⚠ This policy is not finished
Placeholder values are still present in lib/legal.ts. A privacy notice must name the data controller and give real contact details before it is published. Fill in every field marked TODO.
Tasklio is a chore chart for families, which means it holds information about children. We treat that as a reason to collect as little as possible and to be exact about what happens to it. There is no advertising in Tasklio, we do not sell or share data with anyone for their own purposes, and we do not build profiles of you or your children.
For a plain-English walkthrough of how the system actually stores and protects your data, see How we handle your data.
The data controller is Kenneth H., TODO — postal address, United States of America.
For any privacy question or to exercise a right below, email [email protected] or use the contact form. We answer within 30 days, as required by GDPR Art. 12(3).
Account
Your email address; an Argon2id hash of your password (never the password itself); account creation date.
Why: To create your account, sign you in, and send you the confirmation link.
Legal basis: Performance of a contract (Art. 6(1)(b))
Family data
Children's first names or nicknames, chosen avatars, chore lists, completion history, points, rewards and allowance balances.
Why: This is the service itself — the chore chart you came here to keep.
Legal basis: Performance of a contract (Art. 6(1)(b))
Parent PIN
An Argon2id hash of your 4-digit PIN, salted and keyed with a secret held only by the server.
Why: To gate parent-only actions on a shared family device.
Legal basis: Performance of a contract (Art. 6(1)(b))
Child sign-in credentials
A generated username (sign-in code) and an Argon2id hash of each child's 4-digit PIN.
Why: To let a child sign in without needing an email address of their own.
Legal basis: Performance of a contract (Art. 6(1)(b))
Abuse prevention
A short-lived counter keyed to an IP address or account ID.
Why: To rate-limit sign-in and PIN attempts so accounts cannot be brute-forced.
Legal basis: Legitimate interests (Art. 6(1)(f)) — keeping the service secure
Support messages
Whatever you choose to put in the contact form, plus your email address.
Why: To answer you.
Legal basis: Legitimate interests (Art. 6(1)(f)) — responding to enquiries
We do not collect payment information of any kind — Tasklio is free and has no paid tier, no card processor and no billing records. We do not ask for a child's email address, phone number, date of birth, photograph or location, and there is nowhere in the app to provide one.
Only an adult can create a Tasklio account, and only the account holder can add a child profile. Everything Tasklio knows about a child was entered by their parent or guardian, who decides what to put there — a first name or a nickname is enough, and we recommend a nickname.
Children sign in with a username and PIN their parent sets up. We never collect an email address or any contact detail from a child, and children cannot message anyone, upload anything, or be contacted through Tasklio.
Because the parent supplies and controls this data, the parent exercises the child's rights on their behalf through the account. Deleting the account deletes the children's profiles with it.
Family data is stored in a PostgreSQL database hosted in USA. Access is limited in two ways: your browser never talks to the database directly — every request goes through our server, which only ever reads and writes the signed-in account's own records — and the server itself connects with a restricted database account that can read and write rows but cannot alter or delete tables.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell affected users directly, as required by GDPR Art. 33 and 34.
We use a small number of service providers, each bound by a data processing agreement to act only on our instructions. We do not sell personal data, and we do not share it for anyone else's marketing.
Resend · United States
Transactional email — account confirmation, password reset, support messages
Shared: Email address and the content of the message being sent
Their data processing terms →Cloudflare · Global edge network
CDN, TLS termination and DDoS protection
Shared: IP address and request metadata, in transit
Their data processing terms →Where a provider is outside the EEA or UK, the transfer relies on the European Commission's Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified under it.
We may also disclose data where we are legally compelled to — a court order or equivalent binding demand. We will tell you when we are permitted to.
There are no financial records to retain, because Tasklio takes no payments.
If you are in the EEA or UK, the GDPR gives you the rights below. We extend them to every user regardless of where they live.
Access, export and erasure are all self-service from the Settings page — you do not need to ask us. Exercising any of these rights is free and will never result in worse service.
Tasklio sets no advertising or cross-site tracking cookies, and there is nothing here to consent to beyond what the app needs to function. Specifically:
These are strictly necessary for the service you asked for, and are exempt from consent requirements under the ePrivacy Directive.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects, within the meaning of GDPR Art. 22. Points and rewards are calculated from rules the parent sets, and nothing in Tasklio scores, ranks or categorises a child for any purpose beyond displaying the chart the parent configured.
If we change how data is handled in a way that affects you, we will update the effective date above and notify account holders by email or in-app notice before the change takes effect. Past versions are available on request.
Questions, concerns or requests: [email protected] or the contact form.