Privacy Policy for TaskKit

Welcome to TaskKit ("TaskKit," "we," "us," or "our"), developed and published by Zerqon Labs. TaskKit is a mobile productivity, routine-planning, and virtual companion application available on iOS and Android (Bundle ID / Package Name: com.TaskKit.app / com.taskkit.app).

We are committed to protecting your privacy and being transparent about how we collect, use, store, and share your information. This Privacy Policy explains our data practices when you use the TaskKit mobile application, home-screen widgets, AI companion ("TaskKit Companion"), and related services (collectively, the "Service").

By downloading, accessing, or using TaskKit, you agree to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

1. Information We Collect

We collect information in three primary ways: (a) information you provide directly to us, (b) information stored locally on your device, and (c) information collected automatically when you use the Service.

1.1 Information You Provide Directly

• Account & Authentication Information: When you register for an account or log in via Supabase Auth, we collect your email address and encrypted password. You may also use certain features of the app in guest mode prior to or without creating a permanent account.
• Onboarding & Personalization Preferences: During onboarding, we collect your selections regarding your day-to-day lifestyle (e.g., student, working professional, freelancer, parent/caregiver) and productivity goals or friction points (e.g., task paralysis, time blindness, building consistent habits) to tailor your starter routines.
• Tasks, Routines & Schedules: We collect the task titles, categories (focus, wellness, routine, creative), scheduled dates, deadlines, and completion statuses that you create manually or generate through the TaskKit Companion.
• Mind Journal & Reflection Entries: When you create manual reflections in the Mind Journal or save reflection summaries from your chats, we collect the entry heading, feeling summary, solution/action notes, and timestamps.
• AI Companion Conversations ("TaskKit Companion"): When you chat with TaskKit Companion, you provide text prompts and messages regarding your daily schedule, tasks, or feelings of overwhelm.

1.2 Information Stored Locally on Your Device

To provide fast, offline-capable performance and iOS WidgetKit support, TaskKit stores certain data locally on your device using React Native AsyncStorage, local SQLite, and Apple App Groups (group.com.TaskKit.app):

• Chat Session History: Your multi-session conversation threads with TaskKit Companion are stored locally on your device (@taskkit_chat_sessions_v1). When you send a message to the AI companion, only a sliding window of recent messages (up to the last 10–15 messages) is transmitted to our secure backend to generate a response.
• Companion Progression & Cosmetics: Your virtual pet's level, XP, equipped badges, auras, and accessories (useLevelStore, useBadgeStore, useAuraStore, useAccessoryStore) are stored locally on your device.
• Widget Snapshot Data: Pending task titles, due times, and daily completion counts are shared locally between the main app and the TaskKit home-screen widget via your device's secure App Group container.

1.3 Information Collected Automatically (Device, Subscription & Advertising Data)

• Subscription & Transaction Metadata: When you view our paywall or purchase a subscription ("TaskKit Plus" / "pro" entitlement), our subscription processor (RevenueCat) collects transaction identifiers, product identifiers, subscription status, trial status, localized pricing/currency, and device identifiers ($idfv, $idfa if authorized, $gpsAdId, $androidId, and IP address) to validate receipts and prevent fraud.
• App Tracking Transparency (iOS ATT) & Advertising Identifiers: On iOS 14.5+, we ask for your permission via Apple's App Tracking Transparency framework ("Your data helps us analyze marketing performance and understand how users discover our app.").
  • If you grant permission: We collect your Apple Identifier for Advertisers (IDFA) and share attribution events with our marketing partners (TikTok Business SDK and Meta / Facebook SDK).
  • If you deny permission: We do not access or share your IDFA.
• App Usage & Funnel Events: We log key app lifecycle and milestone events—such as app installs/launches, onboarding step completions, account registration, paywall views, checkout initiation, subscription purchases/trials, task creation/completion counts, and companion level-up milestones—to understand app performance and measure marketing effectiveness.

