No one can see your tasks.

Not as a promise, but as a consequence of how Taskrix is built: no copy of your tasks exists anywhere the developer, or anyone else, can reach. Most privacy policies ask you to trust an intention. This one describes a mechanism, and the sections below set out exactly how it works.

Last updated 19 September 2026 · applies to Taskrix 2.1 and later

Task data

Tasks, tags, focus sessions and weekly history are stored on the device. When iCloud sync is enabled, they are also stored in the user's own iCloud account, using Apple's CloudKit private database.

The distinction is the whole point. Data in a CloudKit private database is held under the user's Apple Account, not on any server operated by Taskrix or its developer. There is no administrative console, no dashboard and no technical route by which that data can be accessed. Apple's handling of it is governed by Apple's privacy policy.

Sync is optional and can be disabled at any time under Settings → Your data. With sync off, Taskrix functions fully on a single device.

Before version 2.0, this policy stated that task data never left the device. Version 2.0 introduced sync, and this wording was changed to match. Task data now travels — but it travels to the user's own account, never to the developer's.

Microphone and speech

Voice sorting requires microphone and speech recognition permission. When it is used:

Speech recognition is performed entirely on the device. Taskrix explicitly requires on-device recognition and does not fall back to server-based transcription under any circumstances.
No audio is recorded, written to disk, or transmitted.
Only the recognised instruction — “yes”, “no”, “skip” or “stop” — is used, and it is discarded as soon as the answer is applied.
If permission is declined, voice sorting remains fully usable through on-screen buttons.

Usage statistics in the app

Taskrix records which features are used and in what order, so that development effort goes to the parts people rely on and away from the parts they do not. From version 2.1 this is processed by Google Analytics for Firebase, with Google acting as a processor on the developer's instructions.

What is transmitted: event names such as voice_sort_finished; the names of screens as they are opened, which is what allows the route through the app to be understood rather than just the total for each feature; counts expressed in ranges (“1”, “2–3”, “4–6”) rather than exact figures; and categories, such as which locked feature a subscription prompt was reached from.

Four characteristics are also attached, so that reports can be split sensibly: whether the subscription is free, trial or paid; roughly how many weeks of history exist; whether iCloud sync is on; and roughly how many tasks are open. All four are ranges or categories, never exact numbers.

Google additionally collects standard technical context of its own: device model, iOS version, app version, language, and a country derived from the IP address. The IP address is processed by Google to determine that country; it is not available to the developer at any point.

What is never transmitted: task titles, tags, notes or dates; anything typed or spoken; names, email addresses, Apple Account details, contacts, precise location, or any advertising identifier.

The advertising identifier point is structural, not a policy choice. Taskrix installs the variant of the Firebase library that has no capability to read the IDFA at all, and additionally disables collection of the vendor identifier (IDFV) and all advertising personalisation signals. There is no setting that could turn this on by accident, and no App Tracking Transparency prompt, because there is nothing to ask permission for.

How usage is counted: Google assigns each installation a random identifier. It is not derived from the device, the Apple Account, the email address or anything else about the person, and it cannot be connected to any of them. It persists for the life of the installation — which is what makes it possible to say “this person came back on three separate days” rather than “three visits happened” — and is destroyed when the app is deleted. Reinstalling produces a new one, unconnected to the old.

This is a real change from previous versions and worth stating plainly. Before 2.1, statistics were processed by TelemetryDeck using an identifier hashed twice, once on the device and once by the provider, which made returning use impossible to measure by design. The new arrangement can recognise the same installation across days. It still cannot identify a person, and nothing about who they are is collected or inferred — but it is a persistent identifier where previously there was none, and the App Store privacy label was updated to declare it.

There is no setting to switch this off. Versions up to 2.0 offered one in Settings, and 2.1 removed it: on an app this small, statistics that only some installations report cannot be relied on to decide what to build and what to retire, which is the only purpose they serve. Anyone who had already switched sharing off before 2.1 remains switched off — that choice was made deliberately and is honoured rather than reset.

Two things follow from that, and both are stated here rather than left to be discovered. Deleting the app ends collection completely and destroys the installation identifier along with it. And because there is no in-app control, an objection under the GDPR is handled by writing to the address at the foot of this page; the honest limitation is that without an identifier that can be quoted, what that achieves is confirmation and correction of this policy rather than retrieval of specific records, because there are no records filed under anything a person could name.

Legal basis and transfers: the lawful basis is legitimate interest — understanding which parts of a small app are worth maintaining. Google processes this data in the United States and other countries under the European Commission's Standard Contractual Clauses. Google's own handling is described in the Google privacy policy.

This data is never sold, never shared with data brokers, never used for advertising, and never used to track anyone across other apps or websites.

This website

taskrix.app records how it is used, in more detail than the app does, and without cookies. No third-party analytics provider is involved: events are written directly to a Firestore database operated by the developer, within the same Google Cloud project that hosts the site.

What is recorded: pages opened, scroll depth, which sections remain on screen long enough to have been read, which support questions are expanded, which links and buttons are clicked, whether text is copied, approximate time on page, and the point at which a visitor stops. Also browser, device type, operating system, screen size, language and country — but not town, address or precise location.

What is not recorded: no cookie is set, no advertising or device identifier is used, and nothing is retained on the visitor's device after the browser tab is closed. Each visit is assigned a random label held in the tab's own memory and discarded with it. Nothing on this site can recognise a visitor on a later day, on another device, or on any other website.

Referrers — the page a visitor arrived from — are stored only as a category: “search”, “reddit”, “chatgpt”, “direct”. The full address is never retained, because a referrer URL can contain search terms or a path from a private forum.

