OnTask

Privacy Policy

Effective October 21, 2026

The short version. You give us one thing: a way to sign in. Everything else is made by using the app or is optional. Your record lives on your phone and on our server in the United States until you delete your account. We never sell your data, show ads or track you across other apps. The app uses your microphone only while you record a voice message. One person runs OnTask and can open an account to help you; every look is recorded, and you can ask to see that record. While “Share usage data” is on, PostHog receives usage data without your name; turn it off in Settings. Delete your account in Settings › Account: it is frozen at once and erased 14 days later.

This page says, in plain words, what OnTask keeps about you and why. It covers the OnTask app and this website. Questions go to [email protected].

Who we are

OnTask is made and run by one person: Bogdan Crncevic, an individual developer who lives in Serbia. When you email support, he is who answers. In this policy, “we”, “us” and “OnTask” mean him. He is the person responsible for your data under data-protection law. The service may later be operated by a company owned by the same person; if that happens, we will tell you.

For anything about your data — a question, a copy, a correction, a deletion — email [email protected]. That is our one address for support, privacy and legal matters.

What this policy covers

It covers the OnTask app for iPhone and Android, the server behind it, and this website at on-task.co. The app opens this page from its settings. Our Terms of Service cover your agreement with us; this policy covers your data.

What we do not collect

• No precise location. The app asks for no location permission.
• No contacts, no calendar, and no camera roll beyond the files you pick for a problem report.
• No listening. The microphone is used only to record a voice message you choose to make in a problem report or in Give feedback. The app asks for the microphone once, the first time you press a microphone button, and that press records nothing. If you refuse, it never asks again; you can allow it later in your phone’s settings. A voice message is never recorded or played while the app is in the background.
• No passwords. OnTask has none.
• No card or bank details. The stores handle payment.
• No advertising identifiers, and no list of other apps on your phone.

What we collect, and why

The only thing you must give us to have an account is a way to sign in: a Google account, an Apple account or an email address. Everything else below is either created by using the app or is optional.

In short: your record stays until you delete your account; server logs 30 days; problem reports 30 days after we close them; feedback 30 days after we close it and never more than six months; emails to support no more than 24 months after the conversation’s last message; the website’s waiting list 90 days after we invite you, or 12 months if we never do; sync results 30 days (an upload that never finishes, 24 hours); backups 7 days; sign-in codes 10 minutes.

Each item below says what it is, why we have it, the legal basis we rely on, who else receives it, and how long we keep it. “Until you delete your account” means until the account is erased (deleted for good), 14 days after you ask (see Deleting your account). Backups can hold erased data for a few days more (see Deleting your account).

What you give us

• How you sign in. You sign in with Google, with Apple (on iPhone), or with your email address and a one-time code. We keep how you signed in and the identity and email address that sign-in gives us. If you hide your email with Apple, we hold only the relay address Apple gives us. Why: to give you an account and let you back into it. Legal basis: our contract with you. Who else: Google or Apple as your sign-in provider, under its own policy; Supabase, which runs our sign-in and database; Resend, which delivers our emails. Kept: until you delete your account.
• Your name, if Google or Apple offers one. Why: so that when you write to us we can find your account. No screen in the app shows it. The sign-in asks Apple for it once; email sign-in gives none. Legal basis: our contract with you. Who else: nobody. Kept: until you delete your account.
• Waiting-list email. If you join the waiting list in the app, we keep the address you give, which may differ from your sign-in address. Why: to email you when it is your turn. We use it for nothing else. Legal basis: our contract with you — you asked us to. Who else: Resend delivers the email. Kept: until you delete your account. To change the address, email us.
• Website waiting-list email. If you join the waiting list on this website, we keep an entry on the list: the address you type, when you joined, and whether and when we invited you — nothing else. This list is separate from the waiting list in the app and is not tied to any OnTask account. We send you nothing automatically: we get a short email saying that you joined, and when it is your turn, we write to you ourselves with an access code. We do not keep your network address with your entry; our server’s logs keep it for 30 days, as for any request (see Network address in server logs). Why: to send you an access code. We use it for nothing else. Legal basis: a step you asked us to take before any agreement with us — you asked to be put on the list. Who else: Supabase holds the list. Resend delivers the email about your sign-up to us, and Google holds it in our mailbox. Kept: 90 days after we invite you, or 12 months after you joined if we never do; the email about your sign-up, no more than 15 months after you joined, or sooner if you ask. To be taken off the list sooner, email [email protected]: we delete your entry, and that email, at once (backups can hold it for up to 7 more days). Deleting an OnTask account does not remove it. To get a copy of what we keep, email us too; we first check that the address is yours.
• Emails to support. The emails you send to [email protected], and our replies. Why: to answer you. Legal basis: our contract with you where an email is about your account or a purchase; otherwise our legitimate interest in answering the people who write to us. Who else: Google. [email protected] is a Google Group on our Google Workspace account, and Google holds these emails under its data processing terms. Google may store them outside the United States. Kept: deleted no later than 24 months after the conversation’s last message.
• Your setup answer. During setup you tell us whether your constraint is supply, demand or you are unsure, and we record that setup is complete. Why: to shape the app for you. Legal basis: our contract with you. Who else: while “Share usage data” is on, the answer rides on the setup event sent to PostHog. Kept: until you delete your account.

