Privacy Policy

What we collect: what your sign-in provider gives us, the tools you connect, and the tasks we copy from them onto your boards.

What we never do: sell your data, use it for advertising, or use it to train AI models.

Where it’s stored: in the region you choose: the EU, the UK, the US or Australia.

AI: only if you add your own key. Your browser then talks to that AI provider directly.

Your control: download or delete your data at any time in Account settings.

Questions: privacy@onetasklist.com.

OneTaskList is provided by OneTaskList Pty Ltd (ACN 698 036 798), Level 15, 461 Bourke Street, Melbourne VIC 3000, Australia. We decide how and why your personal data is used, which makes us the “controller” under data protection law.

• Email: privacy@onetasklist.com
• Privacy contact: Silke McManus, privacy@onetasklist.com
• Our representative in the EU: [Altus EU entity, address, email]
• Our representative in the UK: [Altus UK entity, address, email]

You can contact our representatives instead of us about anything in this policy.

• onetasklist.com, the OneTaskList web app, the iOS and Android apps, and the OneTaskList MCP server.
• It doesn’t cover the tools you connect, the service you sign in with, or an AI provider you choose. Their own privacy policies apply; section 5 links to them.
• If your organisation provides OneTaskList to you, section 11 applies too.

The table lists each thing we do with personal data, the data involved, and the legal basis for it under the GDPR and UK GDPR. “Contract” means we need the data to provide OneTaskList to you. “Legitimate interests” means we have a good reason that doesn’t override your rights; the reason is given each time.

Where the data comes from

From you; from your sign-in provider (name, email address, picture and account ID); and from the tools you connect (your tasks and the name of the connected account).

What you have to give us

To have an account you sign in with Microsoft, Google or GitHub, which gives us your name and email address. We can’t create an account without them. Everything else is up to you.

Other people in your tasks

Your tasks can contain information about other people, such as the sender of an email or the author of an issue. We hold it only so you can see your own tasks, and we delete it when you disconnect the tool or delete your account.

• The AI assistant is off until you add a key for an AI provider you choose: Anthropic, OpenAI or a service compatible with it, OpenRouter, or Microsoft 365 Copilot.
• Your browser sends your request straight to that provider. It doesn’t pass through our servers, and your key stays in your browser. The provider handles the data under your agreement with it and its own privacy policy.
• What is sent: for a question about a board, its name, its columns, and the titles and dates of its tasks. For a question about a task, its title, notes, dates and effort.
• “Open in Claude” puts the text of a task or board into a link to claude.ai, which your browser opens.
• If you connect an AI app such as Claude to OneTaskList through our MCP server, that app can read and change your tasks until you revoke its access in that app.
• We never use your data to train AI models, and we make no decisions about you by automated means alone.

We don’t sell your personal data, and we don’t share it for advertising.

5.1 Service providers

These companies process data for us, only on our instructions and under a written contract.

5.2 Tools you connect

When you connect a tool, the company behind it gives us access under its own terms. It is an independent controller, and its privacy policy covers what it does with your data. Tools marked “when available” aren’t offered yet; they’re listed so this policy is ready when they are.

Google user data. When you connect Gmail, Google Drive or Google Tasks, we use only the data needed to show those items on your board and keep their status in step. For Gmail we copy the subject, sender, date and a link to the message, not the message body. We don’t use Google user data for advertising, don’t sell it, and don’t use it to train AI models. People at OneTaskList read it only with your permission, to fix a problem you report, for security, or where the law requires it.

OneTaskList’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.3 Sign-in providers

Microsoft, Google and GitHub confirm who you are when you sign in. Each is an independent controller under its own privacy policy, linked above.

5.4 AI providers you choose

Anthropic, OpenAI, OpenRouter and Microsoft, or another provider you set up yourself. See section 4.

5.5 Anyone else

We disclose personal data only when the law requires it, to protect someone’s safety or our legal rights, or to a buyer if OneTaskList is sold. If your data would pass to a buyer, we tell you first.

