What we collect, and what we do with it.

sjTasks is a product of Sally Jo LLC — "Sally Jo", "we", "us". This policy covers sjtasks.com and the sjTasks application.

sjTasks is sold to businesses. If you are inside someone else's team — because you work there, or because they invited you as a guest to follow a project — that business decides what goes into it and who can see it. This policy describes what happens on our side of that.

Your account. Your name, your email address, a one-way hash of your password, your timezone, and whether you prefer a 12- or 24-hour clock. If you turn them on, your two-factor secret, recovery codes, and any passkeys you register; if you give us a cell number and agree to texts, that number, when you agreed, and the wording you agreed to. sjTasks does not accept profile photo uploads, so we hold no photo of you.

When you accept our Terms and this policy. We record the date and time, your IP address, your browser, operating system and device, your language and time zone, and the version of each document you accepted. We keep that record as evidence that you agreed, and we record it again each time you accept a new version.

What you put in. Your projects, tasks and subtasks, task lists, notes, tags, due dates, estimates, logged time, saved views, and the files you upload — with their names, sizes, and types. We treat all of it as your content. We do not read it except when we have to: support you have asked for, a security or abuse investigation, or a legal obligation.

A record of who did what. Every action in a team writes one row: who did it, what they did, which thing it was about, what changed from what to what, and when. That is what task history, the project feed, and the person and team views are reading. It records no IP address and no browser details, and it is not deleted when the thing it describes is deleted.

Your sign-in sessions. When you sign in we store the session along with the IP address and browser it came from, so you can look at your active sessions and sign the other ones out.

Billing details, which are almost never payment details. Card payments for a paid plan are handled by a dedicated payment processor, on its own checkout page. The card number never touches us: what we hold is which plan you chose and whether it is paid monthly or yearly, where the subscription stands, the identifiers the processor uses for your customer record, and — so you can tell which card is on file — the card's brand and its last four digits. The Free plan involves no card and no processor at all. For an invoiced Enterprise account we hold an invoice email address, a purchase order number, contract dates, the number of seats agreed, and notes about the arrangement.

How you found us. On the public pages of this site — never inside the app, and never for anyone signed in — we keep our own count of visits: which pages were opened and when, the site a visitor arrived from, any campaign tags on the link they clicked, and whether the browser looked like a phone or a desktop. A first-party cookie holding a random value is what makes a returning visitor the same visitor; the value means nothing outside our own database, and no IP address is stored with any of it. If a visit turns into an account, we connect the two — that is how we know which page earned a customer. All of this runs on our own servers; section 8 describes the cookie, and section 11 says how long the records live.

Messages you send us. The contact form stores what you typed — your name, email address, optional company, subject and message — so a person can read it and reply. With it we keep details of the visit it came from: your IP address; your browser, operating system and device; your country, region and city as our network provider reports them from the IP address; the page you first arrived on, the site that sent you there and any source code in its link; and the result of the check that stops automated messages. We use these to answer you, to tell a person from a machine, and to know which pages and links bring people to us.

If you ask for our emails. When you tick a box to get Working Calmly or sjTasks updates, we record the time, your IP address, your browser, and the exact wording of the box you ticked, as evidence that you asked for them. Each email has a one-click unsubscribe.

Ordinary logs. Our servers keep the usual request and error logs — IP address, timestamp, what was asked for, and the browser string — so we can run the service, find faults, and stop abuse.

Every timestamp in sjTasks is stored in UTC and shown to you in your own timezone. Nothing stored carries a local time.

• We do not sell your data or your team's data, and we never have.
• We do not run advertising, and nothing here goes to an advertiser.
• We do not sell you to anybody else. No marketing pixels, no cross-site tracking, no data brokers, no advertising networks. What we measure, we measure for ourselves, to run and improve sjTasks.
• We do not send marketing email from the product.

sjTasks is deliberately quiet, but three things load from outside our own servers. We describe them by what they do; we do not publish our supplier list on a public page.

A typeface service provides the font the site and the app are set in. Loading it tells that service your IP address and which page asked for it. We use it rather than the obvious alternative precisely because it does not follow readers around the web.

An invisible human check runs on the two forms anyone on the internet can reach — the contact form and the invitation page. It looks for automated behaviour and usually shows you nothing at all. It sees your IP address and some signals from your browser. It is not on the sign-in page, and it is nowhere inside the app.

A placeholder-avatar service draws the small circle showing a person's initials on pages inside the app. Those initials appear in the address the browser asks for. This one is something we inherited from the scaffolding sjTasks was built on rather than something we chose, we are not happy about it, and we are replacing it with initials we draw ourselves.

That is the complete list. Nothing else on any page reaches out to anyone.

One journey does leave our pages entirely: paying. Choosing a paid plan sends you to our payment processor's own checkout page to enter your card, and the Billing page can open that processor's portal for managing it. Those pages belong to the processor and its policy governs them; what comes back to us, and what we keep of it, is in section 2.

• To run sjTasks and show you your work.
• To send you the notifications and summaries you have chosen.
• To keep the service secure, prevent abuse, and investigate when something looks wrong.
• To answer you when you ask us something, and to support you when you need it.
• To bill you — the plan you chose, by card through the payment processor, or the invoice we agreed — and keep the record of the arrangement.
• To count visits to this public site and learn which pages and campaigns bring people in — a number we look at ourselves and show to no one.
• To meet a legal obligation when one applies.

That is the whole list. Nothing here is used to build an advertising profile of you, and nothing is passed on to be used that way by someone else.

