This policy explains how BB Dev Ltd handles personal data when you use the hosted Taskr service: the web app, the API and MCP server that agents connect to, Taskr for iOS, the Claude Code plugin when it is connected to our service, and this website. It does not cover copies of Taskr that other people run on their own servers; whoever runs that server is responsible for it.
Who we are
BB Dev Ltd runs Taskr. We are a company registered in England and Wales, company number 13860234, registered office 24 Scotts Road, Bromley, England, BR1 3QD.
Contact us about anything in this policy at contact@bbdev.app. We are a small company and have not appointed a data protection officer; the same address reaches the people who handle data protection.
ICO registration number: [[TO CONFIRM: ICO registration number]].
Our role: controller or processor
Data protection law gives us one of two roles, depending on whose data it is and who decides what happens to it.
- We are the controller of your account data. That is the data we need to give you an account and run the service: your name, email address, sign-in records, settings, devices, billing details and any marketing preferences. We decide how it is used, and this policy explains that.
- For a business, we are the processor of its workspace content. When a company or other organisation uses Taskr, the issues, comments, documents, uploads, planning sessions, customer feedback and repository data its people and agents put into its workspace belong to that organisation. It is the controller; we process that content only on its instructions, under our Data processing agreement. If you are a member of such a workspace and have a question about that content, ask the organisation first. We will help it answer.
- For an individual using Taskr for themselves, we are the controller of everything, including the workspace content.
The data we collect
Your account
- Name, email address and handle. You give us your email when you sign in with a one-time code, or GitHub gives it to us when you sign in with GitHub. We create a display name from your email or GitHub profile; you can change it and add a handle in Settings → Profile.
- Profile picture. If you sign in with GitHub, we store the address of your GitHub avatar and show it. Your browser loads it from GitHub.
- Sign-in codes. We store a one-time code in hashed form for up to 10 minutes.
- Sessions. When you sign in, we store a session with the IP address and browser user agent you signed in from, and when it expires.
- Workspaces and roles. Which workspaces you belong to, your role in each, invitations you sent or received (including the invitee’s email address), and teams.
- Notification settings. Which events reach you in the app, by email or by push, your digest frequency and timezone.
- Credentials you create. API keys, OAuth grants for agents and apps you connect, and service accounts. We store keys and tokens hashed, so we cannot read them back.
How you use Taskr
- Records of what changed and who changed it. Every change to a workspace is recorded with the person, the agent (if any) and the credential that made it. Security-relevant actions, such as exports, plan changes and key changes, are also written to an audit log.
- Agent sessions. When you connect a coding agent, we record the session: the agent’s name, the repository and branch it works on, a hash of its working folder, the files it reports touching, its progress notes and summary, and which issues it claimed.
- Doc views. Which doc pages you viewed and when, to show recently viewed pages and who is reading.
- AI usage records. For each AI request: the feature, the model, tokens and cost, and what it was for. Not the content.
- Service logs. Our servers log each request’s method, path, status, timing and an internal request id. Our tracing records the browser user agent. They do not record your IP address (Cloudflare, which carries all traffic, does see it; see below).
We do not use analytics or advertising tools, and we do not track you across other sites.
Workspace content
What you, your colleagues and your agents put into a workspace: issues, comments, documents and their history, attachments, evidence such as screenshots, screen recordings and test traces, planning sessions, customer records and feedback, ideas, views and labels. This can contain personal data about you or other people. Customer records and feedback can contain data about a workspace’s own customers, which the workspace is responsible for.
The Record a bug tool records the page you are on only when you start it, and masks what you type into form fields.
GitHub data
If a workspace connects GitHub:
- Signing in with GitHub gives us your GitHub account id, login, name, email address and
avatar, and an access token we use to check which repositories you can see. We store the token
[[TO CONFIRM: GitHub OAuth tokens are stored unencrypted in the database today; see review notes]]. - The Taskr GitHub App, installed by someone with rights on the repositories, lets us read repository metadata, branches, commits (message headline, author name, login and email), pull requests (title, description, author, reviews and review comments with the lines they refer to), checks, statuses and deployments. We keep the raw event GitHub sends us for 14 days.
- Docs imports read the files you choose from a repository.
- Remote agents download the repository into a sandbox to work on it, and push branches and open draft pull requests through a second GitHub App.
AI processing
Taskr’s AI features are suggested doc changes when an issue closes, the planning facilitator, and naming feedback themes and drafting idea suggestions. When they run, we send the content they need to an AI model through OpenRouter:
- auto-documentation: the closed issue (title, description, comments, agent notes), the changes in its pull request, and the doc pages it may edit;
- the planning facilitator: the session’s goal, messages, pins and drafts, and the issues and ideas it looks up, limited to what the person asking can see;
- feedback themes: the feedback text.