When you first sign in, you choose a region. Your account, connections, tasks and technical logs are stored there, on Microsoft Azure.

Some data is handled outside your region:

• Sign-in runs in the EU for every region. Your name, email address, picture, sign-in provider ID and sign-in record are stored there.
• Alerts to our team about sign-ups and feedback (your name, email address and region) go to our Microsoft Teams, which stores them in Australia.
• AI requests go to the provider you choose, wherever it operates.
• The tools you connect keep your data wherever they store it.
• Our team works from Australia and may access data from there to support the service.

Transfers outside the EU and UK

When data goes from the EU or UK to a country without an “adequacy decision” (a ruling that its protection is equivalent), we use the European Commission’s Standard Contractual Clauses and, for the UK, the UK Addendum to them. Transfers to the US rely on the EU-US Data Privacy Framework and its UK Extension, or on Standard Contractual Clauses. Australia has no adequacy decision, so data stored or accessed there is protected by these clauses. Ask us at privacy@onetasklist.com for a copy.

We use only the cookies and browser storage OneTaskList needs to work. We use no analytics, advertising or tracking cookies, so we don’t ask for cookie consent. Strictly necessary storage doesn’t need consent under § 25(2) TDDDG in Germany or regulation 6(4) of PECR in the UK.

• Data is encrypted in transit (HTTPS) and at rest.
• Access tokens, names and task content are encrypted again with keys protected by Azure Key Vault.
• Each region’s data is kept separate.
• Only the people who run and support OneTaskList can access it, and only when they need to.
• If a breach puts your data at risk, we tell the supervisory authority within 72 hours and tell you without undue delay where the law requires.

You have these rights under the GDPR and UK GDPR. We give them to everyone, wherever you live.

Your right to object

Where we rely on legitimate interests (see section 3), you can object at any time, on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. Email privacy@onetasklist.com.

Making a request

Email privacy@onetasklist.com. It’s free. We reply within one month. If a request is complex we may take up to two more months, and we’ll tell you within the first month. To protect your account, we may ask you to write from the email address on it.

Complaints

Please complain to us first at privacy@onetasklist.com. We acknowledge a complaint within 30 days and keep you told of progress. You also have the right to complain to a data protection authority:

• UK: the Information Commissioner’s Office.
• EU: the authority in your country, listed by the European Data Protection Board.
• Germany: the authority for your federal state, listed by the Federal Commissioner for Data Protection (BfDI).

When an employer or other organisation sets up OneTaskList for its people under an agreement with us, the organisation decides how the data is used and we process it on its behalf. Its own privacy notice applies. Send requests about your data to the organisation; we’ll help it answer.

OneTaskList is not for anyone under 16. If we learn that an account belongs to someone under 16, we delete it.

We tell you by email or in the app before a material change takes effect. The version and effective date are at the top. Previous versions are at onetasklist.com/privacy/history.

OneTaskList Pty Ltd follows the Australian Privacy Principles under the Privacy Act 1988 (Cth).

• Overseas disclosure: your data may be stored or accessed in the region you choose (the EU, the UK, the US or Australia), in the EU for sign-in, in Australia for alerts to our team and for support access, and in the countries where the providers in section 5 operate.
• Automated decisions: we don’t use computer programs to make decisions about you that could significantly affect your rights or interests.
• Access and correction: see section 10.
• Complaints: contact us first. If you’re not satisfied with our response within 30 days, you can complain to the Office of the Australian Information Commissioner.

Everyone gets the rights in section 10. Some places add their own:

OneTaskList Pty Ltd, Level 15, 461 Bourke Street, Melbourne VIC 3000, Australia

• Email: privacy@onetasklist.com
• Privacy contact: Silke McManus
• EU representative: [Altus EU entity, address, email]
• UK representative: [Altus UK entity, address, email]