Privacy Policy

Last updated: 3 November 2026

1. Who we are

Taskriz is provided by Appeggio.com Trading Pty Ltd (ABN 33 638 342 748, 14 Horne Street, Sunbury VIC 3429, Australia) (“Appeggio”, “we”, “us”). This policy explains what information Taskriz handles, why, and the choices you have. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What we collect

• Your account: your email address, name and password (stored only as a secure hash), and your Profiles and their settings.
• Recovery passphrase (if you set one): your Profile’s private key, locked on your device with a passphrase you choose. We keep it, encrypted again when stored, so you can get your key back on a new device or browser. The passphrase never leaves your device, so we can’t open it. If you choose your own passphrase, your device checks it against Have I Been Pwned’s list of passwords exposed in data breaches by sending only the first 5 characters of a one-way hash of it, never the passphrase. Turning it off, starting fresh or closing your account deletes it.
• Browser notifications (if you turn them on): your browser gets a push address from its maker’s push service — Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari — and gives it to us. When an Agent sends you a request, we send a short notice to that browser naming only the Agent; it is encrypted so the push service can’t read it, and the request itself stays sealed to your devices. You can turn them off in Settings → Notifications or in your browser. We forget the address when you turn them off, sign out in that browser, or close your account.
• Guest accounts: if a business sends a request to someone without a Taskriz account, we create a guest account when they open it — with one tap on the first device they use, or with a one-time code we email or text them on another device or when the business asks for one. It holds their email address, mobile number or both, their Profile and the public key their browser makes. A guest account has no password.
• Mobile numbers: those you add to a Profile for text messages, once confirmed, and the number a business sends you a request at by text.
• Payments: if you choose a paid plan, you pay through Stripe, which collects your card details (we never see or store them) and, for invoices, your business name and tax ID. We keep your plan, its status and Stripe’s customer reference for your account.
• Agents and connections: the Agents in your account, who is paired with them, invitations sent, and the public keys used to seal requests.
• Connected Apps: each app or AI tool you allow to act for you (listed under Connected Apps, where you can remove it) — its name, the Profile it acts for, and when it was allowed and last used.
• Requests and responses: see section 3.
• Attachments: files sent with requests or replies.
• The home page demo: a request you type into the demo on our home page is sent to Amazon Bedrock (an AI service run by Amazon Web Services) to design its interface. The result is kept for up to a week, so the same request can be shown again; what you typed is not stored in our logs, and nothing is sent to anyone.
• Requests Taskriz designs: when you use Ask Someone, or your Agent sends questions in plain words through our API, what you wrote is sent to Amazon Bedrock (an AI service run by Amazon Web Services) to design the request. What you wrote is not stored in our logs, and the request that is sent is encrypted to the people it is for, as every request is. For questions an Agent sends in plain words, the questions are also kept, encrypted, for up to 30 days, so the answers can be matched to them.
• Technical information: IP addresses, device and browser details (in the apps, the device model, operating system and app version), and logs of activity, used for security, limits and fixing problems.
• Cookies, on the web: a session cookie set by our server keeps you signed in. It holds only a random session identifier (we keep only a scrambled form of it), and it is locked down: the page’s scripts can’t read it (HttpOnly), it is sent only over encrypted connections (Secure), and only to Taskriz itself (SameSite=Strict, a “__Host-” cookie). A signed-in session lasts 30 days from your last visit, and at most 90 days; before you sign in, the same cookie lasts an hour and protects the sign-in forms. Signing out ends it. A second cookie, also set by our servers, holds only the country your connection comes from (worked out from your IP address), so the site knows whether to ask you before using analytics cookies; it lasts a day. We use no advertising cookies.
• Website analytics: on our public website — the site’s pages, and the home page while you are signed out — we use Google Analytics only to see which pages people visit and where they are from. It sets its own cookies (named _ga), and your browser sends Google the address of the page, your browser’s details and your IP address, which Google uses to work out roughly where you are. Google Analytics isn’t used in the signed-in app, in the Taskriz apps for iPhone and Android, or for advertising. If you are in the European Economic Area, the United Kingdom or Switzerland, we ask first, and Google Analytics is loaded only if you accept; you can change your choice at any time with Cookie Settings at the foot of the site’s pages.

