Privacy Policy

1. What this covers

This policy describes what information GSD (project-gsd.com) collects, how it is used and stored, and the choices you have. GSD is an invite-only personal task manager in beta; we collect only what the Service needs to work.

2. Information we collect

• Account data — your email address and a hashed password (passwords are never stored in plain text), plus display preferences such as theme and notification settings.
• Your content — the lists, tasks, subtasks, notes, tags, and saved filters you create; files you attach to tasks; and contacts you add to your workspace (a name and optional email, visible only to you). Items you remove are archived and restorable until permanently deleted — by you, or automatically after your configured retention period (30 days unless you change it; you can also choose to keep archived items until you delete them). We also keep a completion history — task and subtask completion records with titles, list names, and timestamps, kept to power your accomplishments reports.
• Activity records — an audit log of sign-ins (including failed attempts) and actions taken in your workspace, recording the time, action, IP address, and browser identification (user-agent). Audit entries are kept in the live database for 90 days and then moved to archival storage. Notification-feed entries are also stored.
• Server logs — standard technical logs (request paths, status codes, errors) kept for troubleshooting.

We use no analytics or advertising trackers.

3. Where your data lives

All data is stored in Amazon Web Services (us-east-1, USA): structured data in a PostgreSQL database (Amazon RDS, encrypted at rest) and file attachments and audit archives in Amazon S3 (server-side encrypted). Connections use TLS. Server logs are retained for one month. Automated encrypted database backups are kept for 7 days, then age out. No user content is sent to any AI system.

4. Cookies

GSD sets a single essential session cookie to keep you signed in, and a small preference cookie that remembers your light/dark theme. There are no third-party, analytics, or advertising cookies, so there is no cookie banner to click.

5. Email

We send transactional email only — currently invitation emails, via Amazon SES. No marketing email, and your address is never shared for marketing.

6. Retention and deletion

You can permanently delete individual archived items (or empty the archive) from Settings → Archived items; archived items are also deleted automatically after your retention period, as described in section 2. To delete your entire account, use the Delete-account option on your Account page: deletion is immediate and permanent, removing your account, lists, tasks, attachments, contacts, and notification feed. Audit entries are retained as described in section 2, with your account identity detached upon deletion. Account deactivation by the administrator is reversible and preserves your data. Backups age out on the schedule in section 3.

7. Sharing

We do not sell personal data. We disclose information only if legally compelled (e.g., a valid legal process), and only the minimum required.

8. Your rights

You can download a machine-readable export of your data (Account → Download my data) and permanently delete your account (Account → Delete account) at any time, without asking us. For anything else — or if you prefer we handle it — contact the address below.

9. Children

The Service is not directed at children under 13.

10. Changes and contact

We may update this policy; the "Last updated" date above reflects the current version. Questions or requests: [email protected]. See also the Terms of Service.