What using the app creates

• Your record. The sessions you count, your activities with their names and leverage, your habits, your settings such as time zone and working days, and the answers you give during setup. They are saved on our server so your record is safe and reaches the phone you sign in on. Activity and habit names are free text, stored as you typed them, so a name is not the place for anything private. We use your record for nothing but running the app for you and, while “Share usage data” is on, for the counts described under Usage data, and the switch that stops it. Stopping paying never touches your data. Legal basis: our contract with you. Who else: Supabase hosts the database. Nobody receives your names or your record, with two exceptions you control. A problem report you send carries your last 7 days of events (see below). While “Share usage data” is on, PostHog receives counts and identifiers but never a name. Kept: until you delete your account, whole and uncompacted.
• A summary of your history. Beside your record, we keep a summary of it that your phone made, so that a new phone you sign in on can show your history at once. It holds your figures week by week, your most recent events, and your activity and habit names, and it comes with a small readable file of your weekly totals. Your phone makes a new one about once a week, and we keep only the newest. Our server keeps both exactly as your phone sent them and works nothing out from them; the checkpoint described next is made from your record, not from this summary or its file. Why: to show your history on a new phone straight away. Legal basis: our contract with you. Who else: Supabase hosts it. Kept: until you delete your account.
• Our server’s own checkpoint of your record. Our server may keep one checkpoint of its own. It holds your record as counted up to the end of a recent week: your figures week by week, your activity and habit names, and what the counting needs to carry on from there. Our server works it out from your record, using the same counting rules your phone uses. The server uses it so that it need not read your whole record each time: to check the events your phone sends against your record, to end a session at its time limit, and — while “Share usage data” is on — to prepare the usage events our server sends. When you sign in on a new phone, our server may send that phone this checkpoint instead of your phone’s summary, so it can show your history at once. It is sent only to the phone signed in to your account. It is only a shortcut: every event in your record stays, and the server can always start again from your record. The checkpoint is thrown away and made again from your record when the counting rules or its own format change, or when certain events are accepted into your record, such as one that belongs before it. Why: to keep sync fast, and to show your history on a new phone straight away. Legal basis: our contract with you; for preparing usage events, the legitimate interest described under Usage data and crash reports. Who else: Supabase hosts it. Kept: until you delete your account.
• Your devices. For each phone: its platform, system version, app build, the region its settings name, and when it last synced; the latest of each only. We also keep the last error a sync from your phone was answered with, so we can help if sync fails. Why: to sync your record and to understand a problem you report. Legal basis: our contract with you. Who else: nobody, unless you send a problem report. Kept: until you delete your account.
• Usage data and crash reports. While “Share usage data” is on, your phone sends usage events and crash reports to PostHog, and our server sends usage events. Events carry a pseudonymous account code (a code that stands for your account, not your name) and counts, minutes, identifiers and screen names — never a name, an email or free text. A crash report carries the same account code, the kind of error and where in the app’s code it happened — never the error’s own message, which could hold your words. Why: to learn where the app helps and where it fails, and to fix crashes; during early access we may also use it to decide which early-access users to ask for feedback. Legal basis: our legitimate interest in learning how the app is used and in fixing crashes. “Our legitimate interest” means a need of ours the law lets us meet without asking, as long as it does not outweigh your rights. You can object at any time by turning the switch off, and we stop at once. Who else: PostHog, United States. Kept: while your account exists; deleted at PostHog when it is erased. Details under Usage data, and the switch that stops it.
• Problem reports. If you send one from the app, it carries:
  • what you typed (up to 4,000 characters);
  • up to five photos or videos you choose to attach;
  • a voice message of up to three minutes, if you record one;
  • your app version, build number, system version and device model;
  • your last 7 days of OnTask events, activity and habit names included.
