Privacy Notice

Information we handle

• Account identity, email, names, verification state, and profile information. Google sign-in may supply identity and avatar information.
• Workspace/space memberships, invitations, task content, comments, mentions, attachments, notifications, and change history.
• Authentication and recovery cookies, workspace selection, and local appearance preferences.
• Technical request information such as IP addresses, browser/request metadata, security checks, and provider operational logs.
• Support messages you send us. Avoid including passwords, tokens, or unnecessary sensitive information.

Authentication is handled by Supabase. Application form responses do not return passwords. Avoid uploading information you do not have permission to share or highly sensitive information unnecessary for project management.

Why we process information

We use information to authenticate accounts, provide workspaces and collaboration, enforce permissions and quotas, deliver account messages, protect against abuse, diagnose service issues, and respond to support or privacy requests. Processing is intended to provide the service you request, protect its legitimate operation, and meet applicable legal obligations; consent is sought where required. Optional Google sign-in is your choice.

Sharing and providers

Authorized collaborators can see shared content and relevant profile/attribution information. Workspace membership alone does not grant access to every space. Members may make independent copies outside SynTask.

We use Supabase for PostgreSQL, authentication, and private attachment storage; Vercel for hosting; Resend SMTP configured through Supabase for authentication emails; Cloudflare Turnstile for abuse prevention; and Google when you choose Google sign-in. Providers may process information in countries outside the Philippines under their own infrastructure and policies. We may disclose information when required by law or reasonably necessary to investigate abuse and protect the service.

The application currently has no identified advertising or optional analytics integration. Provider operational logging is distinct from advertising tracking. We do not publish account or attachment data for advertising.

Retention and account deletion

Account and project data are retained while needed to provide the service. A deletion request restricts access immediately and starts a 14-day restoration window. Signing in alone does not cancel deletion; you must select restoration.

After the deadline, scheduled cleanup removes Personal Workspace content and files and removes Auth identity data. Shared history and shared attachments remain for collaborators; an anonymized inactive profile preserves attribution as Deleted User. User-written references and collaborators' exports may still contain information about you. Processing can be delayed by failed provider operations and retried.

Provider logs and backups have separate retention practices; these pages do not promise a verified universal retention duration or immediate deletion from backups. We will review specific retention questions with you and relevant providers. Information necessary for legal obligations or a documented dispute may need separate handling.

Security and your choices

Private storage, server-side permission checks, and validated inputs are used to protect access. No system guarantees absolute security. Protect credentials, review memberships, and keep copies of important data.

Contact support to request access, correction, export, deletion, or to raise a privacy concern. We may verify identity and assess requests against shared-content rights and applicable obligations. We cannot promise automatic approval of every request. You may also contact the Philippine National Privacy Commission where applicable. This notice is not a certification of legal compliance.