Privacy Policy

1. Introduction

TriggerFlo ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our productivity and task management platform, including our website, desktop applications, and mobile applications (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password.
• Profile Information: Optional information such as profile picture and display preferences.
• User Content: Projects, tasks, comments, time entries, and other data you create within the Service.
• Payment Information: If you subscribe to Pro features, we collect billing information through our secure payment processor (Stripe). We do not store your full credit card number.
• Communications: When you contact us for support, we collect the information you provide.
• Email Preferences: Which optional categories you chose, when you changed them, and where the choice was made.

2.2 Information Collected Automatically

• Usage Data: Information about how you use the Service, including features accessed, actions taken, and time spent.
• Device Information: Device type, operating system, browser type, and unique device identifiers.
• Log Data: IP address, access times, pages viewed, and referring URLs.
• Email Delivery and Engagement: Delivery, bounce, spam complaint, and link-click events for optional emails. We use these to suppress undeliverable addresses and understand whether the emails are useful.
• Cookies: Small data files stored on your device to improve your experience (see Section 8).

2.3 Information from Third Parties

• OAuth Providers: If you sign in using Google or other OAuth providers, we receive your name and email from those services.
• Team Invitations: When invited to a team, we may receive your email address from the inviting user.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send you technical notices, updates, and support messages
• Send only the optional tutorials, product updates, research requests, or promotions you selected
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience
• Sync your data across devices
• Generate aggregated, anonymized analytics

4. Data Storage and Security

4.1 Data Storage

Your data is stored on secure servers provided by trusted cloud infrastructure providers. We use industry-standard encryption for data in transit (TLS/SSL) and at rest.

4.2 Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. You can request deletion of your account and associated data at any time.

4.3 Security Measures

• Encryption of data in transit and at rest
• Secure authentication with hashed passwords
• Regular security audits and updates
• Access controls and monitoring
• Secure payment processing through PCI-compliant providers

Important: While we implement reasonable security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

5.1 With Your Consent

We may share information when you explicitly consent, such as when sharing projects with team members.

5.2 Service Providers

We work with third-party service providers who help us operate the Service:

• Cloudflare: Hosting, CDN, and security services, and AI processing via Cloudflare Workers AI (see Section 6)
• Stripe: Payment processing
• Neon: Database hosting
• Resend: Transactional and optional marketing email delivery, including delivery and engagement reporting
• Anthropic: AI processing, as a fallback for the features described in Section 6

These providers are bound by contractual obligations to keep your information confidential and use it only for the purposes we specify.

5.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request.

5.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. AI Features

Some TriggerFlo features send your content to third-party AI providers for processing. These features are optional. We ask for your permission the first time you use one, and if you decline, everything else in the Service continues to work normally.

6.1 Which Features Use AI

• Voice capture (brain dump): the transcript of what you said, together with the names of the columns in the project you are adding to, is sent so it can be turned into task titles and notes.
• Flo, the in-app assistant: the messages you type and up to the last ten turns of that conversation are sent. So that Flo can answer questions about your work, it can also read your projects, columns, views, tasks, subtasks, and comments, and that content is sent to the provider as part of producing an answer. Flo can propose new tasks, but it cannot create, change, or delete anything without your explicit confirmation.

6.2 Who Processes It

• Cloudflare Workers AI — our first choice for every AI request.
• Anthropic — used as a fallback when Workers AI is unavailable, has exhausted its daily allowance, or returns an unusable result.

Both providers are bound by contractual obligations to keep your information confidential and to use it only for the purposes we specify.

6.3 Models We May Use

The specific models in use today are:

• Voice capture: @cf/meta/llama-3.3-70b-instruct-fp8-fast on Cloudflare Workers AI, falling back to claude-haiku-4-5 from Anthropic.
• Flo assistant: @cf/deepseek-ai/deepseek-v4-flash-0731, @cf/zai-org/glm-4.7-flash, or @cf/openai/gpt-oss-20b on Cloudflare Workers AI, falling back to claude-haiku-4-5 from Anthropic. Where the app offers a model picker, the model you choose is tried first.

We may change which models we use as better ones become available, and we will update this list when we do. We will not add a new AI provider without updating this policy first.

6.4 What We Do Not Send

We do not send your password, your payment details, or content from projects you do not have access to. AI requests are made only when you use one of the features above — nothing is sent to an AI provider in the background.

