Privacy Policy

Last updated: 10.5.2026

Who we are

Checked Off is software published by 321 Oak, Inc., a Pennsylvania corporation. You can reach us at [email protected].

What this policy covers

This Privacy Policy describes what data Checked Off collects, how we use it, and what choices you have about it, during the beta period. By using our service, you confirm that you agree to this Privacy Policy.

WE URGE YOU TO READ THIS PRIVACY POLICY AND BE SURE YOU UNDERSTAND AND AGREE TO IT. IF YOU DO NOT AGREE WITH THE PRIVACY POLICY PLEASE STOP USING OUR SERVICES.

This policy covers:

• The Checked Off application, available on Windows, macOS, Linux, Android, and iOS
• Our website at 321oak.com (informational only — no account creation, no user data collected through the website beyond standard server logs)
• Our communications with you about beta participation

This policy does not cover:

• Data handling by third-party AI providers you choose to use via Checked Off's MCP AI features. Those are governed by the provider's own policies. You should review and understand those policies before you enable MCP access. We describe how MCP works in the sections AI features and third-party providers below.
• Data handling by other third parties (such as your email provider or internet service provider).

What data we collect

Anonymous usage analytics

Checked Off collects structured event data from usage. Collection is a condition of beta participation — beta testers consent to this at recruitment, and there is no in-app toggle to disable collection during the beta period.

What we collect: approximately 21 event types covering:

• App lifecycle — when the app starts, ends, or crashes, and how long sessions last
• Feature activation — which features are used: projects, tasks, routines, domains, tags, AI suggestions, daily list, welcome-back flow
• Workflow patterns — whether you assign dates to tasks or work date-free; whether you complete tasks from the daily list, directly, or via routines; when the welcome-back flow fires after absences
• Error events — what type of error occurred and in which feature area, recorded as enumerated values only. No error messages, no stack traces, no captured application state

Each event carries:

• A persistent anonymous install identifier, created when you agree to analytics and attached to every event from your installation. It is not tied to your name, email, or account. There is no opt-out from this identifier during the beta period.
• App version
• Operating system and OS version
• Platform (Windows / macOS / Linux / iOS / Android)
• Device architecture (x64 / ARM64)

This lets us distinguish platform-specific issues across the surfaces Checked Off runs on.

Approximate location: PostHog, our analytics processor, derives an approximate location (city, region, postal code) from the IP address your device connects from when transmitting events. We do not separately collect or store precise GPS or device location.

What we never collect in analytics events:

• Task content — titles, descriptions, notes, or any content inside a task
• Project, domain, or tag names
• AI prompts or AI responses
• Any free-text input you provide except for the description in a bug report
• Personally identifying information beyond the install identifier and approximate location described above

Error events specifically never contain error messages, stack traces, or application state. Only the enum-valued error type and feature context are transmitted.

Where this data goes: analytics events are transmitted to PostHog, acting as our analytics processor. We have a data-processing agreement with PostHog under their standard terms. PostHog does not use your data for their own purposes. PostHog's own privacy policy governs their data handling: https://posthog.com/privacy. PostHog data is hosted in the US region.

How and when we transmit: events are buffered on your device and transmitted to PostHog in small batches approximately once per minute during active use, and on app close. If the app crashes, pending events are transmitted on the next app launch. If your network is unavailable, events are retained on your device and transmitted when connectivity returns. Old buffered events are dropped if they cannot be transmitted within a reasonable window — this prevents the buffer from growing indefinitely if you are offline for an extended period. All transmission is over TLS.

What PostHog features we use: events only. We do not use PostHog's session replay, heatmaps, or autocapture features. Our instrumentation is deliberate — we only record what we have named in the event list above.

Bug reports

When something goes wrong in Checked Off, you may choose to file a bug report using the in-app "Report a bug" composer.

What a bug report includes by default:

• App version, commit identifier, and build variant (beta)
• Your operating system and its version
• The time you filed the report (with your local time zone)
• The name of the screen you were on when you filed (for example, "Daily View" or "Task Grid")
• The last 20 types of actions you took in the app, labeled only by type — for example, "opened_daily_view" or "toggled_column_picker." Action labels are fixed enumerated values; they never contain what you typed or named
• A summary of what was on the current screen — counts and settings such as "15 tasks visible, 3 columns hidden, today filter active." Summaries contain counts and fixed-value settings only, never the content of your tasks, projects, notes, or any free-text input
• Whatever description you type into the report

What you can optionally attach:

• Structured data for the item you're reporting on. If you turn this option on, we include the structured fields of the specific task, project, or other item — dates, tags, settings, energy level, recurrence rule, completion status, and similar fields — plus anonymous identifiers for related projects, tags, parent and subtasks, or blockers. We never include what you typed: titles, descriptions, notes, waiting conditions, and blocker notes are always removed. This option is off by default. When on, a preview shows you exactly what's being sent before you submit, with the redacted fields clearly marked.
• A diagnostic log from the current session. This is a local log of technical details about errors and application state from this session. It is stored on your device and never transmitted unless you attach it to a bug report. When attached, a preview shows the log contents before you submit; you can remove individual lines before sending. This option is on by default, because the log is usually the most diagnostic part of the report, and because the preview + redact step means you see exactly what will be sent.

