Privacy Policy

TL;DR

Taskelo requires a free account. Your workspace — todos, canvas notes, goals, weekly-routine text, chat history, any files you upload, and the notes Elo keeps about you — is stored in our cloud (a Cloudflare D1 database, plus R2 object storage for file contents) tied to that account so you can use it on any device; your browser keeps a local copy of the synced data as an offline cache. You can export everything as JSON and delete your account — and all its data — in one click. If you connect Google Calendar, Taskelo reads your events to show your schedule, to give Elo context when it plans or answers for you, and to write the brief, review and check-in messages you turn on. We don't keep copies of your events on our servers. If you turn on the daily brief or the weekly review email (hosted plan only), we store your delivery preferences and, for push, a per-device subscription, and deliver through Resend (email) and/or push. Payments, sign-in, and a daily usage counter for hosted chat are handled by the usual processors (Stripe, Clerk, Anthropic). Everything is encrypted in transit and at rest; see "How we protect your data" for the safeguards, especially around your Google data.

Where your data lives

In our cloud database. Your todos, canvas notes, goals (titles, notes, milestones), weekly-routine description, chat messages, the memories Elo saves about you (see "Elo's memory and activity" below), and a log of the actions Elo takes are persisted to our cloud database (Cloudflare D1), keyed to your account, so they follow you across browsers and devices. The browser keeps a local copy as an offline-first cache so the app works without a network. Signing out clears that local copy from the browser you sign out of; the cloud copy stays until you use "Delete account".

In our cloud file storage. Files you upload — through the Files tab or by attaching them in chat — are stored as-is in Cloudflare R2, with a metadata row (name, type, size) in the database. See "Your files" below for quota, visibility, and deletion.

On your device only. Device preferences — chat panel collapsed state, panel width, active workspace tab, active schedule view, goals list expanded state — stay in your browser's localStorage and are never uploaded. One exception: your onboarding/setup progress is kept in localStorage but also mirrored to your Clerk user profile, so first-run setup doesn't restart on every new device. Clearing your browser data resets the local preferences (and drops the offline cache; the cloud copy is untouched).

Google Calendar events are an exception: they are never written to our cloud database. Our server reads them from Google, holding them in memory for the length of one request: to hand them to your schedule view, which caches them in your browser's localStorage so it can render, and when Elo needs them. See "Google Calendar (schedule tab)" below for exactly when. Cloud-side we keep only your calendar settings in Taskelo, the ID of the "Taskelo" calendar we created for you, and when your calendar last synced.

What we do collect (and why)

