FlowTask Privacy Policy
BoostOS (“we”, “us”, or “our”) operates the FlowTask application (the “Service”). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.
1. Information We Collect
When you create an account we collect your email address and display name via your authentication provider. When you connect third-party services we store the following:
- Notion — an OAuth access token and the workspace name so we can read and update your task database on your behalf.
- Google Calendar — an OAuth access token and refresh token, and the email address of the Google account you connect. We read your calendar list and events to find free time, and we create, update and delete the calendar events for tasks you schedule in FlowTask, including removing them when a task is completed or unscheduled.
- Microsoft Outlook Calendar — an OAuth access token and refresh token, and the email address of the Microsoft account you connect, used in the same way as Google Calendar.
- Fathom and Granola — the API key you paste in Settings, stored server-side like the OAuth tokens. We use it to read the action items from your recorded meetings and offer them as suggested tasks in the Meetings inbox. For each suggestion we keep the meeting’s title, date and link, the action item, and any assignee, client, priority or due date found with it.
- FlowTask Meetings desktop app — if you use it, it sends us only the action items it found in a meeting, each with a short quote from where it was said, never the audio or the full transcript. They appear in the same Meetings inbox.
- Teams — if you create or join a team: its name, your name on it (what teammates see as the assignee) and your role; the tasks the team shares (title, notes, dates, status, priority, duration, client, tags and sub-tasks, and who created or last changed each one and when); and your own schedule for those tasks (when you booked them, and your calendar event ids), which only you can see. Everyone on a team can see its members’ names and roles and all of its tasks. Owners and admins can also see the team’s open invitations: the invited email address, the role offered and when the link expires.
- Subscriptions — if you start a plan: which plan, its status, the trial and renewal dates, the number of team members it covers, and the customer and subscription references Stripe gives us. Your card and billing details are entered on Stripe’s own pages and never reach us. To keep free trials to one per person and plan, we also record that you have had one, against your account id and a one-way hash of your email address (from which the address can’t be read back).
We store your tasks (title, notes, dates, status, priority, duration, client, assignee and subtasks) so they stay in sync across your devices, and your scheduling preferences (working hours, buffer time, preferred days) so the auto-scheduler can place tasks at convenient times.
Some information stays only on your device, in your browser’s storage: your focus-session history, the tasks you recently opened, and display preferences such as the appearance and the calendar layout. Signing out or deleting your account clears it, apart from the appearance and sound settings, which say nothing about you.
2. How We Use Your Information
We use the data we collect solely to provide and improve the Service:
- Synchronise tasks between Notion and FlowTask.
- Display your Google or Outlook calendar events alongside your tasks.
- Create, move and remove calendar events for the tasks you schedule.
- Turn action items from your Fathom or Granola meetings into suggested tasks.
- Auto-schedule tasks around your existing calendar commitments.
- Let the people on a team see and update the tasks it shares, and let you invite people to a team with a link.
- Start, manage and end subscriptions, and decide whether a person or a team can use the paid features.
- Authenticate you and keep your session secure.
3. Data Storage and Security
Your data is stored in a Supabase-hosted PostgreSQL database with Row Level Security enabled — each person can only access their own records and the shared records of the teams they belong to. OAuth tokens and API keys are stored server-side and are never exposed to the browser. All communication between the app and our servers uses HTTPS.
4. Third-Party Services
We integrate with the following third-party services, each governed by their own privacy policies:
- Supabase (authentication and database hosting)
- Notion API (task synchronisation)
- Google Calendar API (calendar integration)
- Microsoft Graph API (Outlook Calendar integration)
- Fathom API and Granola API (meeting action items)
- Stripe (payments and subscriptions: it collects and holds your card and billing details and keeps the payment and invoice records the law requires; we receive only the plan, its status and dates)
- Vercel (application hosting)
- Sentry (error reporting, when enabled: technical details about errors in the app, configured not to collect cookies or other personal information)
We do not sell, trade, or otherwise transfer your personal information to outside parties. We do not use your data for advertising.
5. Data Retention and Deletion
We retain your data for as long as your account is active. You can disconnect any integration at any time from the Settings screen, which immediately deletes the associated tokens.
You can delete your account at any time in Settings, under Account. This immediately and permanently deletes your account, your tasks, your settings, your meeting suggestions, and the tokens and API keys for every service you connected. FlowTask also revokes its access to your Google Calendar and Notion. Outlook, Fathom, Granola and Sign in with Apple don’t let us revoke access on your behalf, so the app shows you where to remove it yourself. If you also use another BoostOS service with the same sign-in, your sign-in itself stays for that service; everything FlowTask stored is still deleted.
Teams. Leaving a team, or being removed from it, deletes your membership and your own schedule for its tasks. The tasks you created stay with the team, shown as made by nobody, and any open tasks assigned to you become unassigned. When you delete your account and you own a team with other people in it, ownership passes to its longest-standing admin or, if there is none, to the member who joined first, and the team carries on. If you are the only person on a team you own, the team and its tasks are deleted with your account.
Subscriptions. Deleting your account first cancels your subscription, and the subscription of any team that is deleted with it, so nothing is charged afterwards. Stripe keeps the payment and invoice records it is required to keep, and we cannot delete those; we keep no card details. If you paid for a team that carries on without you, your card is removed from it and the team is asked to add its own before the next renewal. Deleting your account does not delete the record of a free trial described above, which is kept, as the account id and the hashed email only, so that a trial can’t be claimed again by deleting an account and starting over.
Deleting your FlowTask account does not delete your Notion pages or your calendar events: those are yours, in your own accounts. Copies of your data in our database provider’s backups are removed as those backups expire. You can also ask us to delete your account by writing to hello@boostos.pt.
6. Your Rights
Depending on your jurisdiction you may have the right to access, correct, or delete the personal data we hold about you. You may also have the right to restrict or object to our processing of your data. To exercise any of these rights, please contact us at hello@boostos.pt.
7. Google API Services User Data Policy
FlowTask’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We request only the scopes these features need: calendar.events, to read your events and to create, update and delete the events for tasks you schedule; calendar.calendarlist.readonly, to list your calendars so you can choose which ones FlowTask considers; and userinfo.email, to show which Google account is connected. We do not use Google data for advertising or transfer it to third parties.
8. Children’s Privacy
Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “effective date” above. You are advised to review this page periodically.
10. Contact Us
If you have any questions about this Privacy Policy, please contact us at hello@boostos.pt.