SentraTasks ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the SentraTasks application and website (collectively, the "Service").
By using SentraTasks, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
Account Information
When you create a SentraTasks account, we collect:
- Email address — used as your login identifier and for account-related communications. Your email is normalized to lowercase and stored securely.
- Password — hashed using bcrypt before storage. We never store, log, or have access to your plain-text password.
Workspace Content
As you use SentraTasks, we store the content you create and the content generated by AI on your behalf, including:
- Projects — names, descriptions, and organizational metadata.
- Tasks — titles, descriptions, statuses, priorities, due dates, and tags.
- Checklist items — including items you create and items suggested by the AI assistant.
- Conversations — messages exchanged between you and the AI assistant in both the Home chat and individual task threads.
- Narratives — AI-generated summary documents that capture the state and history of your tasks and projects. All narrative versions are preserved.
- Meeting data — meeting notes, agendas, follow-up items (with optional assignee names and emails), and AI-generated meeting summaries.
- Work sessions — session names, scheduled times, and associated notes.
Calendar Data
If you connect a calendar provider (Google Calendar or Microsoft Outlook 365), we access and temporarily cache:
- Calendar event titles, times, locations, and attendee information.
- OAuth tokens required to maintain the connection to your calendar provider.
We only access calendar data necessary to display your schedule within SentraTasks and to create meeting workspaces from calendar events. We do not modify your external calendar.
Usage & Technical Data
- Authentication tokens (JWTs) and session metadata for maintaining your logged-in state.
- AI model usage metrics (input/output token counts, model identifiers) for billing and service monitoring — these do not include the content of your conversations.
2. How We Use Your Information
We use the information we collect to:
- Provide the Service — create and manage your workspace, process your requests, and deliver AI-powered features such as task management, narrative generation, daily briefs, and meeting summaries.
- Maintain security — authenticate your identity, manage sessions, detect compromised tokens through family-based refresh token tracking, and protect against unauthorized access.
- Improve the Service — monitor aggregate usage patterns and performance to improve reliability and develop new features.
- Communicate with you — send essential account-related messages such as password reset requests or critical service notifications.
We do not sell your personal information. We do not serve advertisements. We do not share your workspace content with other users or third parties, except as described in this policy.
3. Data Sharing, Transfer & Disclosure
SentraTasks does not sell, rent, or trade your personal information or workspace content to any third party. Below is an exhaustive list of the circumstances under which your data may be shared, transferred, or disclosed:
AI Service Providers
To deliver the AI-powered features of SentraTasks (conversation responses, narrative generation, meeting summaries, etc.), we transmit relevant workspace content to third-party AI providers for processing. Currently these providers include:
- Anthropic — for large language model inference.
- Microsoft Azure OpenAI Service — for large language model inference.
Data sent to AI providers is used solely to generate a response for your session. It is not used to train AI models and is not retained by these providers beyond the processing of your request, in accordance with their data processing agreements.
Google User Data
If you connect your Google Calendar to SentraTasks, we access limited calendar data (event titles, times, locations, and attendee information) via Google's OAuth 2.0 API. Regarding this Google user data:
- We do not share Google user data with any third party. Google Calendar data is not transmitted to AI providers, advertising networks, data brokers, or any other external service.
- We do not sell Google user data.
- We do not use Google user data for advertising or marketing purposes.
- We do not transfer Google user data to any third party except as necessary to provide and improve the calendar display features of SentraTasks, or as required by applicable law.
- Google user data is stored only on our servers and is used exclusively to display your schedule within SentraTasks and to enable meeting workspace creation from calendar events.
- You can revoke access at any time by disconnecting your Google Calendar from SentraTasks, which deletes all stored Google connection data and cached calendar events.
SentraTasks' use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Microsoft User Data
If you connect your Microsoft Outlook 365 calendar, the same protections described above for Google user data apply equally to your Microsoft calendar data. We do not share, sell, or transfer Microsoft user data to any third party.
Legal Requirements
We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to:
- Comply with a legal obligation, subpoena, or court order.
- Protect and defend the rights or property of SentraTasks.
- Prevent or investigate possible wrongdoing in connection with the Service.
- Protect the personal safety of users of the Service or the public.
