Privacy Policy

Last updated: 31 October 2026

This policy explains what we collect when you use Webetask, why we collect it, who we share it with and what control you have. We've kept it in plain language.

1. Who we are and what this policy covers

Webetask is a task management service for small teams. It's a product by Webegenix, based in Egypt ("Webetask", "we", "us").

This policy covers our marketing website at webetask.app and the Webetask app at app.webetask.app. It also covers any emails we send you and any support we give you. Contact us at support@webetask.app.

2. Data we collect

We only collect what we need to run Webetask:

  • Account data. Your name, email address and password when you sign up with email (we store only a secure hash of your password, never the password itself). If you sign in with Google instead, we get your name, email address and profile picture from Google (see section 3). You can also add a profile photo, your timezone and your notification settings.
  • Workspace content. What you and your teammates put into Webetask, like workspaces, projects, tasks, comments, custom fields and files you attach.
  • Files. Files you attach are stored where your workspace chooses: in Webetask's hosted storage (Cloudflare R2), or in the workspace's own connected Google Drive (see section 3).
  • Usage and device data. Basic records like when you log in, which features you use, your browser and device type, and your IP address. We use these to keep the service secure and working. If you turn on push notifications, we also store the push address your browser gives us for that device.
  • Payment data. Paddle handles payments for paid plans as our merchant of record. Paddle collects your card or payment details. We only get your billing name, email, country, plan and payment status. We never see your full card number.
  • Contact-form messages. When you use the contact form on our website, we keep your name, email, team size, topic, message and IP address. We use them to reply to you and to keep spam out.

3. Google user data

You can sign in to Webetask with your email and a password, or with Google. A workspace can also connect a Google Drive account to store its files. These are the only two ways Webetask uses Google.

Signing in with Google

If you choose Google to sign in, we ask Google for the openid, email and profile scopes. That gives us exactly three things:

  • your name
  • your email address
  • your profile picture

Why we use it. To create your Webetask account and sign you in, and to show your name and photo to your teammates in shared workspaces, for example on tasks assigned to you and on your comments. We also use your email address to send you account emails and the notifications you turned on.

Connecting Google Drive for files

A workspace's Owner or Super Admin can choose to store the workspace's files in a Google Drive account. If they connect one, we ask Google for the drive.file scope, plus their email address to show which account is connected. The drive.file scope only lets Webetask see and manage the files and folders that Webetask itself creates in that Drive: a "Webetask" folder with a folder per project and task, and the files your team attaches there. Webetask can't see, open or change any other files in that Drive.

Why we use it. To save the files your team attaches to tasks and comments in your own Drive, to open them for members of your workspace, to rename and move their folders when projects and tasks are renamed or moved, and to move files to the Drive's trash when they're deleted in Webetask.

How it's stored. We keep an encrypted connection key on our servers so Webetask can reach those files. It's never sent to browsers. Disconnecting Google Drive in Settings → Storage deletes the key. The files stay in your Drive.

For both

What we don't access. We don't access anything else in your Google Account. That includes your Gmail, Google Calendar, Google Contacts, and any Google Drive files that Webetask didn't create.

How it's stored. Your name, email address and profile picture are stored with your Webetask account in our database on Supabase, in the European Union. They're encrypted in transit and at rest, and only you, members of your workspaces and the staff who need it to run the service can see them. We keep them while your account is active and delete them within 30 days of a deletion request or account deletion.

How it's never used. We never sell Google user data. We never use it for advertising, including retargeting or interest-based ads. We never use it to build or train generalized or non-personalized AI or machine learning models. We never share it with anyone except the service providers we need to run the app (see section 5), when the law requires it, or as part of a business transfer described in section 5. We never feed it into Google Analytics, Meta Pixel or any other analytics or advertising tool.

Webetask's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Webetask's access to your Google Account at any time at myaccount.google.com/permissions. After that you won't be able to sign in with Google, and a connected Drive stops working until it's connected again. To delete the data we already hold, see section 8.

