Truetask — Privacy Policy

1. Introduction

This Privacy Policy describes how Truetask LLC ("the Company," "we," "us," or "our") collects, uses, stores, and protects information when you use our services: hosted Truetask cloud workspaces provisioned under truetask.app or another domain we assign ("Cloud Workspaces"), the Truetask desktop app for macOS and Windows ("Desktop App"), the website at truetask.io, the Client Portal at portal.truetask.dev, and the documentation site at docs.truetask.io (collectively, the "Services").

Truetask is available in two deployment models, and they have very different privacy properties. This Policy explains both.

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Key Principle — Two Deployment Models

2.1. Self-hosted: we collect zero data. When you deploy Truetask on your own infrastructure, we collect no data from your instance. The application makes no outbound calls to our servers; there is no telemetry, no usage analytics, no crash reporting, and no phone-home behavior of any kind. License verification runs entirely on your own server. All data in a self-hosted instance stays on your infrastructure, and you are the sole controller of it.

2.2. Cloud Workspaces: we host your data, and only to serve you. When you use a Cloud Workspace, we operate a dedicated, isolated instance for you and store your workspace data in the hosting region you select (currently the United States or the European Union). We host and process that data solely to provide the service. We do not sell it, do not use it for advertising, do not use it to train machine-learning models, and the application itself contains no third-party trackers.

3. Information We Collect

3.1. Cloud Workspaces

When you create and use a Cloud Workspace, we collect and store:

• Signup information: your name, email address, chosen workspace name and address (subdomain), and hosting region.
• Workspace content ("Customer Content"): the data you and your members put into the workspace, including tasks, projects, notes, files, comments, forms and form submissions, time entries, automations, and audit logs. We store this content in your selected region in order to run your workspace; it remains yours (see Section 5).
• Member account data: names, email addresses, and authentication data of users invited to the workspace. Sign-in is by a one-time code sent by email, by a password, or by single sign-on where the workspace has configured it. Passwords, where used, are stored in hashed form only.
• Technical and security logs: IP addresses, request metadata, and security events, used for operating, securing, and troubleshooting the platform.
• Push notification tokens: if you enable browser notifications, we store the subscription token needed to deliver them.
• Billing data: for paid plans, subscription and add-on records. Payment transactions are processed by Stripe; we do not store full card details (see Section 6).
• Integration data: when you connect a third-party service to your workspace (a Git provider such as GitHub, GitLab or Gitea, Slack, Microsoft Teams, Twilio, WhatsApp, n8n, a webhook receiver, or an AI provider of your own), the credentials you authorize are stored encrypted in your workspace, and the content those services exchange with your workspace (issues, pull requests, messages, phone numbers, and similar) enters your workspace as Customer Content according to the connections and automations you configure.
• Agent and AI activity: records of the AI agents you run against your workspace, including run steps, chat transcripts with agents (including transcripts relayed from the Desktop App), tool calls, questions, approvals, and audit entries. These are Customer Content.

3.2. Client Portal (portal.truetask.dev)

When you create an account on the Client Portal, we collect your name, email address, optionally your company name, hashed authentication data, the records of your workspaces and licenses, subscription status received from Stripe (plan, status, and dates), and IP addresses for security and fraud prevention. The Client Portal orchestrates workspaces, accounts, and backups; it never receives or stores payment card details, which are handled by Stripe only (see Section 6).

3.3. Marketing Site (truetask.io)

• The marketing site uses self-hosted, cookie-free analytics (Umami, running on our own infrastructure at umami.truetask.io). It collects aggregated, anonymized usage statistics such as page views, referrers, and approximate location derived from IP. It sets no cookies, stores no personal profiles, and shares nothing with third-party analytics or advertising companies.
• If you use the workspace signup form, we collect the information described in Section 3.1.

3.4. Documentation Site (docs.truetask.io)

This is a documentation site. We do not collect personal information through it.

