taskss

Privacy Policy

Last updated: 16 July 2026 · Version 2.0

This policy explains what personal data taskss collects, why, what we do with it, and the rights you have. It is written to honour India's Digital Personal Data Protection Act, 2023 (DPDP Act), and we apply the same protections to every user, wherever the app is available. This is our privacy notice, not legal advice. If anything here is unclear, write to us and we will explain it.

1. Who we are

taskss (the app, at in.taskss.app) is operated by Big Helpers, New Delhi, India. Under the DPDP Act we are the Data Fiduciary for your personal data.

• Contact for any privacy question, request or complaint: admin@bighelpers.in
• Grievance Officer (DPDP Act s8(9), s13): reachable at admin@bighelpers.in. This is the person able to answer questions about how we process your data and to handle any grievance.

2. What data we collect

• Account details: your name and email address.
• Your content: the tasks, calendar events, notes, journal entries and habits you create, including any photos or attachments you add.
• Precise location: only when you explicitly tap "use current location". We never collect location in the background and never track your movements.
• Device push token: so we can send the notifications you have turned on.
• Crash and performance data: collected through Google Firebase Crashlytics to help us find and fix faults.

We do not run any advertising SDK, we do not track you across other apps or websites, we do not build profiles about you, we do not sell your data, and we do not share it with data brokers.

3. Why we process your data

We process your data to run the service you asked for. Under the DPDP Act this rests on your consent (section 6), which you give by a clear action when you create an account and when you turn on optional features. There are no pre-ticked boxes and nothing is bundled.

Purpose	Data used
Running your account and syncing your tasks, calendar, notes, journal and habits	Account details, your content
Taking payment for paid features (via Razorpay)	Payment details, handled by Razorpay
Sending push notifications you have enabled	Device push token
Showing your current location when you tap for it	Precise location, at that moment only
Finding and fixing faults	Crash and performance data
Protecting your account and preventing fraud and abuse	Account and usage signals

You can withdraw any consent at any time (see section 7), and withdrawing it is as easy as giving it.

4. Where your data is processed

We store and process your data on servers in India. Payment processing (Razorpay) and our hosting both operate in India, so those flows stay within India.

One flow leaves India: crash and performance data shared with Google (Firebase) may be processed by Google outside India, under Google's own data protection terms. Under the DPDP Act, the Government of India may restrict cross-border processing to particular countries by notification (section 16); we will comply with any such restriction.

5. Who else touches your data (sub-processors)

• Google Firebase — crash reporting, performance data and push notifications.
• Razorpay — payment processing. Razorpay handles your card and payment details directly; taskss never sees your full card number.
• Our India hosting provider — the servers your data sits on, in India.

We do not share your personal data with anyone else, and we do not sell it.

6. How long we keep your data, and how to delete it

We keep your data for as long as your account is active. You can delete your account at any time from within the app: Settings, then Delete account. When you delete your account:

1. Your data is wiped from your device immediately and your account is closed at once.
2. We keep a copy on our server for 30 days, so that a deletion made by mistake can be recovered if you ask us for support within that window.
3. After 30 days, a scheduled job permanently and irreversibly purges everything, including the key material for your encrypted journal. After this point nothing can be recovered.

You may also request deletion by writing to admin@bighelpers.in. We also delete data when the purpose it was collected for no longer applies or when you withdraw the consent it rested on, unless a law requires us to keep it (for example, payment records for tax).

7. Your rights and how to use them

To exercise any right, write to admin@bighelpers.in. We respond within the period prescribed by the DPDP Act, and there is no charge.

• Access — a summary of your data and how we process it (DPDP s11).
• Correction, completion, updating and erasure of your data (DPDP s12).
• Withdraw consent — at any time, as easily as you gave it (DPDP s6).
• Nominate another person — you may nominate someone to exercise your rights if you die or become incapable of doing so (DPDP s14).
• Grievance redressal — raise a grievance with our Grievance Officer at admin@bighelpers.in (DPDP s13). If it is not resolved, you may approach the Data Protection Board of India.

Deletion is also available directly in the app: Settings, then Delete account (see section 6).

A limitation for your encrypted journal (see section 8): an access request can only return your journal in encrypted form. We cannot decrypt it.

8. Your encrypted journal

Your journal is end-to-end encrypted on your device (PBKDF2 with 600,000 iterations, then AES-GCM). The key is derived from your passphrase on your device and is never sent to us or stored by us. Because of this, we do not possess the technical means to decrypt your journal content.

• This is a statement of what we cannot do, not a way of avoiding responsibility. Your journal is still covered by this policy, and we remain the Data Fiduciary for the encrypted data and its metadata (that an entry exists, its time and its size).
• If you lose your passphrase, your journal content is permanently unrecoverable. We cannot reset it or produce a readable copy. Keep your passphrase safe.
• Strong encryption lowers your risk if there were ever a security incident, but it does not remove our duty to assess and report a data breach where the law requires it.

9. Automated decisions

We do not carry out automated decision-making or profiling. We run no advertising SDK, do no tracking, build no profiles, and sell nothing.

10. Children

You must be 18 years of age or older to create a taskss account. The DPDP Act treats anyone under 18 as a child and requires verifiable parental consent before their data is processed. Rather than process children's data, we do not allow under-18s to register, and the app asks you to confirm you are an adult before an account is created. We do not knowingly process the data of anyone under 18. If we learn that we have, we will delete it.

11. Language, changes and how we tell you

We write this notice in plain language. On request we can provide its content in English or any language listed in the Eighth Schedule of the Indian Constitution (DPDP s5(3)).

If we change this policy we will update the date and version at the top and, for material changes, tell you in the app or by email.