Category
Account
- What we collect
- First name, last name, email address, and a bcrypt-hashed password
- Retention
- Until you delete your account
Introduction
Overview
TidalTask ("TidalTask," "we," "us," or "our") is an ADHD-focused task management app developed by Daniel Wedding. This Privacy Policy explains what information we collect through the TidalTask web app, Progressive Web App, iOS app, and Android app (together, the "Service"), how we use it, who we share it with, and the choices you have.
By creating a TidalTask account or using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
This policy was last updated on July 6, 2026. If you have questions, contact us at [support@tidaltask.app](mailto:support@tidaltask.app).
Data we collect
Information we collect and how long we keep it
TidalTask collects only the information needed to run the app, keep your account secure, and support the features you choose to use.
Category
Tasks
- What we collect
- Title, description, due date, completion status, repeat schedule, reminder time, priority, group, tags, and assigned collaborators
- Retention
- Until the task or account is deleted
Category
Sessions
- What we collect
- A session token stored in an httpOnly cookie and your last login timestamp
- Retention
- 30 days, or until you log out
Category
Two-factor authentication
- What we collect
- An AES-256-GCM encrypted TOTP secret and hashed backup codes
- Retention
- Until 2FA is disabled or the account is deleted
Category
Passkeys
- What we collect
- WebAuthn credential ID, public key, device type, backup status, and transport hints
- Retention
- Until the passkey is removed or the account is deleted
Category
Device tokens
- What we collect
- A SHA-256 hash of Siri/API tokens, an expiry date, and a label
- Retention
- Until expired or the account is deleted
Category
API keys
- What we collect
- A SHA-256 hash of the key only; the raw value is never stored
- Retention
- Until revoked or the account is deleted
Category
Notifications
- What we collect
- Message title, body, type, scheduled time, and delivery time
- Retention
- Until the account is deleted
Category
Notification preferences
- What we collect
- Push settings, reminder cadence, summary schedule, and timezone offset
- Retention
- Until the account is deleted
Category
Reviews
- What we collect
- Star rating and an optional message
- Retention
- Kept indefinitely in anonymized form; the link to your account is removed on deletion
Category
OAuth clients
- What we collect
- Client name, redirect URIs, grant types, and scope
- Retention
- Until the client is removed
Category
Calendar export token
- What we collect
- A random token used to generate your calendar feed
- Retention
- Until regenerated or the account is deleted
Category
Announcement reads
- What we collect
- IDs of announcements you have viewed or clicked
- Retention
- Until the account is deleted
| Category | What we collect | Retention |
|---|---|---|
| Account | First name, last name, email address, and a bcrypt-hashed password | Until you delete your account |
| Tasks | Title, description, due date, completion status, repeat schedule, reminder time, priority, group, tags, and assigned collaborators | Until the task or account is deleted |
| Sessions | A session token stored in an httpOnly cookie and your last login timestamp | 30 days, or until you log out |
| Two-factor authentication | An AES-256-GCM encrypted TOTP secret and hashed backup codes | Until 2FA is disabled or the account is deleted |
| Passkeys | WebAuthn credential ID, public key, device type, backup status, and transport hints | Until the passkey is removed or the account is deleted |
| Device tokens | A SHA-256 hash of Siri/API tokens, an expiry date, and a label | Until expired or the account is deleted |
| API keys | A SHA-256 hash of the key only; the raw value is never stored | Until revoked or the account is deleted |
| Notifications | Message title, body, type, scheduled time, and delivery time | Until the account is deleted |
| Notification preferences | Push settings, reminder cadence, summary schedule, and timezone offset | Until the account is deleted |
| Reviews | Star rating and an optional message | Kept indefinitely in anonymized form; the link to your account is removed on deletion |
| OAuth clients | Client name, redirect URIs, grant types, and scope | Until the client is removed |
| Calendar export token | A random token used to generate your calendar feed | Until regenerated or the account is deleted |
| Announcement reads | IDs of announcements you have viewed or clicked | Until the account is deleted |
How we use data
How we use your information
We use the information above to:
- Create and maintain your TidalTask account
- Sync your tasks, routines, and preferences across web, iOS, and Android
- Send reminders, summaries, and other notifications you have enabled
- Authenticate you securely, including through passkeys, two-factor authentication, and API keys
- Provide optional integrations such as Siri Shortcuts, OAuth-connected apps, and calendar export
- Respond to support requests sent to support@tidaltask.app
- Maintain the security, integrity, and reliability of the Service
- Meet legal and regulatory obligations
We do not sell your personal information, and we do not use your tasks or account data to build third-party advertising profiles.