  Before your first report on a phone, the app tells you that reports include your device details and your last 7 days of OnTask activity, and lets you cancel. Photos, videos and a voice message upload to our private storage as you add them — a voice message when you stop recording — so that they are ready to send. Nothing becomes a report until you tap Send. If you leave without sending, what was uploaded is deleted at once; anything left behind in another way, such as when the app closes before you send or a recording you replaced, is deleted 30 days after its upload. Photos arrive with their metadata stripped. A voice message is recorded with no location in it, and our server removes location data from videos and voice messages before the report is saved. Please keep other people’s details and anything sensitive out of a report — what you type, what you attach and what you say alike. Only the person who runs OnTask listens to a voice message, and every time he opens one is recorded. Why: to understand and fix what went wrong, and to learn from any idea it carries. Legal basis: our contract with you for the text and device facts; your consent, given when you tap Send, for the attachments, the voice message and the excerpt; and, for learning from an idea a report carries, our legitimate interest in improving OnTask. Who else: Supabase holds the report, its files and its voice message in private storage. GitHub holds a private issue per report carrying only device facts and references into that storage — never your text, files, voice message, events or anything that identifies your account. Kept: 30 days after we close the report; a file or voice message uploaded but never sent goes as described above; all of it earlier if you delete your account. If you ask us to delete a report sooner — which is also how you withdraw your consent — we delete it at once.
• Feedback. During early access, while your account holds its own access code and for the first six months after that code was accepted, the app’s Settings has Give feedback. Each piece of feedback carries:
  • what you typed (up to 4,000 characters);
  • a voice message of up to three minutes, if you record one;
  • your app version, build number and platform (iPhone or Android).
  It carries no device model, no system version and none of your OnTask activity. Your text is sent only when you tap Send. A voice message uploads to our private storage when you stop recording, so that it is ready to send; nothing becomes feedback until you tap Send. If you leave without sending, the voice message is deleted at once; one left behind in another way, such as when the app closes before you send or a recording you replaced, is deleted 30 days after its upload. A voice message is recorded with no location in it, and our server removes location data from it before the feedback is saved. Please keep other people’s details and anything sensitive out of your feedback — what you type and what you say alike. Only the person who runs OnTask listens to a voice message, and every time he opens one is recorded. Why: to learn what to add to OnTask or change, and to decide whether to give you an extra month of Premium for it (see the Terms). Legal basis: our legitimate interest in improving OnTask from what its early-access users tell us. Who else: Supabase holds it in private storage. It never goes to GitHub. Feedback is not usage data, so the “Share usage data” switch does not stop it. Kept: 30 days after we close it, and never more than six months after it arrives, whichever comes first; a voice message uploaded but never sent goes as described above; all of it earlier if you delete your account. If you ask us to delete one piece of feedback sooner, we delete it at once.
• Subscription state and store receipt data. The early-access version of the app sells nothing; Premium goes on sale with a later version. If you buy Premium, the purchase is made in the App Store or Google Play under the store’s own policy. We never see your card details. RevenueCat checks the receipt for us and tells us whether Premium is active, which product and until when; we keep the receipt’s identifiers, that state, and each notice RevenueCat sends us. During early access, early-access users hold Premium for at least six months, and we keep that grant and its end date. Why: to unlock Premium, to restore a purchase on a new phone, to stop one receipt serving two accounts, and to account for money that moved. Legal basis: our contract with you; a legal obligation for the payment record; for the subscription events sent to PostHog, our legitimate interest in learning why people keep or stop paying. Who else: RevenueCat receives the store receipt and your account’s pseudonymous identifier; Apple or Google is the seller. Once Premium is on sale, RevenueCat also sends subscription events to PostHog under that same pseudonymous account code (see Usage data, and the switch that stops it). Kept: the receipt’s link to your account is released at erasure; the notices are kept as a payment record with the link to you removed.
• Your “Share usage data” choice. The last value of the switch your phone sent us. Why: so our server knows whether to pass your events to PostHog, and so a phone you sign in on can use the choice saved with your account. Legal basis: our legal duty to honour your choice. Who else: nobody. Kept: until you delete your account.
• Access code. During early access, we keep which access code your account used and the history of that code. We also keep a mark that your account was an early-access user’s, for as long as the account exists; it is destroyed with the account. If we give you an extra month of Premium for your feedback, we record it with the code’s history: when it was given, by whom, and your Premium’s end date before and after. Why: to run early access, which is by invitation, grant Premium to early-access users, and make sure the extra month is given only once per person. Legal basis: our contract with you; for the record of an extra month, our legitimate interest in giving it only once per person. Who else: nobody. Kept: the code is released from your account when it is erased; the code’s own history — which account held it and when it moved or was released — is kept for the accounting of early access. The record of a month given is personal data while your account exists; at erasure it stays with that history, de-identified — with nothing that names you or your account — so that the code never earns a second month.

