TaskFLY App Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") describes how AESA Investment OÜ (hereinafter referred to as "we", "us" or "our") collects, uses, stores, protects and shares data of users of the TaskFLY mobile application (hereinafter referred to as the "App"). Our goal is to ensure transparency and protection of your data in accordance with applicable legal regulations, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and Google's requirements for OAuth authentication.

1. Controller and Roles of the Parties

AESA Investment OÜ
Tööstuse tn 75-71, 10416 Tallinn, Estonia
Reg. No.: 17379624, VAT ID: EE102927379
Email: development@aesa.sk

The App is published by, and made available on the app stores by, AESA Investment OÜ. With respect to your account, task and friend-system data, we act as the controller; Google/Firebase and Google Gemini act as processors (sub-processors). In the App Store and Google Play, the Application is published through the developer account of AESA Group, SE, which acts solely as a distributor and does not own the Application.

2. Data We Collect

2.1 Authentication Data

When you sign in with Google or Apple, we receive your name, email address, and profile photo. This data is used solely for account identification and friend system functionality. You can replace this photo in Edit Profile with a photo uploaded from your device or with one of the built-in avatars.

2.2 Task Data

Tasks, categories, priorities and notes you create are stored locally on your device (UserDefaults). When you sign in, this data is also synced to Firebase Firestore for cloud backup and cross-device synchronization. When you assign or share a task with a friend, the task and its status are stored in a shared cloud collection accessible to both parties. Your public profile (display name, nickname) is visible to signed-in users for the purpose of friend search. Your profile photo or chosen avatar is part of that public profile.

2.3 Analytics

We use Firebase Analytics with GDPR Consent Mode v2. Analytics data is collected ONLY after your explicit consent. We automatically detect EU region users and request consent before any data collection. No analytics data is collected without your permission.

2.4 Anonymous Comparison Statistics

To display the optional “Your Progress” card, the App periodically uploads four numbers linked to your account: tasks completed in the last 30 days, tasks created in the last 30 days, your current daily streak, and focus minutes recorded by the Pomodoro timer in the last 30 days. No task names, notes, categories or any other content is included. Once a night these numbers from all participating users are aggregated into anonymous distribution histograms, and your position within them is calculated locally on your device — no user ever sees another user’s individual numbers. You can switch this off at any time in Settings → “Anonymous comparison”; switching it off deletes the numbers we hold for you.

2.5 Install Attribution

If you installed the App after tapping an Apple Search Ads advertisement, Apple tells us which campaign, ad group and keyword led to that install, together with the country or region. This comes from Apple’s AdServices framework, is requested once per installation, and says nothing about what you do outside the App. We use it only to understand which advertising is worth paying for. It is never shared with advertising networks or data brokers and is not used to track you across other apps or websites. If you did not come from an advertisement, we simply record the install as organic.

3. Data We Do NOT Collect

• Location data
• Contacts
• Camera; voice recordings are not stored (the microphone is used only for AI assistant voice input and the recording is not retained after processing by Google Gemini)
• Advertising identifiers or tracking cookies
• Third-party ad trackers or remarketing tools

4. AI Assistant

TaskFLY uses Google Gemini (the Gemini 2.5 Flash model) for task creation and assistance. Both text inputs and voice recordings are sent for processing to the Google Gemini API — speech-to-text transcription is produced directly by the AI model. As context, the AI also receives your current task list and your last 10 completed tasks. Conversation history (max. 5 messages) exists only while the assistant is open, is cleared when it closes, and is never stored on our servers. The assistant’s voice replies are generated by Google Cloud Text-to-Speech, which receives the text of the reply.

5. Data Storage & Security

Local data is stored in UserDefaults on your iOS device. Cloud data is stored in Firebase Firestore (Google Cloud Platform) with encryption at rest and in transit. Authentication is secured via the Google Sign-In and Apple Sign-In SDKs. To deliver push notifications (friend requests, assigned-task updates) we use Firebase Cloud Messaging and store your device’s notification token. Widgets and the Lock Screen read a small snapshot of today’s tasks from a shared container on your device (an App Group) so they can render without launching the App; this snapshot never leaves your device. Profile photos you upload are stored as a compressed JPEG (max. 1 MB) in Firebase Cloud Storage in the European Union (region europe-central2, Warsaw) and can be read only by signed-in users of the App.

