Privacy policy

Who is responsible?

Squibble GmbH, Rossbergstrasse 30, 8310 Kemptthal, Switzerland, is responsible for this website and for the tasks application. For privacy questions or to exercise your rights, email hello@squibble.ch.

What this policy covers

It covers the website tasks.squibble.ch and the application at app.tasks.squibble.ch, with every way of capturing tasks: in the browser, with the command-line tool tsk, through MCP clients such as Claude, with the iPhone shortcut, by email and through calendar feeds. The Swiss Federal Act on Data Protection (FADP) applies; the EU General Data Protection Regulation (GDPR) applies where its conditions are met.

Hosting in Germany

The website, the application and the database run on servers that Squibble GmbH rents from Hetzner Online GmbH in Germany and operates itself. The database is backed up every six hours; these backups stay on the server for 14 days. In addition, an encrypted copy of the backups is transferred daily to a further backup system operated by Squibble.

Every connection is encrypted with TLS. Access tokens and calendar feed addresses are stored only as digests.

Visiting this website

This website sets no cookies. To deliver it, our infrastructure processes connection data such as IP address, time, requested address and response status. The website’s web server writes no access logs; upstream systems keep operational logs for troubleshooting and to fend off attacks.

Anonymous measurement

We measure page views and a few clicks (for example on "Start for free" or the language switch) with Umami. We run Umami ourselves at insights.squibble.me; the data goes to no third party. The measurement sets no cookies and stores no IP addresses. It records the page without query parameters (except utm campaign parameters), the language, browser, operating system, device type and country; it does not send the referring page.

For the contact form we count only anonymous steps: whether it was viewed, started, submitted, succeeded or failed and whether you clicked the email address instead, each without the data you entered.

If your browser sends the Global Privacy Control or Do Not Track signal, we measure nothing. You can also switch measurement off for this browser only.

We also measure the application with Umami. We count page views only as the pattern of the address (such as "/tasks/:id"), without numbers, names, titles or query parameters, and a few events such as "workspace created", "task created" or "calendar feed created", each with fixed values only, such as the kind of workspace. After sign-up we record once the sign-in method and the utm campaign you came from. If your browser sends Global Privacy Control or Do Not Track, the application measures nothing either.

Tasks that arrive by email, tsk, MCP, the iPhone Shortcut or the API are counted by our server, because no browser is involved. It sends only the name of the event and the channel (for example "task created" through "tsk"), without IP address, account or content.

In the application, the switch "Anonymous usage statistics" under Settings › Preferences turns all measurement off for your account: on every device, in the browser and on the server.

Account and sign-in

Sign-in is provided by WorkOS, Inc. (USA). WorkOS processes your email address, your name and, if you sign in with Google, Apple or Microsoft, the details that service passes on. The transfer to the USA is based on the European Commission’s standard contractual clauses, which Switzerland also recognises. WorkOS does not see your tasks.

After sign-in, the application sets a session cookie. It is technically necessary and only keeps you signed in.

Your tasks and workspaces

We store what you create in tasks: workspaces, memberships and invitations, tasks with title, description, due date, tags, links, comments and history, plus your settings such as language, time zone and the time of your daily digest. Members of a workspace see its tasks; other workspaces stay separate. We do not use your content for advertising and we do not sell data.

As the operator, Squibble can technically access the content. We only do so when it is needed for operation, troubleshooting or support, or when you ask us to.

Capture by email, calendar and push

Email: when you forward a mail to your personal capture address, our own mail system processes the sender, subject and text to turn it into a task. Mail from senders you have not allowed is discarded. Notifications such as invitations, confirmations and the daily digest are also sent through our own mail system.

Calendar feed: when you subscribe to a feed in Apple Calendar, Google Calendar, Outlook or another app, its provider fetches the feed regularly and processes the entries under its own terms. The feed contains no descriptions; in "numbers only" mode it contains no titles either.

Push: when you turn on push notifications, your browser’s push service delivers them: Apple, Google or Mozilla. The service receives a device address and the encrypted notification.

Contact form

When you write to us through the contact form, we process your details with Site Services, a product of Squibble GmbH running on the same servers in Germany, to answer your request.

To fend off spam and abuse, Site Services also receives your IP address. It stores it only as a checksum that changes daily and cannot be reversed. Site Services deletes requests after the retention period set there, one year by default.

Who receives data

Apart from Squibble itself, only these providers receive personal data, each for the purpose named:

• Hetzner Online GmbH, Germany: servers and data centre for the website, the application and the database.
• WorkOS, Inc., USA: sign-in; safeguarded by standard contractual clauses.
• Apple, Google and Mozilla: delivery of push notifications, only if you turn push on.
• The provider of your calendar app: fetching the calendar feed, only if you set up a subscription.
• Amazon Web Services EMEA SARL, Zurich region: download of the tsk program files, only if you download tsk.

Our own services

The mail system (api.email.squibble.ch), measurement (Umami at insights.squibble.me) and the contact form (Site Services) are run by Squibble GmbH itself on servers at Hetzner in Germany.

Legal bases

Where the GDPR applies: we process data for the application to perform our contract with you (Art. 6(1)(b) GDPR). Operating and securing this website and the application, and their anonymous measurement, rest on our legitimate interest in a secure, useful service (Art. 6(1)(f) GDPR). Push notifications and calendar feeds are set up by you.

How long we keep data

We keep your account and content for as long as your account exists. When you delete tasks or your account, they disappear from the application; they remain in the backups until those backups expire. Statutory retention duties remain reserved.

Your rights

You can ask for information about your data, a copy in a common format (export), its correction or deletion, and you can object to processing based on legitimate interests. Export and account deletion directly in the settings are coming; until then an email to hello@squibble.ch is enough. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the supervisory authority responsible for you.

Changes

When our services or providers change, we update this policy. The version published here applies.