What we keep to run and protect the service

• Roughly where you last synced. A city and country, worked out from your network address — never GPS. At each sync we keep only the city, the country and the date, replacing what we held before. The lookup runs on our own server against a location database we hold; the address is sent to no one for it. The app asks for no location permission. Why: so that when we look at an account to help you, or to check for misuse, we can see roughly where it was last used. Legal basis: our legitimate interest in supporting and protecting the service. Who else: nobody. Kept: only the latest, replaced at every sync, until you delete your account.
• Network address in server logs. Our server’s logs keep the network (IP) address of each request for 30 days, and then it is gone. It is never stored with your account. We also count requests per address for short windows to stop abuse; those tallies count only inside their window, a day at most, and are then swept. Why: security, rate limits and finding faults. Legal basis: our legitimate interest in keeping the service safe and working. Who else: Cloudflare and Render, which carry the request to our server. Kept: 30 days.
• Sync results. When your phone uploads events, our server keeps the result for each one: accepted, or refused and why. An upload that never finishes adds nothing to your record; it is deleted within 24 hours of starting, along with the events in it. Why: so our server can give your phone the same answer if an upload is sent again, and so we can see sync problems. Legal basis: our legitimate interest in keeping sync working. Who else: nobody. Kept: 30 days after the upload finishes, or until you delete your account, whichever comes first.
• Sign-in codes. A six-digit code we email you when you sign in with email or change your sign-in address. Legal basis: our contract with you. Who else: Resend delivers the email. Kept: 10 minutes, or until five wrong entries, then deleted. If you change your sign-in email, the new address is held while the code is live and for 24 hours after the change applies.
• Operator access records. Every time we search for, view, export or change an account, or read a problem report or a piece of feedback, our system records who did it, for which account and when. Why: so every look at your data is accounted for and can be shown to you. Legal basis: our legitimate interest in accountability, and our legal duties. Who else: nobody. Kept: after erasure, with the reference to you removed.
• Notes and flags on your account. While helping you, we may set flags on your account or write a short note about a support case. Why: to remember what we have already looked at or changed for you. Legal basis: our legitimate interest in running support. Who else: nobody. Kept: until you delete your account.
• Backups. Our database is backed up daily and each backup is kept for 7 days. Why: to recover from a failure. Legal basis: our contract with you and our legitimate interest in not losing your record. Who else: Supabase. Kept: 7 days, so erased data can persist in a backup for up to 7 days after erasure.

We make no decisions about you by automated means that have legal or similarly serious effects.