What happens if Checked Off crashes: when Checked Off crashes (as opposed to an error you were shown), an anonymous app_crashed event is included in the next analytics transmission. On the next app launch, a dismissible banner asks whether you'd like to file a report about the crash; the report composer opens pre-populated with the diagnostic log from the crashed session (which Checked Off saves locally for this purpose). You're free to dismiss the banner without filing anything; the anonymous app_crashed analytics event fires either way.

Where bug report data goes: bug reports are transmitted to the same PostHog project as analytics events, as a distinct event type. We chose this so Checked Off's maintainers can cross-reference bug reports against the anonymous analytics event stream in the same system. Bug report size is capped to PostHog's per-event limits; if an attached diagnostic log exceeds the cap, it is truncated and marked as such. If you need to send a larger log, you can export it from Settings and email it to us directly.

AI features and third-party providers

Checked Off offers optional AI-assisted features that require you to enable MCP protocol from an AI provider.

What your connected AI application can access, when AI access is turned on:

• Read access to your tasks, projects, and notes. Not limited to the item you're asking about — your AI application decides what to look up as part of responding to you.
• The ability to add new tasks, projects, and notes.
• The ability to change things you already have — dates, status, and similar fields on existing tasks and projects.
• The ability to replace text you've already written — for example, a task or project description. What's there is overwritten, not appended.
• It can never delete anything. Deleting is something you do in the app itself; this connection has no ability to remove data, enforced in the software itself, not just as a policy.

What Checked Off itself never does:

• Checked Off does not transmit your data to an AI provider. Your connected AI application, using your own account with your own provider, reads and writes your Checked Off data directly on your device — Checked Off's servers are never in that path.
• We do not see, log, or retain anything your AI application reads or writes through this connection.

Your control: you can enable MCP access at any time in Settings, remove it at any time to immediately disable AI features, or use Checked Off indefinitely without configuring any AI key. AI features are optional; the app is fully functional without them.

Account information

You don't need an account to use Checked Off's free tier. An account is required if you opt into Sync or purchase Plus.

You can sign in with an emailed one-time code, or with Google or Apple. Signing in with Google or Apple only confirms your basic identity — we do not receive your Google or Apple password.

For your account, we store: your account ID and email address; hashed sign-in-code state; a record that your account was deleted, if applicable; and a temporary email-delivery log, purged after 30 days. This data is hosted on Cloudflare; Resend, our transactional email provider, sends the sign-in-code emails.

You can delete your account and its data in the app, or through a public deletion page. Deleting your account removes your account data, synced files, and entitlement record. See How long we keep your data below for what happens after deletion.

Sync

Sync lets your data follow you across your devices. It's optional, off by default, and included at no extra charge on both the Free and Plus tiers.

Your data is encrypted on your device before it's uploaded for syncing. We see only file sizes, timestamps, file counts, and your account email — never the content of your synced data. Local data on your device that isn't being synced is not encrypted.

Turning Sync off on a device stops syncing on that device only. From any device you can also turn Sync off everywhere and delete your synced data; we start deleting it right away, with no grace period, and turning Sync off on your last synced device deletes it as well. Your other devices find out the next time they connect. We delete your encrypted files from our servers right away, and they stop being available to anyone. Our hosting provider may keep recovery copies of related database records for up to 30 days, and short-lived operational logs for up to 7 days, before they are purged. Your synced content is encrypted, so it stays unreadable to us and to our host, including in any such copies.

Payment and subscription information

If you purchase Plus, your payment is handled by Paddle (our website and the Microsoft Store), Google Play (Android in-app purchase), or Apple (in-app purchase, once available on iOS/Mac) — never by us directly.

These processors share your account ID and purchase receipts with us, and with RevenueCat, our entitlement-tracking provider, so that Checked Off knows what your account is entitled to across purchase paths and platforms.