If a browser sends Do Not Track or Global Privacy Control, nothing is recorded at all. Neither signal is legally binding in most jurisdictions; Taskrix honours them regardless.

App Store links on this site carry a campaign label such as ct=web_home_hero, which allows Apple to report which page and button preceded a download. Apple returns this as an aggregate count containing no information about individuals.

Support requests and feedback

Messages submitted through the support or feedback forms are stored in the same Firestore database. Each record contains the message text, the chosen topic, the page it was sent from, and the time of submission.

Providing an email address is optional. It is used solely to reply and for no other purpose — no mailing list, no marketing, and it is never shared. Messages sent without one are still read; they simply cannot be answered.

Messages are retained while they remain useful for supporting the app, and may be deleted on request.

Purchases

Taskrix Pro is a monthly subscription processed entirely by Apple. Payment details are never visible to the developer, and no payment information is stored by Taskrix. The app asks Apple whether the current Apple Account holds an active subscription and receives only a yes or no in response, along with the date the current period ends.

Subscriptions are managed in Settings → [your name] → Subscriptions on the device, under Apple's control rather than the developer's. Cancelling is done there and takes effect at the end of the paid period.

Children

Taskrix is not directed at children under 16. Nothing collected can identify a person of any age: there is no account, no name, no email address and no contact information, and the only persistent value involved is a random per-installation identifier that is connected to nothing outside the app.

Your rights

The GDPR provides rights of access, rectification, erasure, portability and objection. These apply, and most are satisfied by the design of the app rather than by a request procedure:

Access and portability: Settings → Advanced → Export my data produces a complete JSON file immediately — no request, no waiting, and a format readable in any text editor.
Erasure: deleting a task deletes it. Deleting the app removes everything held on the device. Data held in iCloud is removed from Settings → [your name] → iCloud → Manage Storage, under the user's control rather than the developer's.
Objection: Do Not Track stops the website's statistics entirely. The app's have had no in-app switch since version 2.1; deleting the app ends collection and destroys the installation identifier, and objections can be raised at the address below.
Access to data held about you: requests are welcome, and the honest answer is that there is no way to find your records, because there is nothing to search by. Usage statistics are filed under a random installation identifier that exists only inside your copy of the app and is known to no one — it cannot be looked up, quoted, or matched to a person, which is the same property that protects you. Deleting the app destroys it. Where a message has been sent through a form with an email address, that message can be retrieved or deleted on request, because an email address is something that can actually be searched for.

Data controller

Taskrix is developed and operated by VolksApps, the data controller for the purposes of this policy. Contact details are at the foot of this page.

Lawful basis

Only two activities described here require a lawful basis under the GDPR:

Usage statistics, in the app and on this website — legitimate interest. There is no other practical way to determine which features merit continued development, and the data is constructed so that it cannot identify anyone. The website's collection is suppressed entirely by a Do Not Track signal. The app's has no in-app switch as of version 2.1; deleting the app ends it, and the section above sets out what an objection can and cannot achieve.
Support and feedback messages — necessary in order to respond, which is the purpose for which they were sent.

Task data requires no basis, because it is never received.

Retention

Task data: retained until deleted by the user. Deleted tasks are held for 30 days in Recently Deleted, then permanently removed. No copy is held by the developer at any stage, so there is nothing further to expire.
App usage statistics: retained by Google for 14 months, the longest period Google Analytics offers for event-level data, after which individual events are deleted and only aggregate totals survive. Aggregates are what the data is for; an event from two years ago answers nothing a total cannot.
Website events: retained indefinitely at present, since period-on-period comparison is the purpose of collecting them. The same reasoning applies: no record identifies anyone.
Support and feedback messages: retained while useful for supporting the app, and deleted on request.
Web server logs: held by Google for Firebase Hosting under their own schedule.

International transfers

Apple and Google both operate globally and handle international transfers under their published terms — Apple, Google. App usage statistics, website events and form submissions are all processed by Google, in the United States and elsewhere, under the European Commission's Standard Contractual Clauses. Taskrix operates no servers of its own.

Before version 2.1, app statistics were processed by a German provider within the EU. That changed with the move to Google Analytics for Firebase, and it is stated here rather than left to be noticed.

Service providers

Apple — iCloud sync (CloudKit private database), App Store distribution and payments.
Google — Firebase Hosting serves this website and writes request logs containing IP addresses; Firestore stores website events and form submissions; Google Analytics for Firebase processes the app's usage statistics.

From version 2.1, Google is therefore the processor for all three, where previously the app's statistics sat with a separate provider. That concentration is worth naming: it means Google is technically capable of accessing everything described in this policy except the one thing that matters most, which is the tasks themselves. Those are held in the user's own iCloud account, under Apple, and Google never receives them in any form.

What Google does receive is what is described above: event and screen names, banded counts, page paths, scroll percentages, which support question was expanded. It contains no cookie on the web, no advertising identifier anywhere, and nothing attributable to a named person. Do Not Track prevents the website's collection entirely.

Complaints

Please raise any concern directly first; inaccuracies in this policy will be corrected promptly.

There is also a right to lodge a complaint with a data protection supervisory authority. Within the EU or UK this is the authority for the complainant's own country, and no permission or involvement from the developer is required.

Changes to this policy

Where a change affects what leaves a user's device, it will be stated in the app's release notes rather than applied silently to this page.

Contact

Questions about this policy can be sent through the support form or by email to volks4apps@gmail.com. Every message is read.