Usage data, and the switch that stops it

To learn where the app helps and where it fails, OnTask sends usage events and crash reports to PostHog. PostHog stores them for us and hosts them in the United States.

• Nothing is sent before you tap a sign-in button.
• After you sign in to an account you already have — with a sign-in button, on a new phone, or when a phone opens already signed in (see Security) — your phone sends nothing, not even a crash report, until it has read your saved “Share usage data” choice from our server. What it made in the meantime is then sent or dropped as that choice says.
• Events carry a pseudonymous account code — never your email, your name or your sign-in identity.
• Your activity and habit names never go to PostHog, and no free text does.
• PostHog is set to store no network (IP) address with any event.
• Once Premium goes on sale, with a later version of the app, subscription events from RevenueCat reach PostHog too. The early-access version sells nothing, so until then no such events are sent.
• “Share usage data”, a switch in the app’s settings, is on until you turn it off. Off, your phone sends no usage events and no crash reports, and our server stops passing your events to PostHog. Subscription events that RevenueCat sends to PostHog through its own link to PostHog are not stopped by this switch. They carry only your account’s pseudonymous code and the subscription’s state. RevenueCat and PostHog use that same code, so in PostHog a subscription’s events sit beside your usage events, and we can see how people who stop paying used the app. They are deleted with your account. Nothing held back while it is off is sent later.
• Turning the switch off does not recall what was already sent. What PostHog holds about you is deleted when your account is erased.
• After you ask us to delete your account, and for the 14 days until it is erased, our server holds back your account’s events instead of passing them to PostHog; no phone is signed in to the account then, so no phone sends any either. If you cancel the deletion by signing in again, the held-back events are sent then, if the “Share usage data” choice saved with your account is on. If the account is erased, the held-back events are erased with it and never sent. RevenueCat’s subscription events, described above, are not held back.
• The switch is a setting of the phone it is on, and it survives a sign-out. When you sign in to an account you already have, on any phone, the switch takes the choice saved with your account, so an “off” saved there stays off. If you change the switch on that phone before it has read your saved choice, your change wins. When you create an account, the switch keeps the setting it had on that phone.

Who else receives your data

A small number of companies help us run OnTask. Each works for us under a contract, may use your data only to provide its service to us, and must protect it at least as well as this policy says. We never sell personal data. There are no ads in OnTask. We never share it for advertising. We do not track you across other companies’ apps or websites.

• Supabase — our database, sign-in service and private file storage. United States.
• Render — hosts our server. United States.
• Cloudflare — the network edge in front of our server and the host of this website. It sees network addresses in order to deliver pages and requests.
• Resend — delivers our emails: sign-in codes, account notices, the extra-month email, and the email that tells us of a new website sign-up. United States.
• PostHog — receives usage data and crash reports while “Share usage data” is on and, once Premium is on sale, subscription events from RevenueCat, which the switch does not stop. United States. Set to discard IP addresses.
• RevenueCat — checks store receipts and tells us your subscription state. Receives the receipt data and your account’s pseudonymous identifier, the same pseudonymous account code PostHog’s usage events carry. Once Premium is on sale, it sends subscription events to PostHog under that code. United States.
• Apple and Google — your sign-in provider and the store you buy from; on Android, Google’s backup service may also keep the copy of your sign-in described under Security. Each is responsible for its own data under its own privacy policy.
• GitHub — holds a private issue per problem report with device facts and storage references only, nothing that names you or your account.
• Google — our support address, [email protected], is a Google Group on our Google Workspace account; Google holds the emails you send us and our replies under its data processing terms. Google also holds our own mailbox, where the emails about website sign-ups arrive. Google may store them outside the United States.

Beyond these, we disclose personal data only if the law requires it, or to protect someone’s safety or our legal rights, and then only what is required.

Can we see your record? Yes: the one person who runs OnTask can open an account to help you or to check for misuse. Nobody else can. Every look is recorded, and you can ask to see those records.

Where your data is stored

The app’s data and the website’s waiting list are stored in the United States: our server runs on Render in Virginia, and our database and file storage run on Supabase in Virginia. PostHog holds usage data in the United States too. Emails you send to support, and the emails about website sign-ups in our mailbox, are the exception: Google holds them and may store them outside the United States (see Emails to support). We are based in Serbia and reach that data from there.

