1. Data I Collect

1.1 Task Data

All tasks, notes, subtasks, and completion history are stored locally on your Mac in the app's sandboxed container. PopTask does not upload, sync, or transmit your task data to any external server, except when you explicitly enable a third-party integration (see Section 3).

1.2 Voice Input

On macOS 26 or later with Apple Silicon, voice input is processed entirely on your device using Apple's Foundation Models. No audio or transcribed text is sent to any server.

On earlier macOS versions, voice input uses Apple's built-in on-device speech recognition framework (SFSpeechRecognizer). Audio is processed locally on your Mac. Apple may process some audio according to Apple's own privacy policy depending on your system settings, but PopTask itself does not transmit any audio data.

1.3 AI Features

On macOS 26 or later with Apple Silicon, AI features (smart suggestions, title cleanup, task breakdown, follow-up suggestions) run entirely on your device using Apple's Foundation Models. No task text leaves your Mac.

On earlier macOS versions, task text is sent to the PopTask cloud service at api.poptask.bar for processing. All requests are transmitted over HTTPS (TLS 1.2+). The service processes the request in memory and returns a result. No task text, personal data, or request content is logged, stored, or retained on the server after the response is delivered. The server is hosted in the United States.

1.4 Purchase Information

PopTask uses Apple's StoreKit framework for in-app purchases and subscriptions. All payment processing is handled entirely by Apple. PopTask does not collect, store, or have access to your payment information, credit card details, or Apple ID.

1.5 Analytics and Tracking

PopTask does not include any third-party analytics, advertising, or tracking frameworks. I do not collect usage statistics, behavioral data, or device fingerprints. PopTask participates in Apple's standard crash reporting through Xcode and App Store Connect. If you have enabled "Share with App Developers" in your macOS settings, Apple may share anonymized crash logs with me. These logs do not contain task content, personal data, or identifiable information.

---

2. Data Storage

All app data is stored locally within the app's sandboxed container on your Mac. This includes tasks, settings, completion history, and preferences. PopTask does not use iCloud sync or any cloud storage service for task data.

---

3. Third-Party Integrations

PopTask offers optional integrations that you can enable in Settings. No integration is enabled by default. You must explicitly turn on each one. These integrations sync task data with third-party services:

Apple Reminders

When enabled, tasks are synced with the Apple Reminders app on your device using EventKit. Data stays within the Apple ecosystem and is governed by Apple's privacy policy.

Apple Calendar

When enabled, tasks with due dates are added to your Apple Calendar using EventKit. Data stays within the Apple ecosystem and is governed by Apple's privacy policy.

Google Calendar

When enabled, tasks are synced with your Google Calendar account via the Google Calendar API. This requires OAuth 2.0 authentication with your Google account. PopTask displays an in-app disclosure before your first Google sign-in explaining what data will be accessed and how it will be used. See Section 4 below for full details on how PopTask accesses, uses, stores, and shares Google user data.

Microsoft Calendar and Teams (Coming Soon)

PopTask plans to offer optional sync with Microsoft Outlook Calendar and Microsoft Teams Calendar in a future update. When available, this integration will use the Microsoft Graph API with OAuth 2.0 authentication. This privacy policy will be updated with full details before the integration launches. No Microsoft account data is currently collected or accessed.

---

4. Google User Data Disclosure

PopTask's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.1 Scopes Requested

When you connect your Google account, PopTask requests access to the following OAuth 2.0 scopes:

https://www.googleapis.com/auth/calendar — Read and write access to your Google Calendar. PopTask reads your calendar event list to check for existing synced tasks and writes new calendar events when you create tasks with due dates. PopTask also updates and deletes events when you modify or complete tasks.

https://www.googleapis.com/auth/userinfo.email — Read access to your email address. Used solely to display which Google account is connected in the app's Settings screen. Your email address is not stored on any server or transmitted anywhere beyond the initial API response to your device.

4.2 Data Usage

Google Calendar data is used exclusively to sync your PopTask tasks as Google Calendar events. Specifically, PopTask creates, updates, and deletes calendar events that correspond to your tasks. Task titles, due dates, due times, and notes are transmitted to Google's Calendar API for this purpose.

No Google user data is used for advertising, analytics, market research, or any purpose other than providing the calendar sync feature you enabled.

4.3 Data Sharing

PopTask does not share Google user data with any third parties. Your Google Calendar data is transmitted only between your device and Google's servers via the official Google Calendar API. No intermediary servers, analytics services, or other third-party services receive or process your Google user data. PopTask does not sell, rent, or disclose Google user data to anyone.

4.4 Data Storage

Google OAuth tokens (access token and refresh token) are stored locally on your Mac in the macOS Keychain, encrypted and sandboxed to PopTask. Your connected email address is stored locally in the app's preferences. No Google user data is stored on any PopTask server.

4.5 Data Deletion

You can disconnect your Google account at any time by going to PopTask Settings and clicking "Disconnect Google Calendar." This immediately deletes all stored OAuth tokens from your device's Keychain, removes the stored email address, and stops all calendar sync activity. After disconnection, PopTask retains no Google user data.

Uninstalling PopTask also removes all locally stored data, including any Google OAuth tokens and cached email, from your Mac.

You can also revoke PopTask's access to your Google account at any time by visiting Google Account Permissions.

---

5. Siri and Shortcuts

PopTask supports Siri and Apple Shortcuts for adding and managing tasks. Siri interactions are processed by Apple according to Apple's privacy policy. PopTask donates task actions to the Shortcuts framework but does not send any additional data to Apple beyond what is required for Shortcuts functionality.

---

6. Data Retention

Since all data is stored locally, your data exists only on your Mac. Deleting the app removes all associated data, including tasks, preferences, OAuth tokens, and cached settings. PopTask does not retain any user data on external servers.

When AI features use the PopTask cloud service on older macOS versions, the task text is processed in memory only. No data is logged, cached, or retained on the server after the response is sent to your device.

---

7. Your Rights

7.1 Access and Deletion

Because PopTask stores all data locally on your Mac, you have full control over your data at all times. You can view, edit, or delete any task directly in the app. Uninstalling PopTask permanently deletes all app data from your device.

7.2 European Economic Area (GDPR)

If you are located in the European Economic Area, you have the right to access, correct, delete, or export your personal data. Since PopTask stores all data locally on your device and does not maintain any user accounts or server-side databases, your data is already under your full control. The legal basis for any processing (such as cloud AI on older macOS versions) is your explicit consent when you choose to use the feature. You may contact me at the address below with any data-related requests.

7.3 California (CCPA)

If you are a California resident, you have the right to know what personal information is collected, request its deletion, and opt out of any sale. PopTask does not sell, share, or disclose personal information to third parties for commercial purposes. PopTask does not maintain server-side user profiles or databases. You may contact me at the address below to exercise your rights.

---

8. Children's Privacy

PopTask does not knowingly collect personal information from children under the age of 13 (or the applicable minimum age in your jurisdiction, such as 16 in certain EU member states). The app does not require account creation or personal information to function. If you believe a child has provided personal data through a third-party integration, please contact me and I will take steps to delete it.

---

9. Changes to This Policy

I may update this privacy policy from time to time. Any changes will be reflected on this page with an updated effective date at the top. Continued use of PopTask after changes constitutes acceptance of the updated policy. For significant changes, I will update the effective date and, when possible, note what changed.

---

10. Contact