• Your email address, handled by Clerk. Used so we can email you a one-time code to sign in. We don't store passwords; we don't ask for one.
• Your synced app data — todos and the named lists you sort them into, canvas notes, goals (titles, notes, milestone checklists), your free-form weekly-routine text, hosted-mode chat messages, and a couple of app settings (such as the active canvas tab). These are stored in Cloudflare D1 in our account, keyed to your Clerk user id, and used only to render the app for you on your devices and to provide context to Claude when you choose to chat.
• Files you upload — the file contents live in Cloudflare R2 in our account; the database keeps a metadata row per file (name, content type, size, optional goal link, whether it came from the Files tab or a chat attachment, and its visibility setting). Each account gets 1 GiB of storage. Files are private by default; see "Your files" below.
• Elo's memory, if you use Elo — short facts Elo saves about you during conversations (at most 50 entries of up to 300 characters each), stored in our database and shown in full on the Assistant tab under "What Elo knows", where you can edit or remove any of them. See "Elo's memory and activity" below for exactly how removal works.
• A log of Elo's actions — every change Elo makes to your workspace (which tool ran, whether it succeeded, and a small summary of the outcome) is recorded and shown to you in the Activity tab. We also use this log to rate-limit Elo's actions. It records what Elo did — not your chat messages.
• Reminders, if you or Elo set them: what the reminder says, when it's due, your time zone, how it repeats (if it does) and the task it's about (if any). They're kept in our database so a scheduled job can send them on time, by email and also by push if you've turned push on. Each one that goes out is noted in your chat and in Elo's action log.
• Elo's check-in questions, if you turn check-ins on: the short question Elo asks you in the evening (it also lands in your chat and under "From Elo" on the Assistant tab), and whether and how you answered it. Turning on privacy mode deletes all of them.
• Web searches, when Elo looks something up: the search query Elo writes is sent to Anthropic, which runs the search and returns the results to Elo. Elo is told to keep details about you out of its queries. Each search is listed in Elo's action log, and a count of today's searches is kept next to the daily token counter so we can cap them.
• Weather, if you add it to your brief: the place name you type and your preferred units, kept with your brief settings. To get the forecast, our server sends that place name, and then its coordinates, to Open-Meteo, a free weather service. Nothing that identifies you goes with it. When you ask Elo about the weather somewhere, it looks that place up the same way.
• Images in your notes: images you paste or drop into a note are stored in Cloudflare R2, with a row in our database recording which account they belong to. So that your notes can show them, each image is served from a long, random link that doesn't require signing in: anyone who has that exact link can open the image. Images you remove from your notes are cleared by a weekly cleanup, and all of them are deleted with your account.
• Feedback and bug reports you send us: your message, whether it's feedback or a bug, the page you sent it from and your browser's user agent, stored with your account id. A copy is emailed to us (through Resend) with your email address, so we can reply.
• Google Calendar connection state, if you connect it — when your calendar last synced, the ID of the "Taskelo" calendar we created for you, and your calendar settings in Taskelo (whether planned blocks publish automatically, whether Elo may add events, and your category names and colours). Clerk holds your Google OAuth token on our behalf; we exchange it for a short-lived access token each time we call Google's Calendar API. Your actual events are not stored in our database. See "Google Calendar (schedule tab)" below for exactly when we read them and where they go.
• Daily brief and weekly review preferences, if you turn them on — whether each is enabled, your chosen delivery time and timezone (for the weekly review, also the day of the week), which channels (email and/or push — the weekly review is email-only), and any free-text instructions you add. Stored in user_settings, keyed to your account, so a background job can send them without your browser needing to be open. We also keep the text of your most recent daily brief so the app can show it on the schedule tab — each new brief overwrites the last — plus the date each was last sent, so we don't send twice.
• Your time zone — the one Taskelo runs in (your device's, or one you choose under Settings → Time zone), stored on your account so the brief, check-ins, and repeating reminders arrive at the right local time. When you open the app it also asks our server which time zone your network connection is in, which Cloudflare works out from your IP address, so it can offer to switch when you travel. That network time zone is only compared and shown to you; we don't store it.
• Your country, each time you use Elo: Cloudflare works out which country your connection comes from, and we check it because Anthropic, whose models power Elo, doesn't serve every region. Where it doesn't, Elo is unavailable and the rest of Taskelo works as usual. The country is checked and discarded, never stored.
• Push subscription data, if you enable push delivery — one row per device (endpoint URL plus the client public key and auth secret your browser generates for that subscription), used only to deliver the daily brief and other notifications you've opted into. Deleted when you disable push on that device or delete your account.
• A Stripe customer id and subscription status, if you subscribe to hosted mode. Payment-card data goes directly to Stripe; we never see card numbers, CVCs, or billing addresses. We keep the Stripe ids so we know whether your subscription is active.
• A daily token counter attached to your account in Clerk's private metadata, of the form { date, tokens }. This is how we enforce the daily cap on hosted chat. It is a number and a date — nothing about what you asked or what Claude answered.
• Basic web analytics via Google Analytics (page views, session counts, referrer, approximate location from IP, browser/OS). This helps us see whether anyone uses the site. See Google's privacy policy. Turning on privacy mode in the app (Settings → Privacy) switches analytics off on that device; a browser or extension that blocks GA works too.
• Error reports and server logs, so we can find and fix problems. When something breaks in the app or on our server, we record the error along with your account id, your browser and device details, and the country and network provider you connect from. They never include the content of your messages, notes, tasks, or files, and we keep them only as long as we need to fix the problem.

Hosted chat: what happens to your messages

When you send a message in hosted mode, your browser posts it to our Cloudflare worker, which checks that you're signed in and entitled, increments the daily token counter, and forwards the request to Anthropic. The worker streams Claude's response back to your browser. The worker itself never logs the content of your messages. It records the token count, and an error report if something fails.