Before anything leaves our servers, we remove secrets such as keys and tokens and mask email addresses. Every request is limited to model endpoints that OpenRouter lists as zero data retention: the provider keeps no copy and does not train on it. We check after each request that a zero-retention endpoint answered, and discard the answer if not. Owners and admins can choose “EU only” to keep model processing on EU endpoints, and can turn the AI features off. We do not use your content to train AI models.
Remote agents are different. When a workspace assigns an issue to the Taskr Worker, the agent runs in a sandbox with the repository and sends the issue, code and tool output to Anthropic, using the workspace’s own Anthropic API key. That processing is under the workspace’s own agreement with Anthropic and Anthropic’s data retention terms, not the zero-retention routing above. We keep the agent’s transcript for 90 days by default.
[[TO CONFIRM: whether similar-issue search (embeddings) is turned on in production, and with which provider; if so, issue titles and descriptions and feedback text are sent to it]]
Taskr for iOS
- Sign-in. You sign in on our website in a browser sheet; the app receives an access token, which it keeps in the iPhone’s Keychain.
- Offline copy. The app keeps a copy of the issues, notifications and docs you open on the device so it works offline. Signing out of a workspace deletes it.
- Push notifications. If you allow notifications, we store your device’s push token, the app’s version and the device’s name, and send notifications through Apple. A notification contains the text you would see in the app, such as an issue title, a comment or an agent’s question.
- Diagrams. When you open a doc with a diagram, the app loads the diagram library from the jsDelivr content network, which sees your IP address.
- The app has no analytics, advertising or crash-reporting tools and does not track you.
Billing
We do not take card payments yet. When we do, the payment provider
[[TO CONFIRM: payment provider, Stripe is built]] will collect your card details; we will not
see or store them. We will keep the provider’s customer and subscription ids, the plan, the
number of seats, the owner’s email address and the billing events the provider sends us.
Marketing
We do not send marketing email today. If we start, we will only email people who opt in, every
email will have a one-click unsubscribe link, and we will record when you agreed and when you
unsubscribed. [[TO CONFIRM: marketing consent capture, once it lands]]
When you contact us
If you email us, we keep the email and our reply so we can help you and keep a record.
Why we use it, and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Creating your account, signing you in, running the service you asked for | Account, sessions, workspaces, settings, credentials | Contract: we need it to provide Taskr to you |
| Hosting and processing workspace content for a business | Workspace content, GitHub data, AI processing | We act as processor on the business’s instructions; the business has its own lawful basis |
| Hosting workspace content for an individual, including AI features and GitHub you turn on | Workspace content, GitHub data, AI processing | Contract |
| Notifications and service emails (sign-in codes, invitations, mentions, digests, important changes) | Email, push token, notification content | Contract. You choose which notifications you get |
| Keeping Taskr and your account secure: preventing abuse, investigating incidents, rate limiting | Sessions (IP address, user agent), audit and change records, service logs | Legitimate interests: keeping the service and its users safe. See our assessment summary below |
| Understanding cost and fixing problems | AI usage records, service logs and traces | Legitimate interests: running a reliable service at a sustainable cost |
| Billing, invoices and tax records | Billing data | Contract, and legal obligation to keep accounting records |
| Marketing email (when we start) | Email, consent record | Consent, which you can withdraw at any time |
| Answering your questions and requests | Your messages | Legitimate interests, or legal obligation for data protection requests |
| Complying with the law and defending legal claims | What is relevant | Legal obligation or legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for the assessment and object at any time (see Your rights).
Taskr is not designed for special category data (health, biometric data and similar). Please do not put it into Taskr.
Who we share it with
We do not sell personal data and do not share it for advertising.
We use other companies (subprocessors) to run Taskr. The current list, with what each one does, the data it handles and where, is on the Subprocessors page. In short:
- Cloudflare: DNS, the secure tunnel to our servers, and content delivery. All traffic to the app, API and MCP server passes through it.
- Our server host
[[TO CONFIRM: VM provider]]: the virtual machine in the UK where the database and files are stored. - Vercel: hosts this website.
- Resend: sends email.
- OpenRouter and the zero-retention model providers it routes to: AI features.
- GitHub: sign-in with GitHub and the GitHub App.
- Apple: push notifications and the App Store.
- Anthropic: remote agents, using the workspace’s own key.
We also share data:
- inside your workspace, with the other members, guests and agents the workspace allows to see it;
- with services your workspace connects, such as a webhook endpoint or an agent you run yourself;
- with authorities when the law requires it, and with professional advisers under a duty of confidentiality;
- with a buyer if our business is sold, under the same protections, and we will tell you.
International transfers
Our database and files are stored in the UK. Some subprocessors are based in, or process data
in, the United States and other countries: Cloudflare, Vercel, Resend, OpenRouter, GitHub,
Anthropic and Apple, and the AI model providers behind OpenRouter. When personal data leaves the
UK, we rely on one of the safeguards UK law allows: the UK Extension to the EU–US Data Privacy
Framework (the “UK–US data bridge”) where the company is certified, or the UK International
Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in its
data processing terms. [[TO CONFIRM: the mechanism for each provider, from its DPA and its Data Privacy Framework certification]]
You can ask us for details at contact@bbdev.app.
