We believe privacy is a right, not a feature. Here's exactly what data we collect, why, and how we protect it.
Effective date: 27 April 2026 · Last updated: 16 May 2026
TaskSage ("we", "us", "our") is a task management web application built and operated by Jagadish Vulli, based in the United Kingdom.
For the purposes of the UK GDPR and EU GDPR, Jagadish Vulli is the data controller for personal data processed through TaskSage.
Contact: jagadish.vulli@gmail.com
When you sign in, we collect:
All content you create in the app is stored in your personal account:
If you use AI features, we record the number of AI calls made, token counts, and associated costs against your account. We do not store the full content of AI prompts or responses beyond what you explicitly save to your task notes.
When you use the Gmail email scan feature, the subject line, sender name, and body of selected emails are sent to our AI processing providers solely to extract action items. This email content is not stored on our servers — it passes through our Cloud Functions to the AI API and is discarded immediately after the task is created.
When you enable agentic AI on a task, our scheduled system automatically processes that task using AI at regular intervals (typically daily). The task's name, notes, and instructions are sent to our AI providers as part of this scheduled run. You can disable this at any time by removing the AI instruction from the task.
We collect minimal technical data to operate the service:
Plain English summary: We read your Gmail, Google Calendar, and Google Tasks to help you manage work in one place. For the Google Meet feature (Personal tier and above), we also create Google Calendar events on your behalf when you schedule a meeting from within TaskSage. We never access your Google data in the background — all interactions happen when you take an action in the app.
When you connect your Google account, TaskSage may request access to the following Google scopes depending on the features you use:
| Scope | Why we request it | Stored on our servers? |
|---|---|---|
gmail.readonly |
To scan your inbox for emails that contain action items and automatically create tasks from them. Only used when you trigger the email scan feature. Email content (subject, sender, body) is passed to our AI providers to extract action items and is immediately discarded — it is never stored on our servers. | Never |
calendar.readonly |
To display your Google Calendar events alongside your TaskSage tasks in the Calendar and Daily Digest views, giving you a unified schedule. | Never |
calendar.events |
To create, update, and delete Google Calendar events on your behalf when you use the Google Meet feature (Personal tier and above). When you schedule a Google Meet from a task, we create a Calendar event with a Meet link and send invites to any attendees you specify. When you reschedule or delete the task's meeting, we update or delete the corresponding Calendar event. We only create, update, or delete events that TaskSage itself created — we never touch other calendar events. | Event ID only |
contacts.readonly |
To provide a contacts typeahead when you add attendees to a Google Meet — so you can search and select from your Google Contacts rather than typing email addresses manually. Contact data is fetched in your browser session only at the moment of search and is never stored on our servers. | Never |
tasks.readonly |
To let you browse your Google Tasks lists and selectively import items into TaskSage as new tasks. | Never |
Note on "Event ID only": when you create a Google Meet via TaskSage, we store the Google Calendar event ID and the generated Meet link URL in your TaskSage task record (in Firestore). This is necessary to update or cancel the event later. We do not store the full Calendar event data.
Google Calendar and Google Tasks data is fetched directly from Google's APIs in your browser session and displayed in real time. Gmail scanning is triggered by you and runs via our server-side Cloud Functions, which use your OAuth token to fetch the relevant emails, pass them to our AI providers for extraction, and immediately discard the email content.
Google Meet integration (create, update, cancel) is performed directly from your browser using the Google Calendar API — these calls do not pass through our servers. Contact search (People API) is also performed directly from your browser.
Your Google OAuth access token is stored only in your browser's localStorage and is passed to our Cloud Functions only when you explicitly trigger a feature that requires it (such as email scan). It expires after approximately one hour.