6.5 Your Choices

You are asked to consent before the first time any of your content is sent to an AI provider. You can withdraw that consent at any time in Settings, which stops any further content being sent and disables these features until you turn them back on.

6.6 Reporting AI Content

If Flo produces something inappropriate, you can report it from the assistant itself. Reports reach us at [email protected] and we act on them.

7. Your Rights and Choices

You have the following rights regarding your personal information:

7.1 Access and Portability

You can access your data through the Service. You may request a copy of your data in a portable format.

7.2 Correction

You can update your account information at any time through your account settings.

7.3 Deletion

You can permanently delete your account and associated data at any time from within the app: open your profile (Profile → Delete Account) and confirm. You may also contact us for assistance. Some information may be retained for legal or legitimate business purposes.

7.4 Marketing Communications

Optional email is off unless you affirmatively select a category. You can separately choose tips and tutorials, product updates and research, and offers and promotions during email/password signup, in a one-time in-app preference prompt, in Settings, or from the preference link in any optional email. Social-sign-in accounts start with every optional category off.

You can change or withdraw these choices at any time. Every optional email includes both a preference link and a one-click unsubscribe mechanism. You will still receive essential transactional email related to actions on your account, such as verification, security, password reset, billing, and purchase messages.

7.5 Do Not Track

We do not currently respond to "Do Not Track" browser signals.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Understand how you use the Service
• Improve performance and security

Types of Cookies We Use

• Essential Cookies: Required for the Service to function (authentication, security)
• Preference Cookies: Remember your settings (theme, language)
• Analytics Cookies: Help us understand usage patterns

Analytics on This Website

We use PostHog to measure how this website is used. Analytics cookies and session recordings are only used on this website with your consent, which we ask for with a banner on your first visit.

If you decline, we set no analytics cookies and store nothing on your device, and no session recording takes place. Your visit is still counted, but only through a rotating, privacy-preserving identifier that cannot be traced back to you or linked across days.

You can change your choice at any time using the Cookie settings link in the footer of any page.

You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to these countries.

We take appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy.

10. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date
• Sending you an email notification (for significant changes)

Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: [email protected]
• Website: https://triggerflo.app

14. Additional Rights for EU/EEA Residents

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Object: You can object to processing of your personal information
• Right to Restriction: You can request we restrict processing of your information
• Right to Lodge a Complaint: You can file a complaint with your local data protection authority

Our legal basis for processing your information includes: performance of our contract with you, our legitimate interests, and your consent.

15. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect
• Right to delete your personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us using the information provided above.

16. Google Calendar Integration

TriggerFlo offers an optional integration with Google Calendar. When you connect your Google account, we request access to your Google Calendar data to provide the following features:

• Viewing your calendar events alongside your tasks and time entries
• Creating calendar events from within TriggerFlo
• Displaying event details including titles, times, descriptions, locations, attendees, and conference links

16.1 Google Calendar Data We Access

When you authorize the integration, we access:

• Calendar List: The names and identifiers of your Google Calendars
• Event Data: Event titles, descriptions, locations, start/end times, attendee email addresses, and conference/meeting links
• Basic Profile: Your Google account email address (used to identify your connected account)

16.2 How Google Calendar Data Is Stored

Your Google OAuth tokens (used to access the Calendar API on your behalf) are stored locally on your device using encrypted secure storage. Calendar event data is fetched on demand and displayed in the app; it is not uploaded to or stored on our servers. When you disconnect your Google account or delete your TriggerFlo account, all locally stored tokens are removed.

16.3 Limited Use Disclosure

TriggerFlo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google Calendar data to provide and improve the user-facing features described above.
• We do not transfer Google Calendar data to third parties, except as necessary to provide the Service, as required by law, or as part of a merger or acquisition with your prior consent.
• We do not use Google Calendar data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not sell Google Calendar data to data brokers, information resellers, or any other third parties.
• We do not use Google Calendar data to determine credit-worthiness or for lending purposes.

16.4 Human Access to Google Calendar Data

TriggerFlo personnel do not read or access your Google Calendar data unless:

• You have given us explicit permission for a specific support request
• It is necessary for security purposes, such as investigating abuse or a security incident
• It is required to comply with applicable law
• The data has been aggregated and anonymized for internal operations in accordance with applicable privacy law

16.5 Revoking Access

You can disconnect your Google Calendar integration at any time from the Integrations settings in TriggerFlo. You can also revoke TriggerFlo's access directly from your Google Account permissions page. Upon disconnection, all stored tokens are deleted from your device.