Privacy Policy

1. Scope

This policy applies to task-daily.com, the TaskDaily web app, its API and the TaskDaily Discord bot (together, the "Service").

Within a workspace, the person who created it (the owner) and its admins decide who is invited, who can see what and which integrations are turned on. For content inside the workspace, they decide the purpose the data is used for; TaskDaily runs the infrastructure and processes the data according to the configuration they choose. If you are a member and have questions about how your organisation uses data, ask your workspace admin first.

2. Data we collect

Account

• Email address, display name, email verification status.
• Password: only a hash is stored (PBKDF2-SHA-256), never the password itself.
• When you sign in with Google or Discord: your account identifier at that provider, your email (only when the provider confirms it is verified) and your display name. We do not read contacts, calendars or any other data in those accounts.

Profile and preferences

• What you fill in yourself: avatar, job title, bio, skills, location, time zone, status, working hours. Location and time zone are shown to others only when you turn on their visibility.
• Appearance and notification preferences: language, light/dark theme, quiet hours, muting notifications…

Sign-in security

• Sessions: IP address, browser string (user agent), creation time and last activity.
• Security history: sign-ins and changes to credentials, with IP and browser.
• Two-factor authentication: the TOTP secret and hashes of backup codes; passkey public keys; recovery email (stored only after that address confirms it).

Content you and your colleagues create

• Tasks, projects, milestones, tags, comments, documents, version history, time logs.
• Chat messages (channels, direct messages), reactions, pinned messages.
• Leave and overtime requests, with reasons, discussion and attachments.
• Daily check-ins: what you are working on, blockers, mood, hours.
• Internal notes about members written by people with management rights. The member a note is about cannot see it.
• Uploaded files (up to 25 MB each).

Technical data

• The workspace activity log (who changed what, and when) and in-app notifications.
• Server logs and per-IP/per-account rate-limit counters, used to prevent abuse.

3. How we use it

• Providing the Service: storing and displaying content, syncing it in real time across devices, sending notifications according to the workspace's configuration.
• Protecting accounts: authenticating sign-ins, alerting you when a new device signs in, letting you review and revoke sessions, preventing password guessing and spam.
• Transactional email: email verification, password reset, workspace invitations, security alerts. We do not send marketing email.
• Operations: finding and fixing bugs, measuring performance, keeping the system secure.
• Legal obligations: when required by law or by a competent authority.

4. Who can see your data

• Members of the same workspace see your name, avatar, public profile fields, task figures and the content of the projects and chat channels they are allowed to access.
• Private projects and channels are visible only to their members and to people with project management rights.
• Personal tasks (not in any project) are visible only to their creator and assignees.
• Leave requests are visible to the requester and to people with approval rights. The absence calendar (who is off on which day) is visible to the whole workspace.
• Check-ins are readable by default only by their author and the workspace admins; a workspace can open them to every member.
• Workspace owners and admins can manage members, view the workspace change log, export workspace data and configure integrations.

Integrations a workspace turns on

• Discord: when a workspace connects the bot, notifications about tasks, deadlines, leave requests and new members are posted to the Discord channels an admin chooses; everyone in those channels can read them. Personal tasks, comments in leave threads and private projects without their own channel are never posted to a shared channel. Check-in reminders are sent as a Discord direct message to each person who has linked their account.
• Webhooks: admins can send events (for example, a task was created or a leave request was approved) to an address they configure. Data sent there is then handled by the receiving party.
• Calendar: you can create a private calendar link (.ics). Anyone with that link can read your task deadlines and days off, so treat it like a password. You can change or revoke the link at any time.
• Link previews: when you send a link in chat, our server fetches that page to get its title and preview image, and caches the result for up to 24 hours.

5. Third-party processors

We use a few providers to run the Service. They process data only to provide their service to us.

Some providers store or process data outside Vietnam. We transfer data abroad only as far as needed to provide the Service, and complete the procedures Vietnamese law requires.

Beyond the cases above, we disclose data only on a lawful request from a competent state authority, or when needed to protect the safety of users and the Service.

6. Cookies and browser storage

• Session cookie (HttpOnly, sent only over HTTPS, expires after 7 days): keeps you signed in.
• OAuth state cookie (expires after 10 minutes): prevents forgery when you sign in with Google/Discord.
• Browser storage (localStorage): appearance preferences, the open workspace, unsent drafts. This data stays on your device.

We do not use advertising cookies or third-party tracking cookies.

7. Retention and deletion

• Account: kept until you delete your account.
• Sessions: expire after 7 days; each account keeps at most 10 active sessions.
• Security history: the latest 200 events per account are kept.
• Activity log and notifications: kept indefinitely by default; workspace admins can set an automatic deletion period (30 days to 10 years).
• When a project is deleted: its tasks, comments, documents and attachments are deleted, including the files in storage.
• When a workspace is deleted: all of its content is deleted: projects, tasks, documents, messages, leave requests, check-ins, logs and uploaded files.
• When an account is deleted: the profile, sessions, credentials, comments, messages, leave requests, check-ins and any workspaces you own alone are deleted. Tasks, projects and documents you created in someone else's workspace are transferred to that workspace's owner, so your colleagues do not lose shared work. If you own a workspace that still has other members, transfer ownership first.
• Backups kept by our infrastructure providers may persist for a short time before being overwritten.

8. Security

Every connection uses HTTPS. Passwords are hashed, and the session cookie cannot be read by JavaScript. Sensitive changes (changing your email, turning two-factor authentication on or off, adding a passkey, deleting your account) require you to re-authenticate. We support two-factor authentication, backup codes and passkeys, and a workspace can require every member to turn on two-factor authentication.

Uploaded files are reached through hard-to-guess links; anyone with the link can open the file, so do not share links to sensitive files outside your team.

No system is perfectly secure. If an incident affects personal data, we will notify affected users and the competent authorities as the law requires.

9. Your rights

Under Vietnamese personal data protection law, you have the right to:

• Access and receive a copy: Account → Privacy → Export data (a JSON file).
• Correct: edit your profile, name and email under Account.
• Delete: Account → Privacy → Delete account.
• Withdraw consent: turn off notifications, unlink Google/Discord, revoke your calendar link, leave a workspace.
• Object to or restrict processing, and complain: contact us at the address at the bottom of this page.

For content in an organisation's workspace, some requests have to be handled by the workspace owner; we will help pass your request on to them.

10. Children

The Service is for people aged 16 and over and is not aimed at children. If you know that a child has given us data without the consent of a parent or guardian, contact us so we can delete it.

11. Changes to this policy

When this policy changes, we update the date at the top of the page. For important changes, we will notify you in the app or by email before the change takes effect.

12. Contact

Send any privacy question or request to support@task-daily.com. We reply within 30 days. For quick help, ask in our Discord server.