However, because chat history is part of cloud sync, your messages and Claude's replies are persisted to your row in Cloudflare D1 so the conversation reappears on your other devices and after you reload the page. They are scoped to your account and deleted (along with everything else in your row) when you delete the account.

Anthropic processes these messages as our service provider, under its commercial terms: inputs and outputs sent through the API are not used to train Anthropic's models, and are retained only briefly (generally up to 30 days) for trust-and-safety purposes before deletion. The same applies to anything included in the system prompt — your todos, notes, goals, saved Elo memories, and any calendar events — and to the contents of any file Elo reads for you during a conversation. See Anthropic's privacy policy.

Your files

The Files tab is a small personal drive. Anything you upload — directly, or by attaching a file in chat — is stored in Cloudflare R2 in our account, keyed to your user id, up to 1 GiB per account. We don't scan, index, or open your files for any purpose of our own; they exist to be served back to you (and to Elo, below).

Files are private by default. Downloading a file requires your signed-in session. You can flip an individual file to "anyone with the link", which makes its unguessable URL work without signing in — useful for sharing, but it means anyone who has that link can fetch the file until you flip it back or delete it. There is no public listing; only the direct link works.

Elo and your files. During a conversation, Elo can list your files and read the contents of files you ask it to work with — contents it reads are sent to Anthropic as part of that conversation, like the rest of your chat context. Elo can also create new text files in your drive and append to files it created; it cannot delete files or change a file's visibility. Every file Elo creates or extends is recorded in the Activity tab.

Deleting a file removes both the stored contents and its metadata row immediately — there's no trash or retention window, so it's gone. Deleting your account purges every file in your drive the same way.

Elo's memory and activity

Long-term memory. Elo can save short, durable facts about you that come up in conversation — a standing preference, a constraint, an ongoing project — so it doesn't start from zero every time. These memories are stored in our database (at most 50, each up to 300 characters) and are included in the context sent to Anthropic whenever Elo works for you: chat, day planning, the daily brief, and the weekly review. This is workspace data like your todos and notes — it is never used for advertising, profiling beyond the app's own features, or model training.

The entire memory store is visible under Settings → "What Elo knows", and Elo mentions it when it saves something. You can edit or remove any memory there, and Elo can retire its own outdated ones. Removing or replacing a memory erases its text at once, so Elo can never see it again. An empty marker stays in our database until you delete your account, when every memory row is erased outright.

What Elo can change. Beyond answering, Elo can act on your workspace during a conversation: add or complete todos, create and edit notes, create goals, add schedule blocks, create or extend files in your drive, save or retire its memories, and — only if you've enabled the setting — publish planned time blocks to the "Taskelo" Google Calendar it created, add events to that calendar, and change or remove the events it added there (it asks you to confirm before removing one). It cannot delete your files, notes, goals, or account data, and it cannot touch events on your other calendars. Every one of these actions is logged and shown in the Activity tab, and rate limits cap how many actions Elo can take per hour.

Follow-ups. Elo may notice that a task it added for you hasn't moved and ask about it once. To make "once" true, we store a small record when you dismiss such a follow-up (the task id and when you dismissed it), so the same question is never asked again.

Google Calendar (schedule tab)

Connecting Google Calendar is optional and goes through Google's standard OAuth consent screen, brokered by Clerk. Taskelo requests two scopes: calendar.events.readonly, the narrowest scope that lets us list events, and calendar.app.created, which allows an app to create secondary calendars and manage events only on calendars it created itself. Taskelo uses the second to make a calendar called "Taskelo" and publish your planned time blocks there. It cannot create, modify, or delete events on your own calendars — Google enforces that, not just our code — and we do not receive your calendar list, calendar metadata, or account settings. Google's consent screen lets you grant one scope and decline the other. The same screen also asks to share your Google account's basic profile (email address, name, and profile picture). That goes to Clerk, which uses it to link the Google account to your Taskelo account and to show which Google account is connected in your account settings; Taskelo doesn't store it in our database or use it for anything else. Deleting your Taskelo account also deletes that calendar from your Google account, as long as the connection still works at that point.

