Privacy Policy

Last updated: 17 July 2026

This policy describes what data Tackl ("we," "us") collects when you use the app at tackl.nthakur.com, why, and what control you have over it. We built Tackl to store as little as possible, and only what the app actually needs to work.

1. What we collect

If you use Tackl without an account (guest mode): nothing is sent to us. Your tasks are stored only in your browser's local storage, on your device. We have no way to see, back up, or recover this data — clearing your browser data deletes it permanently.

If you create an account:

Account identity — your email address, and a password hash (email/password sign-in) or your Google account's basic profile (name, email, profile photo — Google sign-in). Handled entirely by Firebase Authentication; we never see or store your password in plain text, and email/password sign-in and Google sign-in are the only two ways to create an account.
Task data — the text of tasks you create, their quadrant (important/urgent), completion status, and ordering. This is what makes the app work.
If you use optional Google integrations (delegating a task by email, scheduling a task on Google Calendar, or backing up your list to Google Tasks) — these features, where they call a Google API, request a short-lived access token directly from your browser to Google; we never see or store that token. We only store the small result of a successful action on the task itself (e.g. a Calendar event link, or that a task was delegated to an email address you typed in). Delegation via email uses your device's own mail app (a "mailto:" link) — we never see the email content or know whether it was actually sent.

2. How we use it

Solely to operate the app: authenticating you, storing and displaying your tasks, and (for the optional integrations above) recording that an action happened. We do not sell your data, use it for advertising, or share it with anyone except the service providers below, who process it only to help us run Tackl.

3. Who else touches your data

Firebase Authentication (Google) — manages sign-in and issues the tokens that prove who you are to our server.
Cloud Firestore (Google Cloud) — stores your task data, in a database region located in Singapore (asia-southeast1).
Google Cloud Run — hosts the Tackl server itself.
Google Calendar API / Google Tasks API (only if you use those optional features) — called directly from your browser using your own Google account's permission, not routed through our server.

We don't use any analytics, advertising, or tracking services. We don't use tracking cookies — your sign-in session is kept by Firebase using your browser's local storage, not a cookie.

4. International data transfers

Your task data is stored in Google Cloud's asia-southeast1 (Singapore) region. If you're accessing Tackl from the European Economic Area, UK, or elsewhere outside that region, this means your data is transferred to and processed in Singapore. Firebase/Google Cloud is Google's infrastructure, and Google offers Standard Contractual Clauses and other safeguards for these transfers as part of its standard cloud terms — we don't run our own separate data centers or transfer mechanisms beyond what Google provides.

5. Security

Your task data is never accessible directly from the browser — our database's security rules deny all direct client access. Every read or write goes through our server, which first verifies your identity token before touching anything, and only ever touches your data.

6. How long we keep it

For as long as your account exists. If you don't have an account (guest mode), only your own browser decides that.

7. Your rights

You can delete your entire account and all associated task data yourself, at any time, from within the app (the "Delete account" link next to Sign out) — this is immediate and permanent, and removes both your account and every task you've stored with us. You can also request a copy or deletion of your data by contacting us (below).

If you're in the EU, UK, or EEA (GDPR)

We process your data on the basis of performing our contract with you (running the account and service you signed up for) — see §1 for exactly what we collect. You have the right to access, correct, delete, restrict, or receive a portable copy of your personal data, and to object to our processing of it. Account deletion (above) covers deletion directly; for the others, contact us (below). You also have the right to lodge a complaint with your local data protection supervisory authority.

If you're a California resident (CCPA/CPRA)

We do not sell or share your personal information, and never have. The categories of personal information described in §1 (identifiers like email, and the task content you provide) are collected solely to operate the service. You have the right to know what we collect, to request deletion (available directly in-app), to correct inaccurate data, and to not be discriminated against for exercising any of these rights — we don't offer different service levels based on whether you exercise them.

8. Children's privacy

Tackl isn't directed at children, and we don't knowingly collect data from anyone under 13.

9. Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page.

10. Contact

Questions about this policy, your data, or to exercise any of the rights above: contact@nthakur.com