Privacy Policy
Effective from 29 September 2026
This is a translation provided for information. The legally binding version is the Polish one: Polish version
This policy explains what personal data we process in the Add My Task service available at www.addmytask.com (the “Service”), for what purpose, on what legal basis and what rights you have. We apply Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
1. Data controller
The controller of your personal data is Kamil Kajzer. For all matters concerning personal data you can contact us by email at: kamilkajzer@gmail.com.
The controller has not appointed a data protection officer.
2. What data we process
- Account data: email address and username. When you sign in with Google, we receive from Google your email address, first and last name and the address of your profile photo (we do not display the Google photo in the Service).
- Password — if you set one. We store only its encrypted hash, so nobody, including the controller, knows it.
- Avatar: the chosen background colour and, if you upload one, a profile photo. Before it is sent, the photo is reduced in your browser to a 256×256 pixel thumbnail, which removes its metadata (e.g. location and camera model).
- Content you create: board names, tasks, their descriptions, calendar dates (dates and times), task locations (place name or address and map coordinates), assigned people and the change history (who changed a task and when). If you use Projects — also project and stage names, the budget, the currency and the cost and income amounts assigned to tasks. Projects are visible only to you (other board members cannot see them).
- Device location — only when you click “My location” (for a task location or a route) and allow it in your browser. The location shown on the route map stays only in your browser. When setting a task location, the coordinates are sent to our server to find the place name, and we store them only when you save them as the task location.
- Data of invited people: when you invite someone to a board, you provide their email address. We store it together with a name made from the first part of the address and send the invitation to it.
- Technical data: IP address, browser and device information and the time of requests, recorded automatically in server logs. On your first visit to the home page we use the country determined by Vercel from your IP address and the browser language to show the page in the right language — only while displaying the page, without storing it.
- Correspondence: the content of messages you send us (e.g. questions, complaints, content reports).
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Creating and maintaining the account, signing in (including sending the sign-in code), sharing boards and tasks, searching for addresses and showing tasks on the map | Art. 6(1)(b) GDPR — performance of the service agreement (Terms of Service) |
| Sending a board invitation to a person whose address was provided by another user | Art. 6(1)(f) GDPR — legitimate interest of the inviting person and the controller in enabling collaboration |
| Ensuring the security of the Service, detecting abuse, technical logs | Art. 6(1)(f) GDPR — legitimate interest of the controller |
| Handling correspondence, complaints and reports of illegal content | Art. 6(1)(b), (c) and (f) GDPR — performance of the agreement, legal obligations (including the Digital Services Act), legitimate interest |
| Establishing, pursuing or defending claims | Art. 6(1)(f) GDPR — legitimate interest of the controller |
Providing an email address and username is voluntary, but without them it is not possible to create an account and use the Service. We do not make decisions about you based solely on automated processing, including profiling.
4. Who we share data with
We entrust data to service providers who process it on our behalf and on our instructions:
- Supabase Inc. — database, user sign-in and storage of the Service’s content. The database is located in a data centre in Ireland (European Union);
- Vercel Inc. — hosting (the servers the Service runs on);
- Google — signing in with a Google account (if you use it).
- Brevo (Sendinblue SAS, France, EU) — sending emails (sign-in codes, invitations, email address change confirmations). Brevo receives the recipient’s address and the content of the message; data is processed in the European Union.
- OpenStreetMap Foundation (United Kingdom) — the Nominatim address search. Requests are sent by our server and contain only the text you typed (address, place name) or coordinates — without your IP address, email address or other account data. The base map is described in section 8.
Your username, avatar (photo or colour), email address and board content are visible to the other members of the boards you belong to. We store the profile photo in Supabase (Ireland) at an address containing a random identifier of your account — we do not publish it anywhere outside the boards, but anyone who is given this address can see it. We may also disclose data to public authorities if required by law.
5. Transfers of data outside the European Economic Area
Your account and content are stored in a database in Ireland (EU). However, the providers (Supabase, Vercel, Google) are based in the USA or use infrastructure outside the EEA — this applies, for example, to the servers the application runs on, signing in with Google and technical support. In that case, data is transferred on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) — for certified entities — or standard contractual clauses adopted by the European Commission. The OpenStreetMap Foundation is based in the United Kingdom, for which the European Commission has found an adequate level of data protection. You can obtain a copy of the safeguards by writing to kamilkajzer@gmail.com.
