Privacy Policy for Taskey

1. Who we are

Taskey is made by ToDeX Interactive V.O.F., (Dutch Chamber of Commerce / KvK 42185631). We are the data controller for any personal data processed through Taskey, as described in this policy. You can reach us at info@todex-interactive.com.

2. At a glance

• An account is required.
• Some data reaches our servers — listed in full below.
• No analytics or crash reporting.
• No ads.
• We never sell your data.

3. Data stored on your device

Your sign-in session and app preferences are stored on your device.

4. Data we collect

To use Taskey you need an account. You can sign in with: One-time code sent to your email. We never ask for or store a password.

• Email address, display name, language preference and your player code. Creating your account and sending sign-in codes.
• Events you create or join: name, description, dates, settings and your role. Running events and deciding who can spin, add tasks or review answers.
• Tasks, spins, text answers, proof photos and review results. Playing the game: assigning dares and recording whether they were completed.
• Photos and captions you add to an event's shared album. Sharing them with the other members of that event.
• Sign-in session details (IP address and device/browser type). Keeping you signed in and protecting accounts against misuse.

What other players can see: Members of an event you join can see your display name, profile picture, the tasks you get, your answers, the photos you submit or share, and your results in that event.

5. Analytics & crash reports

Taskey does not currently include any analytics or crash-reporting tools. If we add them in the future, we will update this policy before they go live.

6. Device permissions

Taskey only asks for these permissions, and only at the moment they are needed. You can decline or revoke any of them in your device settings.

• Camera: Only when you take a photo as proof for a task or for the shared album.
• Photo library: Only when you choose an existing photo to submit or share.

7. Legal basis for processing

Where the GDPR applies, we rely on the following legal bases:

• Email address, display name, language preference and your player code: Performance of a contract (Art. 6(1)(b) GDPR).
• Events you create or join: name, description, dates, settings and your role: Performance of a contract (Art. 6(1)(b) GDPR).
• Tasks, spins, text answers, proof photos and review results: Performance of a contract (Art. 6(1)(b) GDPR).
• Photos and captions you add to an event's shared album: Performance of a contract (Art. 6(1)(b) GDPR).
• Sign-in session details (IP address and device/browser type): Legitimate interests (Art. 6(1)(f) GDPR).

8. Service providers

These companies process data for Taskey, each only for the purpose listed:

• Vibecode — Hosting our backend, database and photo storage, and sending sign-in code emails (EU).

9. Data sharing & disclosure

We do not sell or rent your data. Data is only shared with the service providers listed above, with other players as described above, or where we are required to by law.

10. International transfers

All service providers listed above store and process Taskey data within the European Union.

11. Security

We use reasonable technical and organizational measures to protect any data we hold, including encrypted connections (HTTPS) for all traffic between the app and our servers. Only our own team can access stored data, and only when needed for support, abuse reports or security. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Data retention

• Account data is kept for as long as your account exists.
• Event content (tasks, answers, photos) is kept until the event is deleted by its admin or you delete your account.
• Sign-in codes expire after a few minutes; sign-in sessions expire automatically.

13. Deleting your data

Delete your account at any time from the app's settings. This permanently removes your account and everything linked to it, including events you created, your answers, and the photos you submitted or shared.

14. Children's privacy

Taskey is not directed at children under 13, and we do not knowingly collect personal information from children under 13. In the EEA, children under 16 need permission from a parent or guardian before giving consent to any consent-based processing, such as personalised ads. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. Users in the UK, California, and other regions may have similar rights under local law. You can exercise these rights for your Taskey account by contacting us below, or delete your account directly in the app.

You also have the right to lodge a complaint with a data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

16. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

17. Contact

Questions about this policy? Email us at info@todex-interactive.com, or for app support visit our Support page (support: info@todex-interactive.com).