2. How We Use Your Information

We use the information we collect for the following purposes:

1. Provide and Sync the Service: To authenticate your account, sync your tasks and journal entries across devices, render home-screen widgets, and trigger local scheduled push notifications (such as 30-minute task warnings, due-time nudges, and daily morning briefings).
2. Power the AI Companion ("TaskKit Companion"): To process your natural-language prompts via our authenticated Supabase Edge Function and our AI provider (DeepSeek), enabling automatic task breakdown, categorization, scheduling, and reflection summaries.
3. Life-Safety & Crisis Interception: TaskKit includes an on-device safety filter (services/crisis.ts) that scans chat input locally on your device for indicators of self-harm or severe crisis. If detected, the message is not sent to the AI model; instead, the app immediately surfaces 24/7 crisis resources (such as the 988 Suicide & Crisis Lifeline and Crisis Text Line).
4. Manage Subscriptions & Entitlements: To process free trials, recurring subscriptions, and purchase restorations through Apple App Store, Google Play Store, and RevenueCat.
5. Analytics, Attribution & Ad Optimization: To measure how users discover TaskKit, evaluate onboarding conversion rates, and optimize marketing campaigns on TikTok and Meta (including Value-Based Optimization and Conversions API attribution).
6. Security & Abuse Prevention: To enforce authentication checks, rate-limit API requests (e.g., capping AI requests per minute), and protect against unauthorized access or service abuse.

3. Third-Party Service Providers & Data Sharing

We do not sell your personal task lists, journal entries, or chat transcripts to data brokers. We share limited data only with trusted third-party service providers required to operate, secure, and market the Service:

We may also disclose information if required to do so by law, regulation, subpoena, or court order, or to protect the safety, rights, or property of our users, the public, or TaskKit.

4. Data Retention & Deletion

• Cloud Data (Supabase): Your account profile, synced tasks, and Mind Journal entries are retained for as long as your account remains active. You can delete individual tasks and journal entries directly within the app at any time, which immediately removes them from our database.
• Local Device Data: Chat sessions with TaskKit Companion, companion XP/levels, and widget caches are stored locally on your device. You can delete individual chat sessions inside the Chat History sheet or clear all local app data by uninstalling the TaskKit app.
• AI Processing: Prompts sent to our Supabase Edge Function for DeepSeek processing are transmitted ephemerally to generate your response and tool calls (schedule_tasks, save_chat_summary).
• Account Deletion Requests: You may request complete deletion of your account and all associated cloud data at any time by contacting us at the support email listed below. Upon verification, we will permanently delete your Supabase Auth record and all associated database records within 30 days.

5. Your Privacy Rights & Choices

Depending on your jurisdiction (including the European Economic Area/UK under GDPR, California under CCPA/CPRA, and other applicable US state or international privacy laws), you have the following rights:

• Access & Portability: Request a copy of the personal data we hold about you.
• Correction & Deletion: Edit or delete your tasks, journal entries, and chat history in-app, or request full account deletion.
• Opt-Out of Cross-App Tracking (iOS ATT & Android Ad Settings): You can revoke or manage tracking permissions at any time in your device settings:
  • iOS: Go to Settings > Privacy & Security > Tracking and toggle off TaskKit.
  • Android: Go to Settings > Google > Ads (or Privacy > Ads) to reset or delete your advertising ID.
• Push Notification Controls: TaskKit uses local scheduled notifications for task warnings, due times, and morning briefings. You can disable notifications at any time in your device's system settings.

To exercise any of your privacy rights, please contact us using the details in Section 9.

6. Security

We implement industry-standard technical and organizational safeguards to protect your data:

• All network traffic between the TaskKit app, Supabase, RevenueCat, and DeepSeek is encrypted in transit using HTTPS/TLS.
• Our AI Edge Function enforces strict Supabase JWT session authentication (401 Unauthorized rejection for unverified callers), per-user sliding-window rate limiting (15 requests/minute), and strict payload sanitization.
• Passwords are never stored in plain text and are managed via Supabase Auth's cryptographic hashing.

However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Children's Privacy

TaskKit is not directed to children under the age of 13 (or the minimum age of digital consent in your jurisdiction, such as 16 in certain regions). We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal data from a child under 13 without verifiable parental consent, we will promptly delete that information.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our features, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this policy and, where appropriate, notify you within the application.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

• Application Name: TaskKit
• Developer / Publisher: Zerqon Labs
• Email: support@zerqonlabs.com
• Website: https://taskkit.zerqonlabs.com