Privacy
What is collected, who sees the data and how to control it
What is collected
GPS coordinates
GPS coordinates are recorded only during an active tracking session for a specific task. The app does not record coordinates in the background without your explicit action — pressing Start is required.
GPS tracking is off by default. You can turn it on in Settings → Tracking.
Redmine credentials
Your Redmine login and password are stored locally on the device in encrypted Android storage (Encrypted SharedPreferences). They are used for the direct connection of your device to your company's Redmine.
Exception: for the auto-pause when idle feature, Taskloc keeps an encrypted copy of your Redmine API key on the server — so that the server can leave a note in Redmine when the app on the device is unavailable.
Task cache
The task list, comments and projects are cached locally on the device (Room) and updated when syncing with Redmine.
Diagnostic events
Anonymized crashes and network errors are sent to a self-hosted GlitchTip (hosted in Russia). They contain no coordinates, passwords or message text.
Geofences (optional, off by default)
If you turn on geofence reminders, the app compares your position with the sites pinned to tasks in the background. The coordinates of the sites are stored in your Taskloc account; the processing happens on the device.
Visit log (optional, off by default)
If you explicitly turn on the visit log, when you leave a task site the app sends a structured record to the Taskloc server (arrival time, departure time, site coordinates). Turning it on comes with a separate consent.
Where the data is stored
- Locally on the device: Android Keystore, Encrypted SharedPreferences, Room.
- Taskloc server: PostgreSQL in the Russian Federation (meets the requirements of Russian law 152-FZ).
- GPS retention: indefinite — you can delete any session from Routes. Diagnostic events — 30 days. Visit log — 1 year.
Cookies and local storage (web dashboard)
This section is about the website and the web dashboard in a browser; the Android app does not use cookies.
| Cookie | Purpose | Lifetime | Accessible to scripts |
|---|---|---|---|
nuxt-session | Sign-in session | 30 days | no (httpOnly) |
oauth_web_state | Protects tracker sign-in against a forged response | 10 minutes | no (httpOnly) |
i18n_redirected | The chosen interface language | about a year | yes |
There are no other cookies: we do not set advertising or analytics cookies, do not use third-party counters, and serve fonts from our own servers. That is why the site does not ask for separate cookie consent — all three cookies are strictly necessary for it to work.
Browser local storage (localStorage): a profile cache with your email and name (taskloc:cache:user_profile), caches of the organization list, settings and reference lists, your Redmine address, and a persistent browser identifier (taskloc-device-id) — a random number created on the first sign-in, not a device fingerprint. It is sent to the server with requests and tells your devices apart in the session list.
Tab storage (sessionStorage): the identifier of an unfinished payment — only for the duration of the payment.
Everything listed above lives in your browser and is removed by clearing the site data.
Error collection: interface errors are sent to a self-hosted GlitchTip. It is turned on by an instance setting; if the setting is not set, no reports are sent at all. GlitchTip sets no cookies and leaves nothing in browser storage.
External requests: the only request to a third-party service is for map tiles. With the public map source (used by default), the browser loads them directly from tile.openstreetmap.org, and OpenStreetMap sees your IP address and the address of the page the request came from. With your own tile source, the map loads from Taskloc servers and nothing goes outside.
Who sees the data
- You — all data collected about you.
- Your organization — according to the access policies. Access to other people's routes is possible only through membership in a shared Redmine project.
- Manager (live map) — if the organization has turned on Team online, managers and admins see your location during an active or paused tracking session and only if you share a project with them. Outside a session and with tracking off, you are not on the map. This is monitoring during working hours, turned on by the organization deliberately.
- Third parties — none. The exception is the public map source: OpenStreetMap sees the IP address of the browser that requested the tiles (see "Cookies and local storage").
Your rights
- Viewing routes: the Routes section in the app.
- Deleting a session: swipe the item in Routes → Delete.
- Deleting all local data: Settings → Clear active sessions.
- Signing out: removes the credentials from the device.
- Requesting deletion of data from the server: write to privacy@taskloc.com and include the email of your account.
App permissions
| Permission | When it is requested | Why |
|---|---|---|
| Location (precise) | On the first start of GPS tracking | Recording the route |
| Background location | When turning on geofences | Comparing your position with sites in the background |
| Notifications | On the first start of tracking | A foreground service requires a notification |
| Network | Always | Syncing with Redmine and Taskloc |
The full privacy policy is available in the app: Settings → Privacy → Privacy Policy.