What we read. Taskelo reads events from your primary calendar, and from the "Taskelo" calendar it created, using a short-lived access token we obtain from Clerk for each request. For each event that means its title, description, time, and location, the details needed to show it and plan around it. We read them at these moments, and no others:

• While you have Taskelo open. The schedule view refreshes your events on its own: about every five minutes while the tab is visible, when you come back to the tab, right after Taskelo publishes to your calendar, and whenever you press Sync. Each refresh covers roughly one week back through ten weeks ahead, and the events are cached in your browser's localStorage so the schedule renders without another round-trip.
• When Elo works for you. When you send a chat message, ask Elo to plan your day, or Elo writes the summary on your overview page, our server reads your events for the next 14 days and includes them in the prompt sent to Anthropic, alongside your todos, notes, and goals. If you ask about a different period, Elo can look up that date range the same way. These reads go to Google directly and don't depend on your browser's cache.
• For scheduled messages you turn on. If you've turned on the daily brief, the weekly review, or check-ins, a scheduled job reads the days each one covers when it is time to write it, without your browser open: the next day or two for the brief and the evening check-in, the coming week for the weekly review and the Sunday check-in. These reads stop when you turn the feature off or disconnect Google.
• When Taskelo writes to the "Taskelo" calendar. Publishing your day plan, or Elo adding or changing an event, first reads that calendar's events for the day so Taskelo updates what it wrote before instead of duplicating it.

What we keep. In every case the events exist only in memory for the length of that one request. We don't store them in our database; cloud-side we keep only the calendar settings, calendar ID, and last-synced time listed under "What we do collect". One thing worth stating plainly: when Elo uses your calendar to write something for you, such as a chat reply, a check-in question, a day plan, or your daily brief, that text can mention an event by name or time. It is stored like the rest of your chat history and workspace (see "Data retention" below), not as a copy of your calendar.

Who receives it. Events read for Elo are sent to Anthropic, which processes them as our service provider to produce Elo's response and does not use them to train its models (see "Hosted chat" above). A brief, review, or check-in written from your calendar is delivered by email through Resend and/or as a push notification; push payloads are encrypted to your device's own key, so the push service that relays them cannot read the contents. Everything travels through Cloudflare, which hosts our app and server. We don't share your calendar data with anyone else.

Taskelo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features described above, which you can see and control in the app.
• We transfer it only to the service providers named above, and only as needed to provide those features, for security purposes, or to comply with the law.
• We do not use or transfer it for advertising of any kind, including personalized, retargeted, or interest-based ads. We do not sell it or provide it to data brokers or information resellers, we do not use it to build databases for any other purpose, and we do not use it to determine creditworthiness or for lending.
• No person at Taskelo reads it unless you ask us to (for example, to look into a problem you've reported), it is needed for security purposes such as investigating abuse, or the law requires it.
• We do not use it to develop, improve, or train generalised AI or machine-learning models, and neither does Anthropic. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models. When Elo reads your calendar, your events are used only to produce the response you asked for; they are never combined with other users' data and are not stored in any model.

Turning it off. You can disconnect at any time from the schedule tab's ⚙ menu, which removes the Google credential Clerk holds for us and clears the events cached in that browser. You can also remove Taskelo's access from your Google account's third-party connections page. Signing out also clears the cached events from that browser; on another browser where you're still signed in, sign out there or clear its site data. Deleting your Taskelo account removes the credential and the "Taskelo" calendar along with everything else. To ask us to delete anything sooner, email hello@taskelo.com.

How we protect your data

We treat everything in your workspace as sensitive, and the Google Calendar data you let us read most of all. These are the safeguards in place:

