Privacy Policy
Version 1 · Effective 2026-10-15
1. Who we are
The controller of your personal data is [operator details missing], [operator details missing], registration number [operator details missing] ("GenTask", "we"). This policy covers the GenTask mobile app, the web app at app.gentask.ai and the website gentask.ai. Contact for all privacy matters: privacy@gentask.ai.
2. What we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Account data: Firebase user ID, email address, name, sign-in provider (Google, Apple or email and password) | You, and your sign-in provider | To create your account and sign you in |
| Content you create: prompts (up to 1000 characters), chat history, programs, tasks, schedules, learning plans (subject, goal, items), share links | You | To provide the service |
| Usage data: monthly counters of created tasks and AI turns, creation times of learning plans, the Terms version you accepted and when | Generated by the service | To apply free limits and to prove your acceptance of the Terms |
| Device data: push notification token; the title, text and payload of notifications we send you | Your device | To deliver reminders |
| Crash reports (mobile app) | Firebase Crashlytics | To find and fix crashes |
| Server logs: internal user ID, request method, path, status and duration | Generated by the service | Security, debugging and abuse prevention |
| IP address | Your device or browser | Used briefly for rate limits and, on the web, sent to Cloudflare for the bot check (see section 5). It is not stored by our application. It may appear in reverse-proxy error logs, kept for up to 90 days |
| Website visits: aggregated page views | Cloudflare Web Analytics | To understand how the website is used. It sets no cookies and does not track you across sites |
We do not collect payment data, advertising identifiers or product-analytics data today. Before that changes, we will update this policy and tell you.
3. How AI generation works
When you ask GenTask to create or change something, we send the following to OpenAI to generate the result: your prompt, earlier turns of the same conversation, your local date, time, time zone and language, the text of web pages whose links you paste into the prompt, and the subject, goal and items of a learning plan. We do not send your user ID or your email address to OpenAI.
When your prompt contains a link, our server fetches that page. The website sees our server's IP address, not yours.
4. Legal bases (GDPR)
- Contract: providing the service you asked for (account, content, reminders, AI generation).
- Legitimate interests: security, preventing abuse (including the retention record described in section 8), debugging, and crash reports.
- Consent: push notifications, which you control in your device settings.
- Legal obligation: when the law requires us to keep or hand over data.
5. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Google (Firebase) | Sign-in, push messages, crash reports | EU/US |
| OpenAI | AI generation (section 3) | US |
| netcup GmbH | Server hosting and the database | Nürnberg, Germany |
| Cloudflare | Website hosting, web analytics, bot protection (Turnstile receives your IP address and browser signals when the check runs), encrypted backup storage | Global |
| Purelymail | Sending and receiving email | US |
6. International transfers
OpenAI, Google, Cloudflare and Purelymail may process data outside the European Economic Area, including in the United States. Where required, transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses. Backups are encrypted on our server before they are uploaded to Cloudflare.
7. Sharing
Your programs are private. If you create a share link, anyone who has the link can view that program until you stop sharing it. Nobody can list or search other users' programs.
8. How long we keep data
- Your account data and content: until you delete your account. Deletion removes them from our live database immediately.
- Backups: daily encrypted backups. Deleted data disappears from backups within about 90 days (7 daily, 4 weekly and 3 monthly copies).
- Server logs: log files 14 days; the central log store 90 days.
- Sent-email records: 7 days.
- Retention record after you delete your account: a one-way hash of your normalized email address, that month's usage counters, learning-plan creation times from the last 30 days, and a ban flag. We keep it for 12 months to stop people from resetting free limits or escaping a ban by deleting and re-registering. It cannot be used to read your content.
9. Your rights
If you are in the EU or UK, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent, and complain to a supervisory authority (in Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky).
If you are in California, you have the right to know what we collect, to delete and to correct your data, and not to be discriminated against for using these rights. We do not sell your personal information and do not share it for cross-context behavioural advertising.
To use any of these rights, write to privacy@gentask.ai from the email address of your account. You can also delete your account yourself, as described at gentask.ai/delete-account.
10. Children
GenTask is for people aged 16 or older. It is not directed at children under 13, and we do not knowingly collect their data (COPPA). If you believe a person under 16 uses GenTask, write to privacy@gentask.ai and we will delete the account.
11. Security
We use encrypted connections (TLS), restrict access to our servers, encrypt backups and use short-lived session tokens. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.
12. Changes
If we change this policy in a material way, we will email you before the change takes effect. The version number and effective date are at the top of this page.
13. Contact
privacy@gentask.ai · [operator details missing], [operator details missing]