Privacy · taskical.app/privacy

Your app data stays yours. Here’s how the website works, too.

Events and remindersTaskical reads and updates calendars and reminders in your existing macOS accounts through Apple’s EventKit, with your permission. It does not create a separate calendar-content database or mirror your calendar or reminders on a Taskical server.
Contacts and invitationsWith permission, Taskical reads Contacts to help you select invitees and display attendee names and photos. It does not bulk upload your address book. The invitation addresses you select are sent to the calendar provider when you approve an invitation change.
Optional provider connectionsOptional Google, Microsoft and iCloud connections send the invitation changes and replies you review directly to the provider. External iCloud replies can use Apple’s SMTP service with an app-specific password after your review. Provider OAuth tokens and app passwords are stored in your Mac’s Keychain.
What stays on your MacTaskical retains local settings, calendar-set and connection references, and a hashed reply-attempt journal that helps prevent duplicate iCloud replies. These settings and references are not erased simply by quitting the app.
Optional iCloud settings syncYou can enable iCloud sync for supported appearance preferences and calendar sets. Keyboard shortcuts, connection credentials and default destinations do not sync through this feature.
Location remindersLocation-based reminders use Apple’s reminder alarms. Taskical does not track your location; Apple’s reminders services handle the alert.
Feedback and diagnosticsWhen you send feedback, we receive its type, summary, message, any email address you supply, and the app version. If you choose to include native-app diagnostics, the app adds them as text to your message: app/build/macOS versions, the calendar view and whether the workspace uses sample or live data. These generated diagnostics contain no event titles, reminder text, names or account addresses. The message you write may contain personal information, so review it before sending.
Optional screenshotsIf you choose to include screenshots with native-app feedback, they open in your email draft for you to review and send. Screenshots may contain calendar details or personal information. Review or remove them before sending; they are not uploaded through the feedback API.
PurchasesTaskical verifies purchases on your Mac using Apple’s StoreKit. The developer does not receive your payment-card information. The free trial requires an explicit zero-price purchase and does not automatically charge you for the permanent unlock.
Native app trackingThe native Mac app contains no advertising or tracking SDK. Optional website analytics and administrator sign-in are described separately below.

Google API data and Limited Use

Taskical’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and, for Google Workspace data, the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Google API data is used to provide the features you authorize: reviewed Google calendar invitation changes and replies in the Mac app, administrator sign-in, and the website owner’s Analytics connection and reports. Native calendar operations communicate directly with Google; Taskical’s website does not receive a server-side copy of your Google calendar. Native Google credentials stay in your Mac’s Keychain. Content you choose to send for support is handled as described below.

We will not sell Google API data, use it for advertising or credit decisions, or use it to train general-purpose AI or machine-learning models. Transfers are limited to delivering the authorized features with your consent, security needs or legal requirements. Human access to Google API data is limited to specific data you agree to share, necessary security or legal handling, or aggregated and anonymized information for internal operations. These limits also apply to people working on Taskical’s behalf.

Website, feedback & admin accounts

Taskical is developed by Imran Mughal. The native-app practices above are separate from this website. Feedback sent from the website or app is retained in a private review queue, including your message, supplied email, app version, optional diagnostics and our notes and replies. Approved collaborators can review feedback and organize future work. If you supply an email address, our email provider processes replies sent to you.

Screenshots are not accepted by the feedback API. Screenshots you review and send through your email app are received in the support mailbox with your email message and sender details, and may contain calendar or other personal information.

We count website page requests by day, page and broad device category. These aggregate counts include automated traffic and contain no IP address or visitor identifier. The server and HTTPS proxy process connection information such as your IP address and request headers. Feedback rate limiting uses an IP-derived hash held temporarily in memory. Routine proxy access logging is disabled, but technical error logs can retain client IP addresses and request details when errors occur.

Google Analytics loads automatically on public website pages. Google receives usage and device information and uses analytics cookies to measure visits. We configure clean page addresses without query strings and do not include feedback text or email addresses in analytics events. The feedback page and admin workspace do not load Analytics. Website analytics does not enable tracking in the native Mac app.

Administrator sign-in uses Google and Better Auth. We store the administrator’s name, verified email, Google profile-image URL when supplied, account identifiers, approval status and session records, which can include IP address and browser user-agent information. Essential cookies maintain sign-in. Only the owner can approve or revoke workspace access. Google integration tokens are encrypted at rest.

Website owner’s Google Analytics connection

Separately from public website analytics, the owner can authorize Analytics read and edit access in the admin workspace. Taskical reads accessible Analytics account, property and web-stream names and identifiers to find or create the website’s connection. At the owner’s request it can create a property and web stream, or connect an existing stream, and turn off enhanced automatic measurement. This authorization does not give the website access to native users’ calendars or Gmail messages.

We retain the connected account, property, stream and measurement identifiers in the server database. The server requests aggregate users, sessions, page views, engagement, daily counts and traffic-channel reports from Google, and caches the results in server memory until they are replaced or the server process stops. Approved collaborators can view these reports in the dashboard; only the owner can manage the connection. Visitor page views are configured without Google Signals or advertising-personalization signals, and no native feedback content is added to these reports.

You can revoke Taskical’s Google authorization through your Google Account connections. Revoking authorization prevents further authorized API access; it does not automatically erase data already retained by Taskical or Google. Contact us below to request deletion of Taskical’s retained records.

Retention and deletion requests

Feedback, replies and support email are retained for support and planning; they do not expire automatically. Closing a feedback item changes its status and does not delete it. Server backups may also retain copies. There is no self-service deletion control. To request deletion of your feedback or account data, use our feedback form, choose Question, and include your feedback reference if you have one. We review requests manually, including the records and backup copies involved.

Updated September 18, 2026. Questions? Contact us through the feedback form.