Privacy Policy

1. Introduction

Dispatch ("we," "us," or "the app") operates taskdispatch.app, an AI-powered task management web application. This Privacy Policy explains what information we collect, how we use it, and your rights regarding it.

2. Information We Collect

We collect only what is necessary to provide the service:

• Account information: your email address, display name, and a bcrypt-hashed password. We never store your plain-text password.
• Task data: task names, categories, notes, due dates, subtasks, and any other content you enter.
• Usage metadata: timestamps of task creation and modification, login timestamps, and task history logs.
• Email preferences: whether you have opted into morning reminders and the address to send them to.
• Push notification subscriptions: browser endpoint and encryption keys, stored solely to deliver push notifications you explicitly enable.
• Timezone: your IANA timezone preference for scheduling reminders and calendar feeds.

3. How We Use Your Information

• To provide and operate the task management service.
• To send optional morning briefing emails and push notifications if you opt in.
• To generate a personal iCalendar (.ics) feed of your tasks if you enable it.
• To run a nightly automated backup (admin use only — your data is not shared).
• To use Google Gemini AI to parse the natural-language text you type or speak in the Dispatch bar. Only the command text is sent to Google's API — no account information, email, or task history is included in those requests.

4. Data Sharing

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes. The only third-party service that processes any portion of your data is Google Gemini API, which parses the text of dispatch commands. This is subject to Google's Privacy Policy and API terms.

5. Data Storage and Security

Task data is stored in a PostgreSQL database hosted on Railway (US-based infrastructure). We implement the following security controls:

• HTTPS-only connections — all traffic is encrypted in transit
• CSRF token protection on all state-changing API requests
• Rate limiting on all endpoints (backed by Redis in production)
• Per-user export tokens — no shared global credentials
• Passwords stored as bcrypt hashes — never in plain text
• Security headers: X-Frame-Options, X-Content-Type-Options, Content Security Policy, Referrer Policy
• Email verification required for account activation

6. Not a HIPAA-Covered Service

Dispatch is a general-purpose task management application and is not a HIPAA-covered entity or business associate. Do not use Dispatch to store Protected Health Information (PHI) as defined under HIPAA — including medical records, clinical notes, diagnoses, treatment plans, or any individually identifiable health information. While you may use a "Health" category for personal wellness reminders (e.g., "Schedule dentist appointment"), the app does not provide HIPAA-compliant data storage and must not be used for PHI.

7. Your Rights

• Access: You can export your tasks at any time via your personal export token in Settings.
• Correction: You can edit any task or account data directly in the app.
• Deletion: To delete your account and all associated data, contact us at the address below. We will process deletion requests within 30 days.
• Portability: Your tasks can be exported as JSON via your personal export URL.

8. Cookies and Sessions

We use a single session cookie to maintain your login state. This cookie is HttpOnly, SameSite=Lax, and Secure (HTTPS-only in production). We do not use tracking cookies, third-party analytics, or advertising cookies.

9. Children's Privacy

Dispatch is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be noted by an updated "Last updated" date. Continued use of Dispatch after changes constitutes acceptance.

11. Contact

Questions or requests? Email: support@taskdispatch.app