What we receive is limited to what we need to manage your subscription: your Plus status and its end date, and transaction details such as the purchase amount and date, a transaction ID, and the payment method type, including, for card payments through Paddle, the last four digits, expiry date, and cardholder name. Paddle, as the seller of record for those purchases, also holds your name, email, billing address, and tax details, and can make them visible to us in our Paddle account for support, refund, and tax purposes.

Communications

We do not require any personal information to participate in beta. If you contact us via email or Discord, we will use the contact information you provide to respond to messages you send us (bug reports, feedback, support questions). Emails to [email protected] arrive in a support inbox hosted within our PostHog account, and may be handled using AI tools and other service providers as part of responding to you.

We will not send you a newsletter, marketing communications, or promotional content unrelated to your beta participation unless you explicitly opt in or, if after the beta test is concluded, we modify our privacy policy and you continue to use our services.

Your email address is stored in our email sending tool (MailerLite) and our contact email inbox. It is not transmitted with analytics events or bug reports; they remain anonymous. We have a data-processing agreement with MailerLite under their standard terms. MailerLite data is hosted in the EU region.

What we deliberately don't collect

• We don't collect task content, project names, domain names, tag names, or any other free-text information you type into the app.
• We don't use third-party analytics outside of PostHog (no Google Analytics, no Facebook pixels, no advertising trackers).
• We don't share your data with advertisers or data brokers.
• We don't share your personal information with any third parties for their direct marketing purposes.
• We don't collect biometrics or precise device location.
• We don't use session replay, screen recording, keystroke logging, or any similar capture technology.
• We don't track your activity across other websites or applications.

Do Not Track signals

We do not respond to Do Not Track ("DNT") browser signals in any version of Checked Off (desktop or, in the future, browser-based). Our in-app analytics collection is governed by the recruitment-gated consent model described above, which applies regardless of any browser-level DNT signal. Our website does not use tracking technologies that respond to DNT signals.

How your data flows

For clarity, the data pathways you should know about are:

1. Your task data stays on your device in a local SQLite database file. It is never transmitted to Checked Off's servers, unless you opt into Sync (see below). You can back it up yourself, open it with any SQLite tool, and take it with you if you ever stop using Checked Off.
2. Anonymous analytics events flow from your device to PostHog, our analytics processor. They contain no task content, no names, and no free-text input.
3. Bug reports you choose to file flow from your device to PostHog as distinct events. They contain what you chose to include, with preview and redaction before you submit.
4. If you enable MCP access, your connected AI application reads and writes your Checked Off data directly on your device — what it then does with that data, including whether and how it contacts an AI provider, is between that application and its own provider. This never transits Checked Off's servers.
5. If you enable Sync, your data is encrypted on your device and the encrypted files flow to Cloudflare, which stores them and relays them to your other signed-in devices. Cloudflare cannot read your synced content.
6. If you purchase Plus, purchase and receipt data flows from Paddle, Google Play, or Apple to us and to RevenueCat, so your account's entitlement can be recognized across devices and platforms.
7. Emails to or from us flow through standard email infrastructure (our Google Workspace account for general mail; PostHog's support inbox for [email protected]; Resend for account sign-in codes; your email provider).

Who has access to your data

Within 321 Oak, Inc.:

• Jill Stapleton (founder) has access to PostHog analytics and bug reports, and to account data, and your email communications. Sara Stapleton (legal counsel) has access to documents, not to tester data, and only as needed for legal advice.

Outside 321 Oak, Inc.:

• PostHog (our analytics processor, and host of our support inbox) holds analytics, bug report, and support-email data under a data-processing agreement.
• Claude (an AI assistant used as a product-development tool) has read-only PostHog API access for querying analytics and bug reports during product-development sessions, and may assist in responding to support emails.
• Cloudflare hosts our account database and, if you use Sync, your encrypted synced files. We have a data-processing agreement with Cloudflare under their standard terms.
• Resend sends account sign-in-code emails and sees the recipient address and code.
• Slack receives notices when a support ticket comes in — the customer's name and email, but not the message text — plus aggregate alert counts. We have a data-processing agreement with Slack under their standard terms.
• If you purchase Plus: Paddle, Google Play, or Apple (whichever you purchased through) and RevenueCat receive your account ID and purchase/receipt data. We have data-processing agreements with Paddle, RevenueCat, Google, and Apple under their standard terms.
• If you sign in with Google or Apple: that provider confirms your basic identity to us. We do not receive your password.
• Your chosen AI provider receives the AI requests you invoke, under your account with them.
• Our email provider (Google Workspace) holds our general email communications with you.

We do not sell, rent, or share your personal data with any other parties.