If you don’t give us the information we ask for, we may not be able to provide Taskriz, or some of it, to you.

The Taskriz apps for iPhone and Android

• On your device: the app keeps your sign-in and your Profile’s private key on the device — in the iPhone’s Keychain or Android’s secure storage. The key never leaves the device unless it is sealed for another of your own devices when you link one, or locked with your recovery passphrase if you set one (section 2).
• Camera, photos and files: the app uses the camera, your photo library or your files only when you choose to attach one to a request that asks for it. Only what you choose is uploaded, and it is handled like any other attachment (section 3).
• Contacts: when you use Choose from Contacts in Ask Someone, the app reads only the contact you pick (on Android, after you allow access to your contacts) to fill in their name, email and mobile. Nothing else in your contacts is read or uploaded. What you save is kept in your account’s Contacts until you delete it or close your account.
• Notifications: if you allow notifications, the app gets a push notification address for your phone — on Android from Google’s Firebase Cloud Messaging, on iPhone from Apple’s Push Notification service — and gives it to us. When an Agent sends you a request, we send a short notification for your phone, through Google or Apple, that names only the Agent — for example, “Acme Billing sent you a request” — never the request itself, which stays sealed to your devices. You can turn these off in Settings → Notifications (App), or in your phone’s settings. We forget your phone’s address when you sign out, remove the app, or close your account.
• Nothing else: apart from delivering notifications (above), the apps contain no third-party analytics or advertising, and don’t track you across other apps or websites.

Website Chat on a business’s website

A business can put a Taskriz chat on its own website (Website Chat). If you use one, you don’t need an account, and this is what happens to what you give it:

• The business is responsible for your details. The business decides what its chat asks for and uses what you send it, under its own privacy policy. Taskriz handles your details for the business, only to design the chat’s form and deliver what you send. To see, correct or delete what a business holds about you, contact the business; we will help with anything we hold.
• What you type: what you type is sent to Amazon Bedrock (an AI service run by Amazon Web Services) to design a form for what you asked. The result is kept for up to a week, so the same question can be answered again; what you typed is not stored in our logs.
• What you send: when you send the form, what you filled in — which may include your name, email address and mobile number — together with what you typed in the chat, is delivered to that business’s Taskriz inbox, sealed to its devices, and, if the business has chosen, emailed to an address the business has confirmed. An emailed copy isn’t sealed: it travels and is kept like any email. Our servers see what you send only while preparing it for delivery, and we don’t log it.
• Nothing else: The chat sets no cookies and has no analytics. We use your IP address only for limits and to prevent misuse (see technical information, above).

3. Requests and responses

When an Agent sends a request, Taskriz handles its content while delivering it: we run automated checks that it is well-formed and genuine (no one reads it), then seal it to each recipient’s devices, and store it sealed — it opens only on those devices. When someone responds, their device seals the response; Taskriz opens it for the same automated checks — no one reads it — and hands it to the Agent, and keeps it until the Agent has collected it, for up to 30 days. Attachments are stored encrypted on our servers (they are not sealed to devices) and are deleted with the request they belong to.

A request to someone without a Taskriz account, or to a guest, is held until they open it. It is encrypted before it is stored, under a key that only Taskriz’s systems use, and only to deliver it; no one reads it. When they open it, it is sealed to the device that opened it, as any other request, and the held copy is deleted. A request can reach someone by text message: the text holds a link, never the request itself.

4. How we use information

To provide Taskriz — delivering requests and responses, sending notifications by email, text or push notification, keeping accounts secure, preventing misuse, enforcing our Terms of Service, and improving the service — using technical information, not the content of requests and responses. We do not sell personal information. Apart from Google Analytics on our public website (section 2), we don’t use analytics or tracking services; we don’t use advertising services, and we don’t send marketing emails.

