TaskStamp

Privacy Policy

Effective 22 July 2026 · Version 1.0 · Applies to TaskStamp mobile & web apps

TaskStamp ("TaskStamp", "we", "us") is a task-delegation app for field and fleet teams. This policy explains what we collect, why, where it lives, and the controls you have — written to meet the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

The short version: your team's data is yours. We store what the app needs to function, keep it in Australia (Supabase Sydney), never sell it, never show ads, and you can export or permanently delete everything from inside the app at any time.

1. What we collect

Data	Examples	Why
Account	Email address or OAuth identity (Google/Apple), display name, role, profile photo	Sign-in (passwordless), team membership, showing who assigned/completed work
Team & task data	Team names, invite codes, task titles/locations/descriptions, due dates, statuses, review outcomes, catalogued history	The core service: delegation, review workflow, audit trail
Attachments	Proof-of-delivery photos you attach to tasks	Evidence for your team's records
Device & push	Push notification tokens (FCM/APNs), platform (iOS/Android/Web)	Delivering task & review notifications to your devices
Preferences	Theme, background/FX settings, plan selections	Saved on your device (and synced to your profile where signed in)
Billing	Plan tier, entitlement status — processed by Stripe / RevenueCat / the app stores; we never see full card numbers	Subscriptions and seat limits

We do not collect location tracks, contacts, advertising identifiers, or behavioural profiles.

2. Where data is stored & who processes it

Supabase (database, auth, realtime) — primary region: Sydney, Australia.
Google Firebase Cloud Messaging and Apple Push Notification service — delivery of notifications. Tokens are device identifiers; payloads contain task titles you write.
Resend — transactional email (team invitations, magic links) from noreply@taskstamp.app.
Stripe / RevenueCat / Apple / Google — payment processing. Their handling is governed by their own policies.

Where an offshore transfer occurs (e.g. notification delivery networks), we take reasonable steps to handle it consistently with APP 8.

3. Retention

Active tasks — kept while your team keeps them.
History catalogue — Free plan: 30-day window; Pro/Scale: retained while subscribed, then 90 days after downgrade (read-only), after which records age out.
Push tokens — removed when they go stale, when you sign out, or on account deletion.
Account data — deleted immediately when you delete your account (see §5).

4. Your rights

You may request access to, or correction of, your personal information at any time (APPs 12–13). You can update your profile in-app (Settings → Profile), export your history (Pro), and delete your account entirely (next section). If you're in the EU/UK, equivalent GDPR rights apply (access, rectification, erasure, portability, objection).

5. Deleting your account

In-app (immediate — required by App Store guideline 5.1.1):
Settings → Cloud & Team → scroll to Danger zone → Delete my account → type DELETE to confirm. Your profile, tasks, history and push registrations are erased from our systems and every device straight away.

By email (processed within 7 days): write to privacy@taskstamp.app from your account email with the subject "Delete my account".

Team data shared with other members (e.g. tasks you assigned to them) is anonymised rather than removed from their records, so their audit trail stays intact. Teams where you are the only member are deleted entirely.

6. Security

Passwordless authentication (OTP/OAuth with PKCE) — no passwords stored.
Row Level Security on every table: rows are only readable/writable by members of the owning team, and only assign-capable roles can write tasks.
Encryption in transit (TLS) and at rest (Supabase managed).
Invite codes are 8-character Crockford codes, rate-limited, and revocable by team owners.

7. Children

TaskStamp is a workplace tool. It is not directed at children under 16, and we do not knowingly collect their data.

8. Changes

We'll post updates here and bump the effective date. Material changes will be flagged in-app for 30 days.

9. Contact & complaints

Privacy questions or complaints: privacy@taskstamp.app. We respond within 10 business days. If unresolved, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).