storage or uninstalling the app.
- Google OAuth tokens: If you disconnect Google integration, we immediately delete your stored access and refresh tokens.
7. Children's Privacy
TaskFlow AI is not intended for children under the age of 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If we discover that a child under 13 has provided us with personal data, we will delete it immediately. If you believe a child has provided us with data, please contact us at [email protected].
8. International Users
If you access the Service from outside the country where our servers are located, your information may be transferred to, stored, and processed in a different jurisdiction. By using the Service, you consent to such transfer. We take steps to ensure your data is treated securely and in accordance with this Privacy Policy.
9. Your Rights
Depending on your jurisdiction (including GDPR, CCPA), you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your personal data ("right to be forgotten").
- Export your data in a portable format (CSV export is built into the app).
- Withdraw consent for optional data processing (e.g., location tracking, notifications).
- Object to processing of your data for certain purposes.
To exercise any of these rights, contact us at [email protected].
10. Third-Party Links
The Service may contain links to third-party websites or services (e.g., Google Maps for shift location viewing). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: