Privacy Policy
Effective 18 October 2026. This notice explains how Daily Task 1 operates as a private task checklist. Please review it before entering sensitive content.
Information collected and purpose
We process your account identifier, password-verification metadata, recovery-verification metadata, encrypted key envelopes, authenticated session records, pseudonymous rate-limit keys and encrypted task-change events. Your task titles, selected dates and completion states are encrypted on your device before upload to Cloudflare D1. We process these items for authentication, synchronization and abuse prevention.
Storage and service providers
Cloudflare Pages serves the website and API; Cloudflare D1 holds authorization records and encrypted event ciphertext. The browser’s IndexedDB contains encrypted task events and the locally PIN-wrapped encryption key. Preferences such as theme and language are saved in localStorage. Cloudflare, your browser and network provider may handle ordinary diagnostic, IP and request metadata under their own policies. No Google account or Google Drive integration is used.
Cookies and security
One HttpOnly, Secure, SameSite=Strict session cookie is used on API requests. Password checks occur over an HTTPS connection; the server temporarily processes submitted credentials for verification, but does not persist plaintext passwords. AES-GCM protects task events at rest when implemented and configured correctly. A short numeric PIN provides convenience, not equivalent protection to a strong account password against someone with access to copied device storage.
Backups and recovery
Optional backups are encrypted locally with a separate user-chosen passphrase and downloaded through your browser. The operator does not automatically receive your backup file or passphrase. The one-time recovery code permits account password replacement only while its encrypted-key wrap remains valid. The recovery code must be kept off-device.
Sharing and access
This product does not sell task data, embed advertising scripts or intentionally share plaintext task content with third parties. Infrastructure providers necessarily process technical metadata to operate the service. Account access depends on your credentials and sessions.
Retention, access and deletion
D1 encrypted events and account records remain until the owner/operator deliberately deletes them; individual task deletions produce encrypted tombstones and are not immediate D1 erasure. Expired session records may remain until administrative cleanup, although invalid sessions cannot authenticate. You may export your decrypted content using Export Full Data. To request an account-level erasure or ask privacy questions, use the Contact page. Browser-stored data can be cleared using browser controls, but this does not itself remove D1 records.
Security limits and rights
No browser, provider or encryption scheme ensures zero risk or perpetual retention. Browser storage can be purged; passwords and recovery materials can be lost; compromised devices can expose content after unlock. Privacy and access rights vary by jurisdiction; requests will be reviewed under applicable law. Service-provider data may be processed internationally.
Changes
Updates to these practices will be reflected here with a revised date. No commercial compliance certification is claimed.