3.5. Desktop App

The Desktop App runs on your own computer. It connects only to the Truetask workspace you sign into, whether a Cloud Workspace or a self-hosted instance, and it hosts AI coding tools that you install and sign in to yourself. Agent chat, permission requests, and run status that the Desktop App relays are stored in that workspace as Customer Content; for a self-hosted instance they never reach the Company. The Desktop App contains no telemetry, analytics, or crash reporting, and sends nothing to the Company on its own.

3.6. Self-Hosted Instances

We collect no data whatsoever from your self-hosted deployment. See Section 2.1.

4. How We Use Information

4.1. Providing the Services — operating your Cloud Workspace, hosting Customer Content, delivering notifications and transactional email (such as sign-in links and digests), and maintaining the Client Portal.

4.2. Account and subscription management — authentication, billing, license issuance, and plan enforcement.

4.3. AI features — when you invoke managed AI features, processing the relevant content to generate the requested output (see Section 6.3).

4.4. Product communications — service announcements, security notices, and release information relevant to your account. We do not send marketing email or newsletters.

4.5. Security — detecting and preventing unauthorized access, fraud, and abuse.

4.6. Legal compliance — complying with applicable laws, regulations, and legal process.

4.7. We do not sell or rent personal information, and we do not share it with third parties for their marketing purposes.

5. Customer Content: Ownership and Access

5.1. You own your Customer Content. We host and process it for Cloud Workspaces solely to provide, secure, and improve the operation of your workspace, and as instructed by you.

5.2. Our personnel do not access Customer Content except (a) with your permission for support purposes, (b) as necessary to maintain or secure the Services, or (c) where required by law.

5.3. A full export of your workspace (JSON for workspace data, Markdown for notes) is available at any time, on every plan, from within the application.

5.4. Free workspaces that go inactive are hibernated, not deleted. Hibernation does not alter Customer Content.

6. Third-Party Processors

We use a limited number of third-party providers to operate the Services:

6.1. Infrastructure providers — Cloud Workspaces run on servers provided by Hetzner in the United States or the European Union, corresponding to the region you select, and their files and backups are stored in region-matched object storage provided by Backblaze. These providers supply compute, network, and storage infrastructure; they do not access Customer Content for their own purposes.

6.2. Stripe — payment processing for subscriptions and licenses, in accordance with Stripe's privacy policy (https://stripe.com/privacy). We do not store full payment card details.

6.3. AI infrastructure providers — when you use managed AI features ("Truetask AI"), the relevant content of your request is transmitted through OpenRouter to the third-party AI model provider serving the selected model, acting on our behalf, solely to generate the response. Our OpenRouter account is configured to exclude providers that train on inputs, and we do not permit the use of your content for model training under our agreements with them. If you connect your own AI provider (bring-your-own-key or a self-hosted model), that traffic flows under your agreement with that provider, not ours. Self-hosted deployments make no AI calls through us at all.

6.4. Email delivery — transactional email (sign-in codes, invitations, notifications, digests) is delivered through Mailgun, which processes recipient addresses and message content for delivery purposes only.

6.5. Cloudflare — DNS, CDN, and network ingress for the marketing site, the Client Portal, and Cloud Workspace addresses under truetask.app. Traffic to a Cloud Workspace passes through Cloudflare's network in encrypted form, so Cloudflare may process technical data such as IP addresses in accordance with its privacy policy (https://www.cloudflare.com/privacypolicy/). Cloudflare does not store Customer Content.

6.6. We do not use third-party advertising or tracking services anywhere in the Services.

7. Cookies

7.1. Marketing site (truetask.io): no cookies. Analytics are cookie-free (see Section 3.3).

7.2. Cloud Workspaces and Client Portal: essential cookies and tokens are used solely for authentication and session management. These are required for the Services to function and do not require consent under applicable privacy regulations (including the GDPR).

