Tasklio holds information about children, so here is the whole picture in plain English — not buried in a policy.
⚠ This policy is not finished
Placeholder values are still present in lib/legal.ts. A privacy notice must name the data controller and give real contact details before it is published. Fill in every field marked TODO.
Your email address
So you can sign in and recover your account.
Your children's names or nicknames
Whatever you typed in. A nickname works perfectly.
Chores, points, rewards, allowance
The chart itself — what you came here to keep.
A hash of your password and PINs
Scrambled one-way. Not recoverable, not even by us.
That is the complete list. Tasklio asks for a child's first name because a chore chart needs a name on it — a nickname is genuinely fine, and we'd rather you used one.
A child's email address, phone number or date of birth
Photographs of anyone — avatars are drawings generated from a seed
Location, contacts, or anything from the rest of your device
Payment or card details — Tasklio is free and has no billing system
Advertising identifiers, or any data sold or shared with advertisers
Your browser never touches the database
Every request goes through our server, which checks who you are and only ever reads or writes your own family’s records. The server itself connects with a restricted database account that can read and write rows but cannot change or drop tables, and nothing else on the machine can open the database at all.
PINs are hashed, and the hashes stay on the server
Parent and child PINs are hashed with Argon2id, salted, and keyed with a secret that lives only on the server — so even a stolen copy of the database would not reveal them. PIN hashes are never sent to any browser, not even your own. Every check happens on the server, and five wrong guesses lock a PIN for 15 minutes.
Children cannot be reached through Tasklio
There is no messaging, no comments, no friend list, no uploads and no public profile. A child signs in with a username and PIN their parent set up, sees their own chart, and that is the whole surface. There is nowhere for a stranger to appear.
Hardened by default
All traffic is HTTPS with HSTS. Sessions live in secure, HttpOnly cookies that page scripts cannot read, and requests from other websites are refused. A Content-Security-Policy blocks scripts from other sites and forbids the site being framed. Sign-in, PINs and account deletion are rate-limited against brute force, and those limits are stored in the database so they survive a restart rather than resetting for an attacker.
Your family data sits in a PostgreSQL database hosted in USA. We keep the list of outside companies deliberately short — each one below is contractually bound to act only on our instructions, and none of them may use your data for their own purposes.
Resend · United States
Transactional email — account confirmation, password reset, support messages
Sees: Email address and the content of the message being sent
Cloudflare · Global edge network
CDN, TLS termination and DDoS protection
Sees: IP address and request metadata, in transit
We do not sell personal data, and we have never received a government request for it. If that changes, we will say so.
Take it with you
Settings → Download my data gives you a JSON file of everything: your account, every child, every chore, every reward.
Delete it for good
Settings → Delete Account removes your account, all children, all history, and your login — immediately, not on a schedule. There are no billing records to keep, so nothing is held back.
If you are in the EU or UK you also have the right to correct your data, restrict or object to how we use it, and complain to your national data protection authority without going through us first. The Privacy Policy sets out each right, the legal basis for every use, and how long we keep things.
Something here unclear, or want data removed? Get in touch.