5. Who we share it with

Service providers who run Taskriz for us, under contract — Amazon Web Services (hosting, storage, email and text messages, and Amazon Bedrock for the home page demo, Website Chat and the requests Taskriz designs), Stripe (payments), Google (Firebase Cloud Messaging, to deliver notifications to the Android app; and Google Analytics, on our public website) and Apple (Apple Push Notification service, to deliver notifications to the iPhone app). Requests are shared with the Agents and people they are sent between.

We may also disclose information when we believe in good faith that it is needed to comply with the law or a lawful request, to protect the rights, property or safety of Appeggio, the people who use Taskriz or the public, or to prevent or investigate misuse of Taskriz.

If Appeggio is involved in a merger, sale or reorganisation of all or part of its business, information may pass to the organisations involved and their advisers, who must keep handling it under this policy.

Text messages. We never share or sell your mobile number or your consent to receive text messages with third parties or affiliates for marketing or promotional purposes. Everything else in this section excludes text message opt-in data and consent: they are not shared with any third party, apart from Amazon Web Services sending the texts for us. We use them only to send the texts you turned on.

The Taskriz apps are distributed through Apple’s App Store and Google Play. Apple and Google handle the information involved in downloading and updating apps under their own privacy policies.

6. Where it is kept

Taskriz runs on Amazon Web Services in the United States (the us-east-1 region, in Northern Virginia), so information is stored and processed outside Australia. Stripe, which handles payments, also processes information in the United States, and Google may process Google Analytics information in the United States and other countries. Google and Apple may also process notification addresses and notifications, for Firebase Cloud Messaging and the Apple Push Notification service, in the United States and other countries. Amazon Bedrock may process what is typed into the home page demo or Website Chat, and the requests Taskriz designs, in other Amazon Web Services regions. We take reasonable steps to make sure the organisations that hold information for us overseas handle it consistently with the Australian Privacy Principles.

7. How long we keep it

Requests stay until they are deleted; attachments go with them. Responses are kept until the Agent collects them, for up to 30 days. What a Website Chat visitor sends stays in the business’s inbox until the business deletes it. Account information is kept while your account is open and deleted from our systems within 24 hours of closing it (copies in our backups go too, within 35 days), unless the law requires us to keep it. Logs of activity (section 2) are kept for up to 90 days, then deleted. Google Analytics keeps what it collects for up to 14 months. A phone’s notification address is kept until you sign out of the app on it, remove the app, or close your account.

A guest account, and everything in it, is deleted 30 days after the last request sent to it, opened or answered (copies in our backups go within 35 days). Responses a guest sent stay with the business that received them. A one-time code expires after 10 minutes. A held request is kept until it is opened or declined, or for up to 30 days.

8. Your choices and rights

You can view and update your account and Profiles in Settings, remove a mobile number, unpair Agents, decline invitations, and close your account. If you are a guest, you can decline a request, close your guest account, or keep it as a Taskriz account. You can change your choice about analytics cookies at any time with Cookie Settings at the foot of the site’s pages (shown where we ask first); wherever you are, you can also block cookies in your browser, or use Google’s opt-out add-on (tools.google.com/dlpage/gaoptout). You may ask us for access to, or correction of, the personal information we hold about you, or complain about how we have handled it, by contacting us. There is no charge; we may ask you to prove who you are, and we will respond within 30 days. In limited cases the Privacy Act allows us to refuse access — for example, where it would unreasonably affect someone else’s privacy — and if we do, we will tell you why. To make a complaint about how we have handled your personal information, email us at support@appeggio.com with the details. We will look into it and respond in writing within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, phone 1300 363 992.

9. Security

Connections are encrypted, requests are sealed to recipients’ devices, passwords are hashed, and access is limited. No service can be perfectly secure; keep your devices and sign-in details safe.

10. Children

Taskriz is for people aged 16 and over. We don’t knowingly collect personal information from anyone under 16. If you believe a child under 16 has given us personal information, contact us and we will delete it.

11. Changes

We will update this policy as Taskriz changes, and tell you about significant changes before they take effect.

12. Contact

support@appeggio.com