4. How we use data

We use the data above to:

  • run the service: create your account, sign you in, show your workspace to you and your teammates, store and open your files, and process payments
  • send account emails, and the email and push notifications you turned on
  • answer your support requests and contact-form messages
  • keep Webetask secure, and prevent abuse, fraud and spam
  • improve the product, using usage data to see which features work and which don't

We don't sell your data. We don't show ads based on your workspace content, and we don't use it for advertising of any kind.

5. Sharing

We share data only with the service providers we need to run Webetask. Each one only gets what it needs for its job:

  • Vercel hosts the Webetask app.
  • Supabase runs our database and sign-in (authentication), in the EU region. Your account data, workspace content and Google user data are stored here.
  • Cloudflare (R2) stores the files of workspaces that choose Webetask's hosted storage.
  • Google Drive stores the files of workspaces that connect their own Drive (see section 3).
  • Resend sends our emails, like sign-up confirmation, password reset, invitation and notification emails.
  • Browser push services (from Google, Apple or Mozilla, depending on your browser) deliver push notifications to devices where you turned them on. They receive the device's push address and an encrypted message that only your device can read.
  • Hostinger provides the server (VPS) for our marketing website, including the contact form.
  • Paddle processes payments as our merchant of record and handles billing, invoices and sales tax.
  • Google Analytics and Meta Pixel measure visits to our marketing website only (see section 6).

Legal requests. We may share data if the law requires it, for example a valid court order. We may also share it when we need to protect the rights, safety or property of our users, the public or Webetask. Where the law allows, we'll tell you first.

Business transfer. If Webetask or Webegenix is part of a merger, acquisition or sale of assets, your data may move to the new owner. If it does, this policy will keep protecting it, including the rules for Google user data in section 3. We'll email you before it happens.

6. Cookies and analytics

Our marketing website at webetask.app uses Google Analytics and Meta Pixel. They set cookies so we can see how people find and use the site, and how well our ads work. They collect things like the pages you visit, how you got there, your browser and device, and a rough location based on your IP address. These tools are never fed with Google user data or your workspace content.

The Webetask app only uses the cookies it needs to keep you signed in and to work properly.

You can opt out at any time:

7. Security

We take reasonable steps to protect your data:

  • All data is encrypted in transit with HTTPS (TLS) and encrypted at rest in our database.
  • Only staff who need access to run or support the service can reach it.
  • Row-level access controls in our database mean each workspace's data can only be read by its own members.
  • Links to files only work for a few minutes, and only for people who can see the task.

No system is perfectly secure. If a breach affects your data, we'll tell you and any authorities the law requires, without undue delay.

8. Retention and deletion

  • We keep account data, workspace content and Google user data while your account is active.
  • When you delete your account or workspace, or ask us to delete your data, we delete it within 30 days.
  • Items moved to a workspace's Trash are deleted for good after 30 days, together with their hosted files. Files stored in a connected Google Drive are moved to that Drive's trash.
  • We keep contact-form messages for up to 24 months, then delete them.
  • Paddle and we may keep billing records for longer when tax or accounting laws require it.

To ask for deletion or a copy (export) of your data, email support@webetask.app from the email address on your account. You can also disconnect Google at myaccount.google.com/permissions.

9. Your rights

You can ask to access, correct, delete or export your data, and you can object to how we use it. Email support@webetask.app and we'll reply within 30 days. You can also edit your profile in the app at any time. If you're in the EU or UK, you can also complain to your local data protection authority.

10. Children

Webetask isn't meant for anyone under 16, and we don't knowingly collect data from children under 16. If you think a child has given us data, email us and we'll delete it.

11. International transfers

We're based in Egypt. Our database is in the EU, and some of our service providers may process data in other countries, including the United States. When data moves between countries, we rely on our providers' safeguards, like the EU Standard Contractual Clauses, to protect it.

12. Changes to this policy

If we change this policy, we'll update the date at the top of this page. Before any material change, especially to how we use Google user data, we'll email you first. We'll also ask for your consent where the law or Google's policies require it.

13. Contact

Privacy questions or requests go to support@webetask.app. Webetask is a product by Webegenix, Egypt.