Privacy Policy

1. Who operates Kanvu

Kanvu is a fully hosted web service. The application, the database, and all infrastructure are owned, operated, and maintained exclusively by the Kanvu operator. Users do not host, deploy, or manage any part of the service. You simply sign in and use the platform — everything runs on our secure servers.

2. What data we collect

When you sign in and use Kanvu, we collect and store:

• Google account information — your name, email address, and profile picture, obtained at sign-in via Google OAuth.
• Google Tasks data — task lists, task titles, notes, due dates, completion status, and subtasks that you authorize Kanvu to read and write through the Google Tasks API.
• Workspace data — tasks, subtasks, assignees, list configurations, workspace members, and any other content you create or import inside Kanvu.
• Authentication tokens — encrypted OAuth access and refresh tokens required to communicate with the Google Tasks API on your behalf.
• Usage metadata — timestamps of actions (e.g., task creation, sync events, history entries) used for audit trails and undo functionality within Kanvu.

We do not collect payment card numbers, government-issued identifiers, health information, or any sensitive personal categories beyond what is described above.

3. How your data is stored and secured

All data collected by Kanvu is stored exclusively on servers controlled and operated by the Kanvu operator. We do not use third-party cloud databases, analytics platforms, or data brokers to store your information.

OAuth tokens are encrypted at rest using a strong encryption key before being written to the database, and are never stored or transmitted in plain text.

Access to the database and server infrastructure is restricted solely to the Kanvu operator. No contractors, partners, or external parties have access to production data.

4. Google OAuth and Google API access

Kanvu uses Google OAuth 2.0 to authenticate users and obtain authorized access to the Google APIs. We request only the scopes necessary to provide the service:

• https://www.googleapis.com/auth/tasks — to read and write your Google Tasks lists and tasks.
• https://www.googleapis.com/auth/calendar.readonly and https://www.googleapis.com/auth/calendar.events.readonly — to read your calendar and event details in read-only mode.
• openid, email, profile — to identify you and display your name and avatar within the workspace.

Google Tasks and Calendar data fetched via the APIs is used exclusively to power the Kanvu workspace experience (syncing tasks, displaying lists, enabling kanban views). It is never used for advertising, sold, or shared with any third party.

Kanvu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who can access your data

Only the Kanvu operator has access to the database and stored data. No third parties, sub-processors, or external services have access to your personal information or task data. We do not share, sell, rent, or disclose your data to anyone outside of what is strictly necessary to operate the service (i.e., the Google APIs themselves, which are governed by Google's own privacy policy).

Within a shared workspace, other members of your workspace can see the tasks and lists that are shared with them inside Kanvu — this is a core feature of collaborative task management and is entirely under your control.

6. Data retention

Your data is retained for as long as your account is active and you continue using Kanvu. If you would like your data removed, contact us at the address below and we will delete your account and associated data promptly.

7. Cookies and tracking

Kanvu uses a session cookie to maintain your authenticated session after sign-in. We do not use advertising cookies, third-party tracking pixels, or analytics services that collect personally identifiable information.

8. Your rights

You have the right to:

• Request a copy of the data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data.
• Revoke Kanvu's access to your Google account at any time via your Google Account permissions.

To exercise any of these rights, contact us at [email protected].

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of Kanvu after any changes constitutes your acceptance of the updated policy.

10. Contact

For privacy-related questions or data requests, contact the Kanvu operator at [email protected].