TaskSage's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
⚠️ You can revoke TaskSage's access to your Google data at any time via Google Account Permissions. This does not delete your TaskSage tasks, only disconnects the Google integration.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing the TaskSage service (storing and syncing your tasks) | Contract performance |
| Authentication and account security | Contract performance |
| Sending push notifications you've opted in to | Consent |
| Sending daily reminder and overdue task alerts | Contract performance / Consent |
| Enforcing subscription tier limits | Contract performance |
| Gmail email scanning — reading selected emails to extract action items as tasks (only when you trigger this feature) | Consent |
| AI feature processing — your task content is sent to our AI providers when you use AI features manually or when agentic AI runs on a schedule | Contract performance / Consent |
| Scheduled agentic AI — automatically running AI on tasks that have AI instructions set, at regular intervals, without requiring you to be in the app | Contract performance / Consent |
| Webhook and automation execution — calling third-party URLs you configure when automation rules trigger | Contract performance |
| Improving and debugging the service | Legitimate interests |
When you use AI features — including the ✨ button, AI scheduling, voice-to-task, email scan, AI text/document import, or AI file upload — the relevant content (task name, notes, checklist, email content, pasted text, or uploaded file) is sent to one of our AI processing providers. The provider used depends on the specific feature:
File uploads: When you use the AI File Import feature (Premium and above), the content of your uploaded file (.txt, .pdf, .jpg, or .png) is sent directly to Google's Gemini API for task extraction. Files are transmitted in memory only — they are not stored on our servers or in Firebase Storage at any point. The file content is processed by Gemini and immediately discarded after the AI response is returned.
Each provider's privacy policy applies to data they receive.
When agentic AI is enabled on a task, our Cloud Scheduler automatically runs AI on that task at regular intervals (typically once per day). This happens in the background without you needing to be active in the app. You remain in control — you can remove the AI instruction from any task at any time to stop automated processing.
We do not use your task content, email content, or uploaded files to train any AI model.
Your TaskSage data is stored on Google Firebase infrastructure (Firestore database and Firebase Storage), operated by Google LLC. Data is processed in the europe-west2 (London) region.
We implement the following security measures:
While we implement strong security practices, no system is 100% secure. In the event of a data breach we will notify affected users in accordance with UK GDPR requirements.
We do not sell, rent, or trade your personal data. We share data only with the following service providers, strictly to operate TaskSage:
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase | Database, authentication, file storage, hosting | EU (europe-west2) |
| Google Cloud | Cloud Functions (server-side processing), Cloud Scheduler (agentic AI scheduling) | EU (europe-west2) |
| Anthropic | AI processing of task content and email content (only when AI features are used) | USA |
| Google (Gemini API) | AI processing of task content for certain features (only when AI features are used) | USA / Google infrastructure |
| Groq | AI processing of task content and email content for certain features (only when AI features are used) | USA |
| Google APIs | Gmail scanning (server-side, on your request), Google Calendar + Tasks integration (read-only, in your browser), Google Meet event creation/update/deletion via Calendar Events API (in your browser, on your request), Google Contacts search via People API (in your browser, when you add attendees to a meeting) | Google infrastructure |
| User-configured webhooks | If you set up webhook or custom tool integrations, task data is sent to the URLs you specify. You are responsible for the privacy practices of those third-party services. | As configured by you |
All providers are bound by appropriate data processing agreements. Anthropic and Groq data transfers to the USA are covered by standard contractual clauses.
We may disclose data if required by law or to protect the rights and safety of users or the public.
Under the UK GDPR and EU GDPR, you have the following rights:
To exercise any of these rights, contact us at jagadish.vulli@gmail.com. We will respond within 30 days.
TaskSage uses browser localStorage (not cookies) to store:
This data never leaves your browser passively and is not accessible to our servers. Your OAuth token is only transmitted to our server-side functions when you explicitly trigger a Google-integrated feature (such as Gmail scan). You can clear localStorage at any time via your browser settings.
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
TaskSage is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you via an in-app notification. Your continued use of TaskSage after changes are posted constitutes acceptance of the updated policy.
For any privacy-related questions, data subject requests, or concerns: