Work tasks in a personal to-do app?

On Monday morning five Jira issues are assigned to you, in the afternoon the school calls, and in the evening you remember that the car insurance has to be cancelled by the end of the month. Three lists, three places, no overview. The obvious idea: put everything into a personal to-do app. With the Jira issues, though, it is worth pausing for a moment.

This article is not legal advice. Your employer’s rules are what counts; if in doubt, ask your IT department or your data protection contact.

What employer policies usually cover

IT policies differ from company to company. Three points, however, appear in almost all of them:

1. Credentials stay in the company. API tokens, passwords and access to company systems must not be entered into services the company has not approved. A Jira token in a third-party app is exactly that.
2. Content stays in approved services. Issue titles, descriptions and comments often contain customer names, project names or security topics. Copying them into a personal service is usually not allowed.
3. No shadow IT. Software that processes company data without the IT department knowing is called shadow IT. It is a risk, because nobody knows where the data is and who can see it.

There is more behind this than internal rules. In Switzerland, the Code of Obligations requires employees to keep business secrets confidential (Art. 321a para. 4 CO). If an issue contains personal data of customers, the Federal Act on Data Protection (FADP) applies as well, and the GDPR in the EU.

Which data is sensitive

Not every detail of an issue is equally sensitive. A rough split helps:

Data	Sensitive?	Why
Credentials (API token, password)	very	Whoever has them sees everything you see
Description, comments, attachments	very	Customer data, code, security issues
Title	often	“Fix data leak at customer X” gives a lot away
Key (PROJ-123), due date, status	hardly	Meaningless without access to Jira

The rule of thumb: the less of an issue lives outside the company, the better. The key and the due date are often enough to know that something is due on Thursday.

How tasks handles this

tasks is built so that you see company issues in your overview without breaking the three points above:

• The company token stays on your laptop. tsk sync jira fetches Jira issues on your machine with the login jira-cli already keeps there and sends only the issues assigned to you. The tasks server stores no Jira token and never calls Jira itself.
• Descriptions, comments and attachments never come along. tasks takes only the title, due date, status and assignment, and only to read.
• Key instead of title. If you hide the titles of external issues for a workspace, tasks shows only PROJ-123 everywhere, in the calendar feed, in notifications and through MCP too, and does not store the title at all.
• One workspace per employer. Every workspace is a privacy boundary, enforced in the database. Your family sees none of it, and you still see everything in one overview.

GitLab takes the same route: tsk sync gitlab asks your logged-in glab for your issues and merge requests, so no GitLab token reaches the tasks server either. More on the page Jira and GitLab.

What about the remaining data?

A key and a date are still data about your work. tasks is a service of Squibble GmbH, a Swiss provider; the servers are at Hetzner in Germany, and sign-in runs through WorkOS (USA, standard contractual clauses). There are no ad trackers. The details are on the page Privacy and hosting.

If your company does not want even keys and due dates outside, the answer is simple: the issues stay in Jira, and tasks manages the rest of your life. How the split by workspace works is on the page Separate work and family.

How to start

1. Read your employer’s IT policy, or ask what may live outside.
2. Create a workspace of its own for this employer in tasks, and hide the titles of external issues if they are sensitive.
3. Install tsk on your laptop; the guide Install tsk and sign in covers the download, the checksum and signing in.

Conclusion

An overview of work and private life does not contradict your employer’s rules, as long as credentials and content stay in the company. What goes outside should be as little as possible: a key, a date, a status.