How long we keep it
[[TO CONFIRM: this table comes from the code as of 2026-10-11 and must be reconciled with docs/legal/retention.md when the retention schedule lands]]
| Data | How long |
|---|---|
| Account (name, email, handle, avatar address) | Until you delete your account [[TO CONFIRM: account deletion, once it lands]] |
| Sign-in codes | 10 minutes, or until used |
| Sessions, with IP address and user agent | 30 days from your last use, renewed while you use Taskr [[TO CONFIRM: expired session rows are not yet deleted]] |
| Workspace content | Until the workspace deletes it, or the workspace is deleted [[TO CONFIRM: deleted items are marked deleted and not yet purged; workspace deletion with a 30-day grace period, once it lands]] |
| Screen recordings in evidence | 90 days by default; each workspace can change this |
| Test reports in evidence | 365 days by default; each workspace can change this |
| Remote agent transcripts | 90 days by default |
| Remote agent event logs | 90 days |
| Raw GitHub events | Content removed after 14 days, record deleted after 90 days |
| Outgoing webhook deliveries | Content removed after 30 days, record deleted after 90 days |
| Workspace export files | 7 days |
| AI usage records | 24 months |
| Change and audit records | For the life of the workspace [[TO CONFIRM: retention period]] |
| Push device tokens | Until you sign out on that device, or Apple tells us the token is no longer valid [[TO CONFIRM]] |
| Service logs and traces | [[TO CONFIRM: log retention on the server and in tracing]] |
| Backups | [[TO CONFIRM: backup schedule and how long backups are kept]] |
| Billing records | 6 years after the end of the financial year they relate to, for tax law |
| Emails with us | [[TO CONFIRM: 2 years after the conversation ends]] |
How we protect it
A summary; business customers can find more in the Data processing agreement.
- All connections use HTTPS. Traffic reaches our server through a Cloudflare Tunnel rather than
through ports open to the internet
[[TO CONFIRM: no other inbound ports are open on the VM]]. - There are no passwords to steal: you sign in with a one-time code (stored hashed, valid 10 minutes, limited attempts) or GitHub.
- API keys and OAuth tokens we issue are stored hashed. Keys you give us for other services (such as an OpenRouter or Anthropic key) are encrypted with AES-256-GCM using a separate key.
- Every request is checked against your role, the scopes you granted an agent, and the workspace’s visibility rules. Requests are rate limited.
- Every change records who made it, and security events go to an audit log.
- Secrets and email addresses are removed from text before it is sent to AI models, and text from issues and pull requests is treated as untrusted when it reaches an agent.
- Remote agents run in isolated sandboxes with limited network access, and their keys never enter the sandbox.
- Only the people at BB Dev who run the service can reach the production server and database.
No system is perfectly secure. If a breach affects your personal data and puts you at high risk, we will tell you.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and get a copy;
- rectification: have inaccurate data corrected;
- erasure: have your data deleted;
- restriction: ask us to limit how we use it;
- portability: get data you gave us in a machine-readable format, or have it sent to someone else;
- object to processing we base on legitimate interests, and to marketing at any time;
- withdraw consent where we rely on it, at any time, without affecting what we did before.
How to use them:
- In Taskr. Change your name and handle in Settings → Profile. Choose your notifications in
Settings → Notifications; every notification email has a one-click unsubscribe link. Workspace
owners and admins can export the whole workspace in Settings → Workspace → Export data.
[[TO CONFIRM: account deletion and a personal data export in Settings → Profile, once they land]] - By email. Write to contact@bbdev.app from the address on your account. We may ask you to confirm who you are. We answer within one month; if a request is complex we may need up to two more months, and we will tell you within the first month. It is free.
- Content in a business’s workspace. We are that business’s processor, so we will pass your request to the workspace owner and help them answer it.
- Push notifications. Turn them off in your device’s settings at any time.
Complaints
If you are unhappy with how we handle your data, please tell us first at contact@bbdev.app so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.
Children
Taskr is not meant for children. You must be 16 or older to use it
[[TO CONFIRM: minimum age]]. If we learn that we hold an account of someone under that age, we
will delete it.
Automated decisions
We do not make decisions about you by automated means that have legal or similarly significant effects. Taskr’s AI features suggest: doc changes wait for a person to review them, the planning facilitator drafts issues for people to accept, and remote agents open draft pull requests for people to review. Automatic checks such as rate limits and plan limits apply the same rules to everyone and you can contact us about them.
Cookies
We use only the cookies needed to keep you signed in, and the web app stores your preferences in your browser. See the Cookie notice.
Changes to this policy
When we change this policy, we post the new version here with a new date. If a change matters to you, we will tell you by email or in the app before it applies.
Contact
BB Dev Ltd, 24 Scotts Road, Bromley, England, BR1 3QD. Email contact@bbdev.app.