• Encrypted in transit. Every connection uses HTTPS (TLS): your browser to the Taskelo app and to our server at api.taskelo.com, and our server to Google, Clerk, Anthropic, Resend, and Stripe. Our site also tells browsers never to connect to it over plain, unencrypted HTTP (HSTS).
• Encrypted at rest. Your synced workspace is stored in Cloudflare D1 and your uploaded files in Cloudflare R2. Both encrypt all stored data and metadata with AES-256, using keys Cloudflare manages in its key management systems.
• Your Google credential never enters our database. The Google OAuth credential you grant is held by Clerk, our authentication provider, which is audited to SOC 2 Type II. Each time our server needs your calendar, it asks Clerk for a short-lived access token, uses it for that one request, and keeps it only in memory. We don't write Google tokens to our database, logs, or your browser.
• Your calendar events aren't stored on our servers. When our server reads your events, they exist only in memory for that single request. The only stored copy is the cache in your own browser, kept under your account and cleared when you sign out or disconnect Google Calendar.
• Narrowest Google access. We request read-only access to your events, plus access to the one calendar Taskelo creates. Google itself prevents Taskelo from changing or deleting events on your own calendars.
• Every request is authenticated and kept to your account. Our server rejects any request without a valid, signed session token from Clerk, checks that the token was issued to taskelo.com, and limits every database read and write to the account that is signed in, so one account can never reach another's data. Files are private by default and need your signed-in session to download.
• Secrets kept out of our code. The keys our server uses to talk to Clerk, Anthropic, Stripe, and our other providers are stored as encrypted secrets in Cloudflare, not in our source code.
• Limited human access. Only the people who run Taskelo can reach our production systems, and they don't read your data except in the cases listed under "Google Calendar" above: you ask us to, security requires it, or the law does.
• Payments and notifications. Card details go straight to Stripe and never reach our servers. Push notifications are encrypted to your device's own key, so the service that relays them can't read them.
• Deletion. Deleting your account erases your data from our database and file storage and removes the Google credential, as described under "Your rights" and "Data retention" below.

If we ever learn of a breach that affects your personal data, we will notify you, and the relevant authorities where required, as the law requires. To report a security concern, email hello@taskelo.com.

Daily brief and weekly review (hosted only)

The daily brief is a short, Claude-written summary of your day — top priorities, calendar conflicts, and a nudge on one goal — available only on the hosted plan (generating it costs model tokens, so it shares the same entitlement gate as hosted chat). It's built from the same context sent to chat: your todos, canvas notes, goals, weekly routine, and — if you've connected Google Calendar — your events for today and tomorrow, which the job reads from Google at generation time rather than from any stored copy.

You choose how it's delivered: by email (sent through Resend), by push notification (sent to any device where you've enabled push), or both. Delivery preferences — enabled, time, timezone, channels, and any custom instructions — are stored on your account row so a background job (running every 15 minutes) can check whether it's your delivery time and send it, without your browser needing to be open. We keep the text of your most recent brief so the app can show it on the schedule tab; each new brief overwrites the previous one, and we also record the date we last sent one so we don't send twice in a day. Push delivery requires storing one row per device (endpoint plus the browser-generated keys for that subscription). You can change your delivery time, switch channels, or turn the brief off entirely from inside the app at any time; doing so updates or removes these rows immediately.

The weekly review is the brief's end-of-week sibling: an opt-in, email-only look back at your week — what got done, which goals moved, what Elo handled — with a suggested focus for the next one, delivered on a weekday and time you choose. It's generated the same way as the brief, from your workspace plus a summary of the last seven days (completed todos, goal movement, and the Activity-tab log of what Elo did), and any custom instructions you've added. Unlike the brief, its text is not stored — it's generated, emailed through Resend, and discarded; the only record is the date we last sent one. Like the brief, it's a hosted-plan feature and stops the moment you turn it off.

Who we share data with

We share only what each service needs to do its job, and only with these processors:

• Clerk — authentication, your email, and (if you connect Google Calendar) the brokered Google OAuth credential.
• Stripe — payments, your card and billing details (which we never touch).
• Anthropic — your hosted chat messages, at the moment you send them. The system prompt that goes alongside includes your todos, canvas, goals, weekly routine, saved Elo memories, and any synced calendar events — plus the contents of any file Elo reads during that conversation. The same context is used to generate your daily brief and weekly review, if enabled. When Elo searches the web for you, the query it writes goes to Anthropic too, which runs the search.
• Google — only if you connect Google Calendar. Our worker calls Google's Calendar API with your authorised token to read your events and to write to the "Taskelo" calendar, at the moments listed under "Google Calendar (schedule tab)" above. Governed by Google's privacy policy.
• Open-Meteo, a free weather service: receives a place name, or its coordinates, when your brief includes the weather or you ask Elo about the weather somewhere. Nothing that identifies you is sent.
• Resend — delivers error reports and the feedback you send to us, and emails you your reminders and, if you enable email delivery, the daily brief and the weekly review (or a transactional email, like a sign-in code fallback). Resend processes the message content and your email address to deliver it — and because the brief and review are written from your workspace, that content can reference your tasks, goals, or calendar events. Governed by Resend's privacy policy.
• Cloudflare — hosts our web app, our worker, the D1 database that holds your synced workspace data, and the R2 storage that holds your uploaded files and note images. Can see request metadata (IP, user agent, timestamps).
• Google Analytics — basic site analytics.