If you live outside the United States, your data therefore leaves your country, and US law is not the same as your own. So we bind every company that holds your data by contract to the protections on this page, and the rights here are yours wherever you live.

Security

Everything between your phone and our server travels encrypted; your sign-in is kept in your phone’s secure store; and every look we take at your data is recorded.

• Every connection between the app, this website and our server uses HTTPS. No endpoint exists on plain HTTP.
• Your sign-in token is held in your phone’s secure keystore, never in a plain file. Neither it nor anything else of OnTask’s on your phone goes into the operating system’s backups or phone-to-phone transfers. Your sign-in on a phone has no expiry date of its own; it ends only when you sign out, sign in on another phone, delete your account, or Apple withdraws it.
• Your sign-in can still outlast the app. On Android, Google’s backup service may keep a separate copy of your OnTask sign-in, so that reinstalling OnTask, or setting up a new phone from the same Google account, opens it signed in. On iPhone, the sign-in may stay on the phone after you delete the app, so reinstalling OnTask there may open it signed in. The copy holds no history. A phone that opens this way fetches your history from our server and signs out any other phone signed in to your account. Signing out or deleting your account removes the copy, and a copy that is missed no longer works.
• The Sign in with Apple credential we need in order to revoke our access later is encrypted on the server under a key stored outside the database.
• Every operator read of your data is recorded, and you can ask to see those records.
• Your record on the phone is stored in a local database kept out of the operating system’s backups.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities the law requires, without undue delay.

Emails we send

We send service emails whenever the service needs them:

• sign-in codes;
• a notice when your sign-in email is changed;
• account and security notices;
• changes to the app or to these documents;
• subscription notices where we send them — the App Store or Google Play sends its own renewal reminders;
• a welcome message with how to reach support;
• if we give you an extra month of Premium for feedback you sent during early access, one email saying so and naming the new end date, sent from [email protected] if we hold an address that can receive it.

These are part of running your account and you cannot opt out of them while you have one. Our service emails contain nothing clickable — no links and no buttons.

We send marketing email — news about OnTask — only to people who have agreed to it. If you have not agreed, you get none. Every marketing email says how to stop it, and telling us at [email protected] stops it too. Service emails never carry marketing.

If you hid your email with Apple, our emails reach you through Apple’s relay. If you turn that forwarding off in your Apple account settings, our emails — including notices about your account — will not reach you.

Getting a copy of your data

Email [email protected], from the address on your account if you can. We first check that you hold the account. We answer within one month, free of charge. If a request is unusually complex, the law lets us take up to two more months; we tell you within the first month if we need them. The copy holds all the personal data our server keeps about your account:

• your full record as a machine-readable file (every event, one per line);
• the summary of your history that your phone made, unpacked so that you can read it, and the readable file of your weekly totals that came with it;
• our server’s own checkpoint of your record, if we hold one, unpacked so that you can read it, with one bookkeeping number of our server’s left out. If either of these is too large to unpack, or cannot be unpacked, we send it as we store it and say so. Both are worked out from your full record above;
• your account and sign-in details;
• your Premium and access-code history;
• your devices, sync details and sync results;
• your problem reports, with their files and voice messages;
• your feedback, with its voice messages;
• the operator access records that concern you.

It is made on our server and sent to you, and our copy is deleted as soon as it has been sent.

Deleting your account

You can delete your account in the app’s settings, under Account › Delete account, or by emailing [email protected] from your account’s own address and we will schedule it for you. If you ask us by email while a phone is still signed in, minutes that phone has not yet synced are lost; deleting from the app syncs first. If you deleted your Apple ID and can no longer sign in, email us; we will need to satisfy ourselves that the account is yours before we schedule its deletion.

