This policy is part of the Terms of service. It applies to everyone who uses the hosted Taskr service run by BB Dev Ltd (taskr-app.bbdev.app, its API, its MCP server, the iOS app and the Claude Code plugin), and to every agent, API key, service account or integration that acts for them. You are responsible for what your agents do in Taskr, in the same way as for what you do yourself.
It does not apply to copies of Taskr that someone else runs on their own servers.
What you may not do
Do not use Taskr, or let an agent use it, to:
- Break the law. Store, send or process anything unlawful, or use Taskr to help commit a crime, including fraud, harassment, stalking and the sale of illegal goods.
- Infringe other people’s rights. Upload content you have no right to use, such as code, documents or recordings that belong to someone else and that you have no licence for, or content that breaks a confidentiality obligation you owe.
- Harm children. Store or share any material that sexualises or exploits children. We report it to the authorities.
- Abuse people. Threaten, harass or bully anyone, or publish someone’s personal information without a lawful reason.
- Process special category data without care. Put health, biometric, genetic, criminal record or similar sensitive personal data into Taskr unless you have a lawful basis and have told us first. Taskr is an issue tracker and is not built to hold that kind of data.
- Send spam. Use Taskr’s email, notifications, webhooks or invitations to send unsolicited messages, or invite people who have not agreed to be invited.
- Spread malware. Upload viruses, ransomware or other harmful code, except as inert samples in an issue about a security problem in your own software, clearly labelled.
- Attack Taskr or anyone else. Probe, scan or test the security of Taskr without our written permission; get round authentication, rate limits, plan limits or access controls; read data you are not allowed to see; or use Taskr’s sandboxes, remote agents or webhooks to attack, scan or overload other systems.
- Overload the service. Send traffic far beyond normal use of an issue tracker, or run
automated jobs that degrade the service for others. Agents should use the MCP server and API
as documented and respect
429responses and the limits we publish. - Mine or misuse resources. Use sandboxes or remote agent workers for cryptocurrency mining, general computing unrelated to your issues, or anything other than building and testing your own software.
- Resell or copy the service. Resell, sublicense or rent access to the hosted service, or use it to build a competing product by copying its features, text or design, unless we have agreed in writing. (Taskr’s source code has its own licence; this rule is about the hosted service.)
- Mislead people about agents. Pass off an agent’s output as a person’s work where that matters to someone relying on it, or set up an agent to impersonate a real person.
- Feed untrusted instructions to agents carelessly. Taskr treats issue, comment and pull request text as untrusted when it reaches an agent. Do not try to defeat that, or plant instructions in content to make someone else’s agent act against them.
Accounts and credentials
- Keep your sign-in email account, GitHub account and any API keys or tokens you create secure. Do not share an account between people; invite each person instead.
- Give agents and service accounts only the access they need, and revoke keys you no longer use.
- Tell us straight away at contact@bbdev.app if you think someone else has used your account or a key.
Reporting a problem
To report abuse, or a security problem in Taskr, email contact@bbdev.app. Please give us a
reasonable time to fix a security problem before you tell anyone else about it.
[[TO CONFIRM: a dedicated security contact or security.txt, if wanted]]
What we do when this policy is broken
We look at what happened and act in proportion to it. We may:
- ask you to remove the content or stop the activity;
- remove or disable the content, an API key, an agent’s access, a webhook or an integration;
- suspend access to a workspace or an account while we look into it; or
- close the account or workspace, as described in the Terms of service.
Where we can, we tell you first and give you a chance to put it right. We act without warning when we must, for example to stop an attack, protect other customers, or comply with the law. We may report illegal activity to the police or other authorities.
Changes
We may update this policy. We will post the new version here with a new date and, for a change that matters, tell account owners by email before it applies.
Contact
BB Dev Ltd, 24 Scotts Road, Bromley, England, BR1 3QD. Email contact@bbdev.app.