6. How long we keep data
- Account data and content — until the account is deleted. Tasks and change history are deleted earlier if a board member deletes them or if the owner deletes the whole board (together with the content added by all its members). Archiving a board does not delete data — the board is simply no longer shown in the global calendar. Projects (budget, stages, amounts) are kept until you delete them or delete your account; a task deleted from a board also disappears from the project, and archiving a project deletes nothing. After deletion, data may remain in backups for up to 30 days.
- Profile photo — until you change or remove it in account settings or delete the account.
- Data of an invited person — until they join the board (it then becomes account data), are removed from the board, the board is deleted, or they successfully object.
- Task assignments after removal from a board — when the board owner removes you from the members, you lose access to the board, but your name and email address remain on the tasks you were assigned to (so that others know who worked on them). We keep them until the assignment, task or board is deleted, your account is deleted, or you successfully object.
- Technical logs — according to the providers’ settings, usually no longer than 30 days.
- Correspondence — for as long as needed to handle it, and then until any claims become time-barred.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15 GDPR);
- rectification of data (Art. 16 GDPR);
- erasure of data (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing based on legitimate interest (Art. 21 GDPR);
- lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
To exercise your rights, write to kamilkajzer@gmail.com. You can change your username, avatar, email address and password yourself in account settings (“Your account”). There you can also delete your account with the “Delete account” button — this deletes your account, your profile with the photo and the boards you own (also for the people invited to them), and on all other boards removes you from members and assignments and anonymises your history entries.
8. Cookies and browser storage
The Service stores on your device only information that is strictly necessary for the service you request. Under Article 399 of the Polish Electronic Communications Law, this does not require your consent. We do not use analytics, advertising or tracking cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
sb-…-auth-token | cookie (Supabase) | Keeping you signed in | Until you sign out or the session expires |
sb-…-code-verifier | cookie (Supabase) | Securing sign-in with Google | For the duration of sign-in |
kanban-theme | browser storage (localStorage) | Remembering the chosen colour theme | Until browser data is cleared |
kanban-calendar-… | browser storage (localStorage) | Remembering calendar, task list and global map settings (view, visible people and boards, the “Only mine” filter, last chosen board) | Until browser data is cleared |
kanban-map-… | browser storage (localStorage) | Remembering task map settings (period, hiding done tasks, route settings) — without location or addresses | Until browser data is cleared |
kanban-maps-ok | browser storage (localStorage) | Remembering that “Show map” was clicked (the map then loads without asking) | Until browser data is cleared or “Don’t load maps automatically” is clicked |
amt-lang | cookie | Remembering the chosen language (the “Choose your region and language” window on the home and sign-in pages, the app menu, account settings) | 1 year or until browser data is cleared |
cookie-notice-ok | browser storage (localStorage) | Remembering that the cookie notice was closed | Until browser data is cleared |
You can delete or block this data in your browser settings. However, blocking cookies will prevent you from signing in to the Service.
The fonts used in the Service are served from our server — your browser does not connect to Google servers for this. Links to our social media profile (e.g. Instagram) lead to external services that apply their own privacy rules.
On the home page and in the Help Center there is a video presenting the Service, published on YouTube (Google Ireland Limited). Until you click the play button, we show only an image from our server — your browser does not connect to YouTube. After you click, the player loads from the youtube-nocookie.com domain (privacy-enhanced mode), and Google receives, among other things, your IP address and browser information and may store its own data in your browser, in accordance with the Google Privacy Policy. If you do not want this, do not play the video.
Task maps (task location, the board map and the map of all boards) use the OpenStreetMap base map provided by the OpenStreetMap Foundation (United Kingdom). The map loads only after you click the “Show map” button — your browser then downloads map tiles directly from OpenStreetMap servers, which receive your IP address, browser information and the map area being viewed, in accordance with the OpenStreetMap Foundation privacy policy. These servers do not store cookies in your browser. The “Google Maps” and “Open in Google Maps” links open the Google service (Google Ireland Limited) in a new tab or app — they pass it the coordinates of the places on the route, and from that moment the Google Privacy Policy applies. The GPX route file is created in your browser without sending it to a server.
9. Changes to this policy
We may update this policy, e.g. when the Service’s features or providers change. The current version is always available on this page, and we will inform you of significant changes in the Service or by email. The rules for using the Service are set out in the Terms of Service.