We don't sell your data, ever, and we don't share it with anyone else except when we're legally required to (e.g. a valid subpoena) or to defend Taskelo from abuse.

Cookies and tracking

We use cookies and similar storage only for: keeping you signed in (Clerk), remembering your preferences (localStorage), and Google Analytics. We don't use cookies to build advertising profiles.

Your rights

You can download a copy of your data at any time from Account → Your data → "Export my data": one JSON file with your todos, lists, canvas notes, goals, day plans, chat history, check-in answers, settings, Elo memories, Elo's activity log, reminders, the feedback you've sent, and the error reports from your sessions. Files you uploaded are listed by name and size; their contents download from the Files tab. Things you deleted are left out, though Elo's activity log can still name ones Elo worked on. You may be asked to confirm it's you before the file is made.

You can delete your account from inside the app — this removes your Clerk profile, wipes your cloud-synced todos / canvas notes / goals / weekly routine / chat history / uploaded files (both contents and metadata) / Elo memories (including retired ones) / Elo's activity log / settings / calendar settings / brief and review preferences / push subscriptions from our database and storage, cancels any active Stripe subscription, deletes the "Taskelo" calendar from your Google account, (via Clerk) drops the stored Google OAuth credential, and clears the local copy in the browser you delete from. You can wipe the local copy on any other device, including any cached calendar events, by signing out there or clearing that browser's site data for taskelo.com.

If you're in the EU, UK, or California, you have additional rights under GDPR/UK GDPR/CCPA — including access, correction, deletion, and the right to complain to your local supervisory authority. Email hello@taskelo.com and we'll honor those requests, usually within 30 days.

Data retention

We keep your Clerk account (email, Stripe customer id, daily token counter) and your synced data (todos, canvas notes, goals, weekly routine, chat history, uploaded files, Elo memories, Elo's activity log, app settings, calendar settings, the most recent daily brief's text, brief and review preferences, and any push subscriptions) for as long as your account exists. Deleting is the exception: a file you delete is erased immediately, contents and metadata both, and a task, note, goal, list, day plan, chat message or memory you delete loses everything it said at once, leaving only an empty marker so your other devices know it's gone. Privacy mode (Settings → Privacy) is the other exception: while it is on, Elo saves no memories or conversation summaries and the daily brief's text is not stored, and turning it on retires any memories and summaries already kept. When you delete your account, all of the above is removed — your Clerk profile is deleted, the corresponding rows in our database cascade away with it in the same operation (including any push subscription rows), and your files are purged from R2. Error reports and server logs are kept only as long as we need them to find and fix the problem. Google Calendar events are not retained on our servers — server-side reads are held in memory for a single request and discarded. The only copy is the one your browser caches, which lasts until you disconnect, sign out, or clear site data. Text Elo writes for you that mentions an event (a chat reply, a check-in, your latest brief) is kept like the rest of your chat history and workspace, as described above. Stripe retains transaction records as long as it's legally required to (typically 7 years for tax/accounting purposes), which we can't override. Google Analytics aggregates data according to its own retention settings.

International transfers

Taskelo runs on Cloudflare's global edge network. Your data may be processed in any country where our processors operate (e.g. the United States for Clerk, Stripe, Anthropic, Google, and Google Analytics). By using Taskelo, you consent to those transfers.

Children

Taskelo is not directed to children under 13. If we learn we have collected data from a child under 13 without verified parental consent, we'll delete it.

Changes

We'll update this page if our practices change, and bump the "Last updated" date at the top. If we change how Taskelo uses Google user data, we'll tell everyone who has connected Google Calendar, by email or in the app, before the change takes effect. Other material changes get an email to hosted users when reasonable.

Contact

Questions or privacy requests: hello@taskelo.com.