1. Who we are
TaskOnTime ("the app", "we", "us") is a task reminder, proof, verification and escalation app for businesses. It is published on Google Play by Yogesh Deshmukh, Pune, Maharashtra, India. Contact: dyogesh46@gmail.com.
This policy explains how we handle personal data when you use the TaskOnTime Android app, its WhatsApp features and its web pages. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the Google Play User Data policy.
2. Your company and us
TaskOnTime is used by organisations (a "company" or "workspace"). The person who creates the company (the owner) and its admins decide who is invited, which tasks are created, which proofs are required and who receives WhatsApp updates.
- For your account data (name, mobile number, email address, language, push token, login records) we decide why and how it is processed. We act as the Data Fiduciary.
- For workspace content (tasks, comments, proofs, verification decisions, reports and the task history of a company) the company decides the purpose, and we process it on the company's behalf. We act as its Data Processor. Requests about workspace content should normally go to your company's owner/admin, and we will help them respond.
3. Data we collect
| Category | What exactly | Source | Required? |
|---|---|---|---|
| Identity & contact | Your full name and mobile number (used as your login; the login code is sent on WhatsApp) | You, or the company admin who invites you | Mobile number or email is required |
| Email address | Only if you log in with email or a company invites you by email: used as your login (a one-time code is emailed to you) and to match invites. Never used for marketing and never shared. | You, or the company admin who invites you | Optional |
| Account & settings | User ID, language (English/Hindi), WhatsApp opt-in setting, the companies you belong to, your role, team, manager, backup person, leave dates, points | You / your company admin | Required |
| Task data | Task titles and descriptions, categories, party (customer/vendor) names and phone numbers, amounts, due dates, priority, watchers, comments, extension requests and reasons, transfer reasons | You and your team members | Required to use the app |
| Proofs | Photos, screenshots and documents (PDF, invoices, receipts) you upload or send on WhatsApp as proof, UTR/payment reference numbers, amounts received, text notes | You | Needed only when a task asks for proof |
| Precise location | GPS latitude/longitude and time, captured only at the moment you take a "location photo" proof with the camera, and stored with that proof | Your device (foreground only) | Optional. Only for tasks that require a location photo. |
| Activity & accountability records | When a task was created, assigned, viewed, acknowledged, reminded, escalated, transferred, verified; reminder and alarm delivery; WhatsApp delivered/read status | The app and our servers | Required (core feature) |
| Device & notification data | Push notification token (Expo / Firebase Cloud Messaging), app version, device platform | Your device | Required for reminders |
| WhatsApp message metadata | Your WhatsApp number, message IDs, template name, time sent/delivered/read, and the text or media of messages you send to the TaskOnTime WhatsApp number (e.g. "DONE #T123", a proof photo) | Meta WhatsApp Cloud API | Only if WhatsApp updates are on |
| Technical logs | IP address, time of request, error messages, recorded by our hosting provider when the app talks to the server | Automatically | Required for security |
| Support messages | Anything you write to us by email | You | Optional |
We do not collect your contacts list, call logs, text messages, other apps, browsing history, advertising ID, background location, or health or financial account information. We do not use advertising, analytics or tracking SDKs. Gallery photos are chosen through Android's system photo picker, so the app only sees the photos you pick.
Data about other people: when you add a staff member, a customer ("party") or an external watcher by name and phone number, you confirm that you are allowed to share it with us for the task and that the person expects to receive task-related messages.
4. How we use data
- Provide the service: log you in with a one-time code sent on WhatsApp or by email, show your tasks, schedule reminders and alarms, run the escalation and transfer rules your company set, collect and show proofs, and record verification.
- Notifications: send push notifications, full-screen alarms and WhatsApp messages about tasks, plus daily/weekly summaries your company has set up.
- Accountability: keep a tamper-evident task history and compute dashboards, scorecards (on-time %, escalations, extensions) and optional points for your company.
- Security & fraud prevention: protect accounts, rate-limit OTPs, flag duplicate UTR numbers within a company, investigate abuse.
- Support & legal: answer your requests, comply with law and valid government orders.
We process your data based on your consent, which you give when you sign in and accept this policy, and for legitimate uses allowed under Section 7 of the DPDP Act (for example, when you voluntarily provide data for a purpose, or to comply with law). You may withdraw consent at any time by deleting your account (section 10). Features that need that data will then stop working.
We never sell personal data, never use it for advertising, and never use proof photos or task content to train AI models.
5. Phone permissions the app asks for
| Permission | Why | Data sent to server? |
|---|---|---|
Notifications (POST_NOTIFICATIONS) | Show task reminders, escalations and approvals | Only the push token |
Alarms & reminders (SCHEDULE_EXACT_ALARM) | Ring the reminder at the exact due time, even offline | No |
Full-screen alarm (USE_FULL_SCREEN_INTENT) | Show the alarm screen over the lock screen at reminder time | No |
Camera (CAMERA) | Take proof photos and location photos | Only the photos you submit as proof |
Precise location (ACCESS_FINE_LOCATION), while using the app only | Stamp a location photo proof with GPS coordinates | Only the coordinates attached to that proof |
| Run at start-up, vibrate, wake lock | Re-schedule alarms after the phone restarts, and ring and vibrate | No |
You can turn any permission off in Android Settings. The related feature will then not work, for example no location photo proof, or reminders that are less precise.
6. WhatsApp messages
TaskOnTime sends task updates through the official Meta WhatsApp Business Platform (Cloud API) using pre-approved "utility" templates. These are task notifications only, never marketing. When your company invites you, you receive WhatsApp messages about your tasks unless you turn WhatsApp off in More → Profile, ask your company admin, or email us. External contacts (e.g. a customer or CA added as a watcher) can ask the company or us to stop at any time, and we will stop.
