Privacy policy

Effective 21 October 2026 · Taskbead beta · Singapore

In short: Taskbead stores what you put into it (your tasks and everything attached to them) so it can show it to you and to the people you choose to share with. No ads, no selling, no third-party trackers. You can export or delete everything at any time.

Who runs Taskbead

Taskbead is operated from Singapore and is responsible for your data under Singapore's Personal Data Protection Act 2012 (PDPA). Contact, including for privacy questions, access or correction requests: send /feedback followed by your message to @TaskBeadBot, or use Feedback in the app's menu. We reply within 30 days.

What we store

What	Details
Your Telegram account	Your Telegram user id and first name, taken from Telegram's login each time you open the app, and a copy of your Telegram profile photo (made once, stored by us so your browser never loads it from Telegram). We do not store your username, last name or phone number.
Settings	Time zone, language (the one you pick, and the one Telegram or your browser reports), which bot messages you get (morning plan, evening and weekly recaps, reminders), theme, the workspace you last used, and whether you've started the bot chat. The link you first opened Taskbead from (for example an ad), to count which ads work.
Tasks	Title, notes, tags, due date, whether it's marked Important, colour, repeat rule, order, subtasks, workspace, who created it and who it's assigned to, and when it was created, finished or deleted.
Workspaces	Names, icons and colours.
Comments	Comments on tasks shared between you and a connection, with author and time.
Files and photos	Files you attach are sent by our bot into your own private chat with @TaskBeadBot and stored by Telegram. We keep Telegram's reference to the file, its name, type, size and a small preview image. If you haven't started the bot yet, small files (under about 900 KB) are stored in our database instead.
Messages you send or forward to the bot	The text or caption becomes a task. For a forwarded message we keep a short "from" note with the sender or chat name Telegram provides, and attach any photo or file as above.
Time tracking	Start and stop times of the tasks you work on (Now).
Connections and invites	Who you're connected with, where their tasks land for you, and your invite codes.
Feedback	What you send through Feedback or /feedback, including an optional screenshot.
Web login	If you use Taskbead in a browser: a hashed session token, your browser's user-agent string and the expiry date; one-time login codes for 10 minutes.
Email and Google sign-in	Only if you choose them: your email address (and for Google, Google's account id for you, your name and profile picture, copied once). Sign-in links are stored hashed and expire after 15 minutes. We ask Google only for your basic profile and email address.
Profile	The display name you choose and when you last changed it, and the profile picture you upload (cropped and re-encoded on your device, which removes location and camera data). Others you share tasks with see your name and picture.
Notifications	If you turn on browser notifications: the push address and keys your browser gives us, to send your reminders.
Technical records	Error reports (the error message with any quoted text removed, the app version and your user id) for 14 days. A daily activity mark (that you used Taskbead on a given date) for counting active users, deleted after 90 days; only totals are kept after that. Short-lived keys that prevent duplicate saves (7 days) and duplicate bot messages (3 days), and rate-limit counters.
On your device	A copy of your tasks and any changes not yet sent (so the app works offline), and your preferences. Clearing the app's site data removes them.

What we use it for

To run Taskbead: show your tasks, sync your devices, send the reminders and morning summary you turned on, and share what you choose with your connections.
To keep it working and safe: fixing errors, preventing abuse, and counting how many people use it (totals only, never task content).

We don't use your data for advertising, don't sell it, and don't use third-party analytics or trackers. The only cookies are the login cookies when you use Taskbead in a web browser.

Who can see it

You.
Your connections see tasks assigned between you (and their comments and files), any task you make Public, and only a count of your other tasks. Tags and colours are private to you.
The developer can access the database to run and fix the service, and looks at content only when needed to fix a problem you reported, or when required by law.
Service providers: Cloudflare (hosting, database and sign-in emails), Telegram (login, bot messages and file storage), Google (only if you sign in with Google) and your browser's push service (only if you turn on notifications; reminders are encrypted so it can't read them). They process data under their own terms; see Telegram's privacy policy.

Where it's stored

On Cloudflare's servers (Workers and the D1 database) in the United States (eastern North America), and with Telegram for messages and attachments. As this is outside Singapore, we rely on these providers' data protection commitments (for Cloudflare, its Data Processing Addendum) to give your data protection comparable to the PDPA.

How long we keep it

Your tasks and settings: until you delete them or your account.
Deleted tasks: permanently removed after 24 hours (so Undo can work).
Daily backups: kept for 30 days, so deleted data disappears from backups within 30 days.
Error reports 14 days; activity marks 90 days.
Messages and files in your chat with @TaskBeadBot stay in Telegram until you delete them there.

Your choices and rights

Export: Settings › Archive and export gives you a CSV of all your tasks.
Delete my data: Settings › Delete my data, or send /deleteme confirm to the bot. This immediately erases your tasks, comments, files we store, time logs, tags, workspaces, connections, feedback, sessions and settings. Tasks others assigned to you go back to them.
Morning summary: send /morning to turn it off.
Access and correction: ask via /feedback. You can also withdraw consent at any time by deleting your data.

Security

Every request is checked against Telegram's signed login or a hashed web session, and every task is checked against who may see it. Files are only downloaded through short-lived signed links. If a data breach is likely to harm you, we'll tell you through the bot and notify Singapore's PDPC as the law requires.

Children

Taskbead is made for people at work and isn't intended for children under 13.

Changes

We'll post changes on this page and tell you in the bot about important ones. The effective date at the top shows the latest version.