How long we keep your data

• Analytics events: retained in PostHog for the duration of the beta program plus a reasonable wind-down period. We expect to review retention policy at beta close and publish an updated policy with specific timelines for general availability.
• Bug reports: retained in PostHog for the duration of the beta program. After beta close, we will review which reports to retain for continued product improvement and delete the rest.
• Account data: retained while your account is active. If you delete your account, backups held by our hosting provider may retain deleted rows for up to 30 days, after which they are purged. We keep an identifier-only record that a deletion occurred for 90 days.
• Synced data (if you use Sync): kept while you use Sync, and deleted when you choose to delete it or turn Sync off on your last synced device. Our hosting provider may keep recovery copies of related database records for up to 30 days, and short-lived operational logs for up to 7 days, after deletion.
• Email communications: retained in our email system per standard business retention practices.
• Your task data on your device: indefinite, under your control. If you delete the data file, the data is gone.

Your rights and choices

During the beta:

• You can stop participating in the beta at any time by uninstalling Checked Off.
• If you have an account, you can delete it and its associated data (account data, synced files, entitlement record) in the app, or through a public deletion page. If you don't have an account, you can request deletion of your anonymous analytics events and any bug reports you filed by emailing [email protected] — because those events carry only an anonymous install identifier and no persistent user ID unless linked to an account, we can delete data tied to your identifier where we have a link, or delete all data received during the beta if you prefer.
• You can revoke your consent for analytics collection during the beta by discontinuing use and uninstalling the app. (Because analytics is a condition of beta participation, disabling collection while continuing beta use is not something we can offer at the moment — this may change at general availability.)
• You can correct information you sent us by emailing [email protected].

If you are a resident of a state with specific privacy rights, you may have additional rights once we hit certain thresholds, including rights of access, erasure, correction, portability, objection, and complaint. To exercise these rights, email us at [email protected] and we will respond as soon as reasonably practicable.

California residents — additional notices

This section applies to residents of California.

Categories of personal information. The categories of personal information we collect and the purposes are described in the What data we collect and Communications sections above. We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising.

Your rights. California residents may request to access, correct, or delete personal information we hold about you, and may request a list of the categories of personal information we have shared (if any) with third parties for direct marketing. Email [email protected] to exercise these rights. We will respond as soon as reasonably practicable.

Shine the Light disclosure (Cal. Civ. Code §1798.83). We do not share personal information with third parties for those third parties' direct marketing purposes.

Breach notification (Cal. Civ. Code §1798.82). Our breach notification practices, published on our website, comply with California's breach notification timing and content requirements. Notices to affected California residents will be made in the most expedient time possible and without unreasonable delay.

Service intended for U.S. residents. Checked Off is intended for users located in the United States. If you are accessing the service from outside the U.S., your use is at your own risk and may be subject to your local laws, which we do not undertake to comply with.

Where your data is located

• PostHog analytics, bug report, and support-inbox data is hosted in the US region.
• Your task data is on your device, wherever that device is.
• Account data and, if you use Sync, your encrypted synced files are hosted on Cloudflare. Cloudflare's account database has no location setting, so we are not able to claim a specific storage region for this data.
• Our email is hosted in Google Workspace (US infrastructure by default; may be EU-region depending on our account configuration at publication).
• Resend, which sends account sign-in-code emails, processes that data per its own infrastructure.
• Your AI requests go to whichever region your chosen provider routes them.
• MailerLite maintains our email list and this data is hosted in the EU region.

Our service is intended for users located in the United States. Please note that your usage data may transit or be processed in multiple regions, including the United States and the EU. We rely on PostHog's, Cloudflare's, Resend's, MailerLite's, and Google's standard data-transfer mechanisms where applicable.

Security

We take reasonable precautions to protect your data:

• All transmission to PostHog is over TLS.
• If you use Sync, your data is encrypted on your device before it's uploaded — we cannot read its content.
• Your chosen AI provider receives the AI requests you invoke, under your account with them.
• We publish a breach-notification plan on our website describing what we'll do if something goes wrong.
• Checked Off's developers access PostHog through read-only API keys, not through shared passwords.

In the unlikely event of a security breach affecting your data, we will notify affected testers promptly and describe what happened and what we've done about it, per our breach-notification plan.

Children's privacy

Checked Off is not designed for, directed to, or intended for use by anyone under 18. We do not knowingly collect personal data from anyone under 18. Beta participants are expected to be at least 18 years old.

Changes to this policy

We may update this Privacy Policy as the product evolves and as we transition from beta to general availability. Material changes will be communicated to beta testers in advance via in app notice. The current version is always available at 321oak.com/privacy and in the app's Settings → About panel.

Contact

Questions about this policy, requests to exercise your rights, or anything else: [email protected].