When you reply to our WhatsApp number (text, photo or PDF), Meta delivers the message to our server. We use it only to match it to your task, save it as proof or a command, and keep an audit record. Meta's own handling of WhatsApp data is described in the WhatsApp Business policies and WhatsApp Privacy Policy.
7. Who we share data with
Inside your company
Other members of your company see task data according to their role: a manager sees their team's tasks, a verifier sees the proofs of tasks they verify, and owners/admins see the whole company. Your name, tasks, proofs (including location photo coordinates), task history and scorecard are visible to the people your company's hierarchy allows. External watchers your company adds receive WhatsApp updates about the tasks they watch.
Service providers (processors)
They process data only on our instructions, under contract, to run the app:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. (on Amazon Web Services) | Database, login (OTP), file storage, server functions | All app data | India, AWS Mumbai region (ap-south-1) |
| Meta Platforms (WhatsApp Cloud API) | Send WhatsApp login codes and task messages, and receive replies | Phone number, login code, message text/media, delivery status | Meta's global infrastructure |
| Expo (650 Industries, Inc.) Push Service and Google Firebase Cloud Messaging | Deliver push notifications and alarm triggers | Push token, notification title/text, task ID | USA / global |
| Resend (resend.com) | Send the login code email (only for email login) | Email address, login code | USA / global |
| Google Play | App distribution, crash reports that you choose to share with developers | As per Google's policy | Global |
Legal reasons
We may disclose data if Indian law, a court or a competent government authority requires it, or to protect the rights, safety or property of users or the public. If the app is transferred to another entity, for example a company Yogesh Deshmukh forms to run it, your data will move with it under this policy, and we will notify you.
8. Where data is stored
The TaskOnTime database and uploaded files are hosted in India (Mumbai). Some processors listed above (Meta, Resend, Expo, Google) may process limited data outside India to deliver messages. We only use such transfers as permitted by the DPDP Act, and not to any country restricted by the Government of India.
9. How long we keep data
| Data | Kept for |
|---|---|
| Account data (name, phone, email, settings, push token) | While your account is active. Deleted within 30 days of your deletion request. |
| Workspace content (tasks, proofs, comments, task history) | While the company's workspace exists, or until the company deletes it. After you leave or delete your account, the company keeps its business records with your name shown as "Deleted user" (see section 10). |
| Proof files uploaded by a company | Until the task or company is deleted by the company owner/admin, or the company workspace is closed. Then removed from storage within 30 days. |
| Notification and WhatsApp delivery records | Up to 12 months, then deleted or anonymised |
| Security and access logs | At least 1 year, as required by the DPDP Rules 2025 for security safeguards, then deleted |
| Database backups | Rolling, overwritten within about 7 days (deleted data disappears from backups in that time) |
| Inactive accounts | If an account has no sign-in for 3 years, we may delete it after giving at least 48 hours' notice |
| A closed company workspace | Deleted within 30 days after the owner closes it, except records we must keep by law |
10. Deleting your account and data
In the app: open More → Delete account, confirm, and your account is scheduled for deletion.
On the web: follow the steps at businessautomate.in/taskontime/delete-account.html, or email dyogesh46@gmail.com from any address with your registered mobile number or email. We verify ownership first, for example with a one-time code on WhatsApp or by email.
What is deleted (within 30 days): your profile (name, mobile number, email address, language), login, push token, WhatsApp preferences, company memberships, summaries you subscribed to, and your points ledger.
What your company keeps: tasks, proofs, comments and the tamper-evident task history are business records of the company you worked for. The company needs them for audit and accountability. We keep them in that company's workspace with your identity removed ("Deleted user"). To erase specific workspace content, ask your company owner/admin, or email us and we will pass the request on. If you are the only owner of a company, transfer ownership first or close the company. Closing it deletes the whole workspace.
You can also ask us to delete specific data without deleting your account, for example an old proof or your location coordinates. Use the same email.
11. Security
- All traffic between the app, WhatsApp and our servers uses HTTPS/TLS encryption. Data is encrypted at rest by our hosting provider.
- Row-level security isolates every company's data. Proof files are in a private storage bucket and are shown only through short-lived signed links.
- The task history is append-only and hash-chained, so changes can be detected.
- Admin access to production systems is limited and protected with strong authentication.
- If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Rules, 2025.
No system is 100% secure. Please keep your phone locked and do not share OTPs.
12. Your rights under the DPDP Act, 2023
As a Data Principal you have the right to:
- Access a summary of your personal data we process and of the processing activities, and the identities of the parties we shared it with;
- Correct, complete or update your data (you can edit your name and language in the app; ask your admin or us for anything else);
- Erase your data (section 10), unless we must keep it by law;
- Withdraw consent at any time, as easily as you gave it;
- Grievance redressal through our Grievance Officer (section 15). We will respond within 90 days at most, as required by the DPDP Rules, and usually much faster;
- Nominate another person to exercise your rights in case of death or incapacity;
- Complain to the Data Protection Board of India after using our grievance process.
To use any right, email dyogesh46@gmail.com from your registered details or with your registered mobile number or email. We may verify your identity first.
13. Children
TaskOnTime is a workplace tool meant for people 18 years or older. It is not directed at children, and we do not knowingly collect data of anyone under 18. If you believe a child's data has been added, contact us and we will delete it.
14. Changes to this policy
We may update this policy when the app or the law changes. We will change the "Effective" date above and, for important changes, notify you in the app or on WhatsApp before they apply.
15. Grievance Officer & contact
Grievance Officer / Data Protection contact: Yogesh Deshmukh
Email: dyogesh46@gmail.com
Address: Pune, Maharashtra, India
We acknowledge grievances within 7 days and resolve them within 30 days where possible, and in any case within the time the law requires.