• At once, your account becomes frozen: no phone is signed in to it and nothing syncs to or from it. It keeps its data, and our server holds back its usage events from PostHog (see Usage data, and the switch that stops it). If you signed in with Apple, we tell Apple at once that OnTask no longer needs your Sign in with Apple token.
• 14 days later, your account is erased for good. The 14 days are a safety net: sign in again during them and everything is back, as if nothing had happened.
• Destroyed at erasure:
  • your record and profile, the summary of your history with its weekly-totals file, and our server’s own checkpoint of your record;
  • your sign-in identities and your name;
  • your devices;
  • your problem reports, with their files and voice messages;
  • your feedback, with its voice messages, and any extra-month email we have not sent yet;
  • what PostHog holds about you;
  • your setup answer;
  • the flags and notes on your account;
  • your last-seen place;
  • your sync results;
  • the usage events our server held back during the 14 days, never sent.
• Released: your access code, and the store receipt’s link to your account.
• Kept, with nothing that names you: the de-identified payment record from the store (it accounts for money that moved), the de-identified operator access records, and the record of any extra month given for your access code. “De-identified” means with anything that names you removed.
• Backups can hold erased data for up to 7 more days.
• Emails to support are not part of your account; they are deleted on their own schedule (see Emails to support).
• A website waiting-list entry is not part of your account, even at the same address; it is deleted on its own schedule (see Website waiting-list email).
• After erasure, signing in again creates a new, empty account.

Deleting your account does not cancel a store subscription. Subscriptions are managed by the App Store or Google Play; cancel there first if you do not want to be charged again. The app says this before you confirm.

Signing out is not deletion: it removes your record from that phone and leaves your account as it is. Nor is deleting the app: your record stays on your account, and keeping it costs nothing.

Your other rights

• Correct your data. You can change your sign-in email in the app’s settings. Your record is yours to edit in the app. For anything else, email us.
• Object to marketing. Tell us, or use the stop instruction in any marketing email, and it stops.
• Stop usage data. Turn “Share usage data” off; your phone and our server stop sending it at once (RevenueCat’s subscription events are the one exception, described under Usage data, and the switch that stops it).
• Object to, or ask us to limit, other processing. Email us and say what you would like us to stop or limit. We answer within one month. If a request is unusually complex, the law lets us take up to two more months; we tell you within the first month if we need them.
• Complain. You may complain to the data-protection authority of the country where you live. Our home authority is Serbia’s Commissioner for Information of Public Importance and Personal Data Protection. We would rather hear from you first, at [email protected].

Exercising a right costs nothing and never changes how the app treats you.

If you live in the EU, the EEA or the UK

The GDPR, or the UK GDPR, protects you, and nothing in this policy takes away a right it gives you. The app’s data and the website’s waiting list are stored in the United States, and Google may store support email and our mailbox outside your country too; under those laws, both count as a transfer out of your country. Those laws require safeguards for that transfer. Ask us at [email protected] which safeguard applies to a given provider. You have the rights under Your other rights, including a machine-readable copy of your data, and you may complain to the data-protection authority where you live. In the UK that is the Information Commissioner’s Office.

If you live in the United States

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We sell no sensitive personal data either. The rights to see, correct and delete your data described on this page are open to you whichever state you live in.

Children

You must be 16 or older to use OnTask; by creating an account you confirm that you are. We do not ask your age, and we do not knowingly collect data from anyone under 16. If we learn that an account belongs to someone under 16, we delete it and its data promptly. If you are a parent and believe your child has an account, email us and we will delete it.

This website

We set no cookies of our own and run no analytics, trackers or third-party scripts on this site. Our host, Cloudflare, may set one short-lived security cookie to tell people from bots; it identifies nobody. The waiting-list form sends our server the address you type and nothing else about you (see Website waiting-list email). The site is hosted by Cloudflare Pages, which sees your network address in order to deliver the page. We keep no record of your visit ourselves, except that joining the waiting list is a request to our server, which its logs record (see Network address in server logs).

Changes to this policy

When we change this policy, we post the new version here with its effective date. If a change matters to you — a new kind of data, a new recipient, a new use — we also email you at least 30 days before it takes effect, as the Terms promise. Changes that only clarify the text or that are in your favour may take effect when posted.

This policy is written in English. If it is ever translated, the English version controls.

Contact

Bogdan Crncevic, an individual developer based in Serbia. For anything in this policy: [email protected]. Our Terms of Service are at on-task.co/terms.