No Other Sharing
Beyond the AI service providers and legal requirements described above, we do not share, transfer, or disclose your personal information or workspace content to any other party. There are no data brokers, advertising partners, analytics services, or other third parties that receive your data.
4. AI Processing & Your Content
SentraTasks uses large language models (LLMs) to power its AI assistant features, including conversation responses, narrative generation, checklist suggestions, daily briefs, project summaries, and meeting summaries.
When you interact with the AI assistant, relevant context from your workspace (such as task details, conversation history, and narrative content) is sent to the LLM provider to generate a response. Here's what you should know:
- Your content is sent to a third-party AI provider (currently Anthropic) to process your requests. This is necessary to deliver the AI features of the Service.
- We do not use your content to train AI models. Your workspace data is used solely to generate responses within your session.
- Context is scoped. The Home chat assistant accesses workspace-level data and narrative summaries. Task thread assistants only access the specific task's data and conversation history. Meeting agents only access the specific meeting's data.
- Error messages are scrubbed. If an AI processing error occurs, any prompt content is automatically redacted before being stored in our system logs.
5. Calendar & Third-Party Integrations
SentraTasks supports optional integrations with Google Calendar and Microsoft Outlook 365. When you connect a calendar provider:
- You authenticate directly with the provider via OAuth 2.0. We never see or store your Google or Microsoft password.
- We store the OAuth access and refresh tokens necessary to maintain the connection.
- We cache calendar event data locally to display your schedule and enable meeting workspace creation.
- You can disconnect your calendar at any time, which revokes our access and deletes the stored connection data.
We access only the minimum calendar permissions necessary to read your events. We do not create, modify, or delete events in your external calendar.
6. Data Storage & Security
We take the security of your data seriously and employ industry-standard practices:
- Encryption in transit — all communication between your browser and our servers is encrypted using TLS/HTTPS.
- Password hashing — passwords are hashed with bcrypt using auto-generated salts. Plain-text passwords are never stored or logged.
- Token security — refresh tokens are stored as SHA-256 hashes. Access tokens are short-lived (30 minutes). Family-based reuse detection automatically revokes token families if a compromised token is detected.
- Infrastructure — SentraTasks is hosted on Microsoft Azure, leveraging Azure's enterprise-grade security infrastructure including Azure Container Apps and Azure Database for PostgreSQL.
- Data truncation — large payloads in AI processing logs are automatically truncated to prevent excessive data retention.
7. Data Isolation
SentraTasks operates on a single-user workspace model. Every database query is scoped to your authenticated user ID. This means:
- No other user can access your projects, tasks, conversations, narratives, meetings, or any other workspace content.
- There are no shared workspaces or collaborative features that expose your data to other users.
- Your workspace is completely private to your account.
8. Data Retention & Deletion
We retain your workspace content for as long as your account is active. Specific retention behaviors include:
- Narrative versions are preserved indefinitely to maintain a complete history of your work.
- Conversation history is retained as part of your task threads and Home chat for continuity.
- Cached calendar events are refreshed periodically and do not persist beyond their display purpose.
If you delete your account, all associated data is permanently removed through cascading deletion, including all projects, tasks, conversations, narratives, checklist items, meetings, work sessions, and authentication tokens. This action is irreversible.
Within your workspace, you can delete individual projects (tasks are preserved by moving to your Inbox), archive projects, and manage tasks at any time.
9. Cookies & Local Storage
SentraTasks uses browser local storage to maintain your authentication session:
- Access token — a short-lived JWT stored in localStorage for API authentication.
- Refresh token — stored in localStorage to obtain new access tokens when they expire.
We do not use tracking cookies, analytics cookies, or advertising cookies. We do not embed third-party tracking scripts.
10. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access — you can view your account information and all workspace content at any time through the application.
- Correction — you can update your email address and other account information through your profile settings.
- Deletion — you can request deletion of your account and all associated data by contacting us.
- Data portability — you can request an export of your workspace data by contacting us.
- Withdraw consent — you can disconnect calendar integrations and delete your account at any time.
To exercise any of these rights, please contact us at the email address provided below.
11. Children's Privacy
SentraTasks is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete that information promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you via email or through a notice within the application.
Your continued use of SentraTasks after any changes to this policy constitutes your acceptance of the revised terms.
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
Email: privacy@sentratasks-ai.com