Third-party services
Services we share data with
We use a small number of providers to run the Service. We share only what each provider needs to do its job.
Service
Resend
- Purpose
- Sending transactional email, such as password resets and welcome messages
- Data shared
- Email address and name
Service
MongoDB Atlas / self-hosted database
- Purpose
- Storing all account and app data described above
- Data shared
- All data listed in the table above
Service
Apple APNs / Google FCM
- Purpose
- Delivering push notifications to your device via Capacitor
- Data shared
- Device push token
Service
Discord webhook
- Purpose
- Internal operational logging for the team
- Data shared
- User ID only — no name or email
| Service | Purpose | Data shared |
|---|---|---|
| Resend | Sending transactional email, such as password resets and welcome messages | Email address and name |
| MongoDB Atlas / self-hosted database | Storing all account and app data described above | All data listed in the table above |
| Apple APNs / Google FCM | Delivering push notifications to your device via Capacitor | Device push token |
| Discord webhook | Internal operational logging for the team | User ID only — no name or email |
Your rights
Your privacy rights
Wherever you are located, you have the following rights over your TidalTask data, and we have built in-app tools so you can exercise them yourself at any time:
- Access and export. Go to Settings → Export Data to download a full copy of your data as JSON. This covers the GDPR right of access (Article 15) and the CCPA right to know.
- Deletion. Go to Settings → Delete Account to permanently delete your account. This cascades to your tasks, sessions, passkeys, device tokens, notifications, and OAuth authorization codes. This covers the GDPR right to erasure (Article 17) and the CCPA right to delete.
- Correction. You can update your name and email at any time in Settings.
- Portability. The export described above is provided in a structured, machine-readable JSON format covering every field described in this policy.
If you would rather make one of these requests by email, contact us at [support@tidaltask.app](mailto:support@tidaltask.app) and we will respond within 30 days.
Security
How we protect your data
We apply the following technical safeguards to the data described in this policy:
- Passwords are hashed with bcrypt (cost factor 10) — we never store passwords in plain text
- Two-factor authentication secrets are encrypted at rest with AES-256-GCM
- API keys are stored only as SHA-256 hashes; the raw key is shown to you once and cannot be recovered afterward
- Session cookies are set as httpOnly, secure, and sameSite: lax
- All traffic is served over HTTPS, with HTTP Strict Transport Security (HSTS) enforced for one year
- Login attempts are rate-limited to 20 failed attempts per 15 minutes to slow down credential-stuffing and brute-force attacks
No method of storage or transmission is perfectly secure, but these measures reflect current good practice for an app handling personal task and account data.
More information
Retention, children’s privacy, and changes
Data retention. We keep each category of data for as long as described in the table above — generally for as long as your account is active, plus a limited period for sessions and security logs. When you delete your account, associated data is deleted or, in the case of anonymized reviews, disconnected from your identity.
Children's privacy. TidalTask is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at support@tidaltask.app and we will delete it.
International users. TidalTask is operated from the United States, and your data is processed and stored on infrastructure governed under the laws of the State of Texas, regardless of where you access the Service from.
Changes to this policy. We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice. Continued use of the Service after a change takes effect means you accept the updated policy.
Contact us. Questions about this policy or your data can be sent to [support@tidaltask.app](mailto:support@tidaltask.app).
Related pages
Keep exploring
Page
Terms of Service
Read the TidalTask Terms of Service covering accounts, acceptable use, API keys and integrations, termination, disclaimers, and governing law.
Read moreAbout
About TidalTask
Learn what TidalTask is trying to build: an ADHD-friendly planning app focused on quick capture, flexible routines, and clarity without guilt.
Read moreFAQ
FAQ
Read the TidalTask FAQ to learn who it is for, how it fits ADHD planning needs, and how it differs from generic task apps.
Read moreFAQ
Common questions
Does TidalTask sell my data?
No. TidalTask does not sell personal information. Data is shared only with the service providers listed above, strictly to operate the app.
How do I delete all of my data?
Go to Settings → Delete Account in the app. This immediately and permanently deletes your tasks, sessions, passkeys, device tokens, notifications, and OAuth codes.
Where is my data stored?
Your data is stored in MongoDB Atlas or a self-hosted MongoDB instance, governed under the laws of the State of Texas.
Next step
Questions about your data?
Reach out any time — we are happy to walk through what TidalTask stores and why.