7.3. We do not use cookies for advertising, tracking, or cross-site purposes on any of our Services.

8. Data Storage and Security

8.1. Cloud Workspace content, including its files and its backups, is stored in the hosting region you select at workspace creation (currently the United States or the European Union) and stays there. Each workspace runs as an isolated instance with its own database, file storage, and backup storage. Limited account, billing, and operational metadata is processed in the United States.

8.2. Client Portal data (account, workspace, license, and subscription records) is stored on a Hetzner server in the United States. Payment card details are held by Stripe only.

8.3. We implement appropriate technical and organizational measures to protect information, including encryption in transit (TLS/HTTPS), encryption of sensitive settings at rest, hashed password storage, per-workspace isolation, access controls, and tamper-evident audit logging.

8.4. No method of transmission or storage is completely secure; we cannot guarantee absolute security. Suspected vulnerabilities can be reported to [email protected].

9. Data Retention and Deletion

9.1. We retain account data and Customer Content for as long as your account or workspace is active.

9.2. When a Cloud Workspace is terminated or you request its deletion, Customer Content remains exportable for at least thirty (30) days (except where the law requires otherwise), after which it is scheduled for deletion from production systems, with residual copies removed from backups in the ordinary course of backup rotation.

9.3. If you request deletion of your account, we will delete associated personal data within thirty (30) days, subject to legal obligations requiring retention of certain records.

9.4. Transaction records and license purchase history may be retained for accounting and legal compliance even after deletion, in anonymized or aggregated form where possible.

10. Your Rights

You have the following rights regarding your personal information:

10.1. Right of Access

You may request a copy of the personal data we hold about you by contacting [email protected].

10.2. Right to Rectification

You may update your information in the application or Client Portal at any time, or contact us to correct inaccurate data.

10.3. Right to Erasure

You may request deletion of your account, workspace, and associated personal data. We will process the request within thirty (30) days, subject to Section 9.

10.4. Right to Data Portability

Workspace exports are self-serve (Section 5.3). You may additionally request an export of your Client Portal data in a machine-readable format.

10.5. Right to Object

You may object to certain processing of your data. Where we process data based on legitimate interests, we will cease processing upon your objection unless we have compelling legitimate grounds.

10.6. Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected].

11. GDPR Roles

11.1. For account, billing, and marketing-site data, the Company acts as the data controller.

11.2. For Customer Content in Cloud Workspaces, you (the workspace owner or your organization) are the data controller, and the Company acts as a data processor, processing Customer Content on your documented instructions as described in this Policy and the Terms of Service. Contact us at [email protected] regarding data processing agreements.

11.3. For self-hosted instances, you are the sole controller and we are not a processor: we do not process, access, or store any data from your deployment, and you are responsible for your own compliance with respect to it. The same applies to the Desktop App when it is connected to a self-hosted instance.

11.4. Our legal bases for processing include performance of a contract (providing the Services), legitimate interests (security, fraud prevention, service communications), and compliance with legal obligations.

12. International Data Transfers

12.1. Cloud Workspace content stays in the region you select (Section 8.1). Account, billing, and operational metadata may be transferred to and processed in the United States.

12.2. Where personal data of individuals in the European Economic Area is transferred internationally, we rely on appropriate safeguards, including standard contractual clauses where applicable.

13. Children's Privacy

13.1. The Services are intended for business use and are not directed at individuals under the age of eighteen (18).

13.2. We do not knowingly collect personal information from anyone under eighteen (18). If we become aware that we have, we will take steps to delete such data promptly.

14. California Privacy Rights (CCPA)

14.1. If you are a California resident, you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share personal information.

14.2. You have the right to request deletion of your personal information, subject to certain exceptions.

14.3. We do not sell personal information, and we do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA.

14.4. To exercise your rights under the CCPA, contact us at [email protected].

15. Changes to This Privacy Policy

15.1. We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Services at least thirty (30) days before the changes take effect.

15.2. The "Last Updated" date at the top of this policy indicates when the most recent changes were made.

15.3. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Miami, Florida, USA

Email: [email protected]

Security reports: [email protected]

Website: https://truetask.io