6. Account Deletion

You can delete your account at any time directly in the app (Settings → Delete Account). We ask you to type a confirmation word first, and the deletion cannot be undone. Deleting the account removes your sign-in record and automatically erases your cloud data: tasks, shared and delegated tasks in both directions, friend connections including the entries in your friends’ lists, pending friend requests, your public profile, your nickname reservation, your settings, your comparison statistics, your in-app notifications and any AI referral bonus. Problem reports you have sent us are deleted as well; e-mails you have already sent to our support address remain in our mailbox. Notifications you sent to friends stay in their notification list until they are deleted automatically 90 days after they were created. For up to 7 days after deletion a copy of your data may still exist in our automated database backups. We do not restore deleted accounts from them, and once that window passes the copy is gone as well. Data stored only on your device is removed when you uninstall the app. A profile photo you uploaded is deleted from Cloud Storage together with the account.

7. Children's Privacy

TaskFLY is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal data from a child under 13, we will delete it promptly. Parents or legal guardians can contact us at development@aesa.sk.

8. Your Rights (GDPR)

As an EU resident, you have the right to access, rectify, delete, and port your personal data. You can exercise these rights by contacting us at development@aesa.sk or by deleting your account in the app. You may also object to processing based on legitimate interest (see section 9). If you are a California resident, you may request disclosure of the categories of personal information we collect and request its deletion; we do not sell personal information and do not share it for cross-context behavioural advertising, so no “Do Not Sell or Share” opt-out is required.

9. Legal Basis for Processing

We process personal data on the following legal bases under Article 6(1) GDPR: (a) performance of a contract — sign-in, cloud synchronisation of your tasks, task sharing with friends and push notifications, which are necessary to provide the functions you have requested; (b) consent — Firebase Analytics and the related diagnostics, collected only after you agree and withdrawable at any time; (c) legitimate interest — the anonymous comparison statistics described in section 2.4, security and abuse prevention, and the referral bonus described in the Terms of Use. Where we rely on legitimate interest you have the right to object; for the comparison statistics you can opt out directly in the App. Install attribution described in section 2.5 also relies on legitimate interest.

10. Data Retention

We keep your account data (profile, tasks, friend connections) for as long as your account exists. When you delete your account, your cloud data is removed automatically — tasks, shared tasks, friend connections, your public profile, your nickname reservation, your comparison statistics, your in-app notifications and any AI referral bonus. Problem reports you sent us are deleted together with your account. In-app notifications are deleted automatically 90 days after they are created. Your push notification token is removed as soon as it stops being valid. Comparison statistics of users who have not been active for more than 45 days are excluded from the aggregation and are deleted after 180 days of inactivity. The published aggregated histograms contain only counts and no personal data. Automated database backups keep a recoverable copy of cloud data for 7 days. Analytics data is held by Google as our processor for 14 months; withdrawing consent stops any further collection. An uploaded profile photo is kept until you replace or remove it or delete your account.

11. International Data Transfers

Your account and task data is stored in Google Cloud data centres in the European Union (Firestore database in the EU multi-region eur3 — Belgium and the Netherlands; profile photos in Cloud Storage in the europe-central2 region, Warsaw). Some processors may process data outside the European Economic Area: the AI assistant (Google Gemini via Firebase AI Logic) and the assistant’s voice replies (Google Cloud Text-to-Speech). Such transfers are covered by the European Commission’s Standard Contractual Clauses together with Google’s data processing terms. Purchases and subscriptions are processed by Apple under Apple’s own terms and privacy policy.

12. Supervisory Authority and Withdrawing Consent

You can withdraw your analytics consent at any time in Settings → “Reset Analytics Consent”. Withdrawal does not affect the lawfulness of processing carried out before it. If you believe we process your data unlawfully, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk) or with the supervisory authority in your country of residence.

13. Contact

For any privacy-related questions, please contact us at:
development@aesa.sk