Privacy Policy
Last updated: October 18, 2026
This policy explains what data KyroTask collects, why we collect it, and the choices you have. It covers the KyroTask application and this website. Data controller: KyroTask (contact: [email protected]).
Data we collect
Your account details (name, email, and a password stored in irreversibly hashed form), the content your team creates (projects, tasks, comments, attachments, and time logs), preferences such as language and theme, and server access logs (IP address and timestamp) collected automatically for network security and legal compliance. To prevent abuse, we also record the IP address of the account that creates a QR code or changes a QR code's destination URL. When you submit an abuse report, an irreversible keyed digest of your network address and browser is recorded to prevent duplicate submissions; your raw IP address is not stored with the report.
Payment data
Subscription payments are processed by Paddle. Your card number never touches our servers; we only store the subscription status and invoicing metadata the processor returns.
QR scan analytics
When someone scans a QR code you created, we record only a derived device type (mobile, tablet, desktop) and an approximate country or city. We deliberately store no IP address and no raw browser data about the person scanning.
How we use data
To provide and improve the service, send the notifications you enable, respond to support requests, and maintain network integrity. We do not sell your data or share it with advertisers.
Cookies & local storage
We use local storage for your session, language, and theme preferences. We do not use third-party advertising trackers. Cloudflare, which sits in front of the site, counts visits for us without cookies or local storage (page views, referring site, country, device and browser type, page speed); this measurement does not build a profile of you.
Third-party services
We rely on the Paddle payment processor, an email delivery provider, Cloudflare, and Backblaze. All traffic to the site passes through Cloudflare's network (DNS, content delivery, attack protection, the bot shield on the registration form, and cookieless visit statistics): your browser's encrypted connection ends at the Cloudflare server nearest to you and is forwarded to our server encrypted again. Backup copies of the database and files are encrypted on our server before being stored in Backblaze B2 (EU); Backblaze cannot read the contents of those copies. If you sign in with Google, your identity is verified by Google. If you connect an integration such as Slack, its credentials are encrypted at rest. These providers' servers may be located outside your country; where that happens, your data is transferred only with appropriate safeguards, such as Standard Contractual Clauses (SCC) and applicable cross-border transfer mechanisms under the GDPR.
Security & access logs
Two-factor authentication, role-based access control, and encryption of integration secrets and uploaded files protect your workspace. Server access logs (including IP addresses) are retained solely for system security, abuse prevention, network integrity, and compliance with applicable statutory obligations under GDPR Recital 49 and relevant regulations.
Retention & deletion
We keep your data while your account is active. When you request deletion, your account locks immediately and your data is permanently anonymized after a 14-day grace window; you can cancel the deletion by signing in during that window. QR abuse-audit records (the account that created or retargeted a code, with its IP address) are retained for security and legal defense even after an account is closed. The reporter digest on abuse reports is cleared after 30 days.
Your rights (GDPR)
You can request access to, correction of, or deletion of your personal data, and information about its recipients, at any time. You can also download your data and delete your account yourself from Settings → Data & Privacy, or write to [email protected]; requests are answered within 30 days at the latest, in line with the GDPR and applicable data protection regulations.
Changes to this policy
If we make material changes, we will update the date above and notify account owners by email.
Questions about privacy? Write to [email protected].