This notice covers the website at taskr.bbdev.app and the web app at taskr-app.bbdev.app. The law (the Privacy and Electronic Communications Regulations) covers cookies and anything similar that stores information in your browser, so we list both.
The short version
- This website sets no cookies and stores nothing in your browser. It has no analytics and loads its fonts from our own server.
- The web app sets only the cookies needed to keep you signed in, and stores your own choices (such as light or dark theme) and a working copy of your workspace in your browser.
- We use no analytics, advertising or tracking cookies, and no third-party cookies.
- Because everything we use is strictly necessary for the service you asked for, the law does not require us to ask for consent, so we do not show a cookie banner. If we ever add anything that is not strictly necessary, we will ask first.
Cookies
[[TO CONFIRM: this table comes from the code as of 2026-10-11 and must be reconciled with docs/legal/cookies-inventory.md when it lands]]
These are set by the Taskr API (taskr-api.bbdev.app) when you sign in. In production the names
start with __Secure-, which means browsers only send them over HTTPS. They are HttpOnly
(scripts on the page cannot read them) and are only sent to the API’s own host.
| Name | Purpose | How long | Type |
|---|---|---|---|
__Secure-better-auth.session_token |
Keeps you signed in. Holds a random session id, not your details. | 30 days, renewed while you use Taskr; removed when you sign out | Strictly necessary |
__Secure-better-auth.session_data |
A short-lived signed copy of your session and basic account details, so the API does not look them up on every request. | 5 minutes | Strictly necessary |
__Secure-better-auth.state |
Protects sign-in with GitHub against forged requests. | 5 minutes, during GitHub sign-in only | Strictly necessary |
[[TO CONFIRM: whether Cloudflare sets any security cookie (such as __cf_bm for bot management) on our hosts with the current Cloudflare settings; if so it is strictly necessary and is added here]]
Other browser storage in the web app
| What | Where | Purpose | How long |
|---|---|---|---|
| Your theme, sidebar state, issue display options, the docs tree you expanded, recently opened items, your last project in each workspace, tips and tasks you dismissed | Local storage | Remembers choices you make, on this device | Until you change them or clear your browser’s data |
| A working copy of the workspace data you can see | IndexedDB | Lets the app load quickly, stay in sync and keep working briefly offline | Until you sign out or clear your browser’s data [[TO CONFIRM: whether signing out clears it]] |
None of this is sent to anyone else.
Images from GitHub
If you or a teammate signed in with GitHub, the app shows that person’s GitHub avatar, which your browser loads from GitHub. GitHub may log that request under its own privacy statement. It does not set cookies for us.
Taskr for iOS
The iOS app does not use cookies for tracking. It signs you in through a browser sheet, which uses the same sign-in cookies as the web app, and stores its access token in the iPhone’s Keychain. See the Privacy policy.
Controlling cookies
You can block or delete cookies in your browser’s settings. If you block the sign-in cookies, you cannot sign in to the web app.
Contact
Questions to contact@bbdev.app. BB Dev Ltd, 24 Scotts Road, Bromley, England, BR1 3QD.