We do not sell your information. We may share your information for whatever purposes we deem necessary, including but not limited to sharing with our vendors and partners who help us provide services to you. Among those we share with:

• Vendors and partners who help us provide services to you — the hosting for the server it runs on, the object store your files sit in, the service that delivers our email, the network that sits in front of the site, the payment processor that takes card payments for paid plans, the service that sends our text messages (only the phone number and the message), and the human check on our public forms.
• Legal and safety recipients, where the law requires it, or where it is needed to protect someone's rights, property, or safety.
• A buyer of the business, if sjTasks or Sally Jo LLC is ever sold or merged. We would tell you before your data moved.
• The AI model provider behind Ask in English — when you ask a question, we send it with the names of the projects, people and tags it needs, and nothing else, unless an admin has turned on Answers from your work, which also sends the content of the tasks the answer draws on. The public box on the docs pages, which anyone can use without an account, sends the question with our own guide pages; for those we also note the IP address it came from, to stop abuse. We keep each question and its answer for 90 days, to review and improve the answers; after that the text is removed and only a usage count stays, for billing.

Notifications and summaries — a task assigned to you, a note that mentions you, work that is due soon or already late, a file attached, a project you were added to, and the daily and weekly digests. You control every one of them, per team, under Settings → Notifications: each event has an in-app switch and an email switch, you can mute a whole project, and you can put the lot back to the defaults in one click.

Two things about those notification emails are worth knowing. First, they carry content — the title of the task, the words of the note — so what your team writes travels by email to the people the notification reaches. Second, a message about a task can be answered in place: reply to it, and your reply becomes a note on that task, with the quoted history and your signature trimmed off, visible to everyone who can see the task. A reply meant for our eyes only should go through the contact form instead.

Account mail — a password reset, an invitation to a team, a security notice, a notice that a plan has ended. These come with having an account and cannot be switched off.

Text messages. We text only people who give us a cell number and tick the box agreeing to texts, at sign-up or in their profile. We send sign-in codes, system notifications, and system updates. Message and data rates may apply. Reply STOP to any text, or use Stop all texts in your profile, and the texts stop. Reply HELP for help. We never sell your number. Your number and your agreement to texts are never shared with anyone for their own marketing.

Everything we send can be answered. Reply to a message about a task and the reply lands on the task, where the people working on it read it; reply to anything else and it reaches a person here. Nothing we send you comes from an address that cannot be answered.

Inside the app we set essential cookies only:

• a session cookie that keeps you signed in — restricted to this site, not readable by scripts, and expiring after a couple of hours of inactivity;
• a request-forgery token that stops another site from acting as you;
• a remember-me cookie, and only if you tick "Remember me" when you sign in.

The public pages of this site set one more: a first-party visitor cookie, for the visit counting described in section 2. It holds a random value we minted, meaningful only inside our own database; it is not readable by scripts, and it expires 400 days after your last visit. Delete it and, to us, you are a brand-new visitor.

There are no advertising cookies and no third-party cookies set by us, and no cookie we set follows you anywhere beyond our own site. There is no cookie banner on this site because nothing set here is handed to, or readable by, anybody else.

sjTasks runs in the United States, and your team data and your files are stored in the United States. The network in front of the site and the human check on our public forms operate globally, so a request may touch a server nearer to you before it reaches ours. If you use sjTasks from outside the United States, you are agreeing to that.

• Traffic is encrypted in transit and the site is served over HTTPS only.
• The disk the database sits on is encrypted, and the store holding your files encrypts what it holds.
• Files are never public. Every download is a link that is authorized first and then expires within minutes, and every upload goes straight from your browser to private storage.
• Passwords are stored as a one-way hash. We cannot read your password, and neither could anyone who walked off with a copy of the database. Two-factor secrets and recovery codes are stored encrypted.
• Backups run nightly, are encrypted, and are restored as a test rather than assumed to work.

Those backups exist for our recovery, and they are not a promise about yours. Our Terms of Service are blunt about that, and you should keep your own copies of anything you cannot afford to lose. No system is perfectly secure and we will not pretend otherwise.

Very few people, and never quietly.

• Staff access lives behind a separate console that requires two-factor authentication and is reachable only by the people who run sjTasks.
• Support sometimes means signing in as you to see exactly what you see. That is time-limited, it is visible on screen the whole time it is happening, and it can be ended in one click from your side.
• Every staff action in that console — including every one of those sessions — is written to an audit log recording who did it, to whom, from what address, and when.
• One team's data is never mixed with another's. Every query is scoped to a single team, and that is enforced in the code and tested, rather than left to care.

Inside sjTasks, people archive and cancel rather than destroy. Archiving a project hides it and keeps everything in it. Cancelling a task keeps it in the record and drops it out of the progress counts. Actual deletion is something you ask us for, so that nobody wipes a quarter's work with one wrong click.

Deleted things go to a trash. A deleted task takes its notes, time entries, and attachments with it, and they all come back together if it is restored.

We may remove deleted items at any time, and we may keep them for as long as we like. We generally aim to hold them for around thirty days so a mistake can be undone, but that is a habit rather than a promise: nothing here obliges us to delete anything by a given date, or to keep it that long. We may retain material for backup, security, operational, or legal reasons, and we do not promise that every copy of anything has been erased from every system.

The record of who did what is kept. "Jane deleted acme-142" has to outlive acme-142, so activity rows are not removed with the thing they describe.

When a team's work is removed. Cancel a paid plan and the team stays fully usable to the end of the period you paid for, then goes back to Free with everything in it; if it holds more than Free allows, it is read-only until you make room or choose a plan. An owner who closes a workspace has 30 days to reopen it; after that its projects, tasks, notes, files and people are removed, and we keep the billing records we need to answer for what was charged. A Free team with no activity for 90 days may be deleted. These periods are our general practice, not a promise: our Terms let us delete data at any time, for any reason, without notice. Until a team is removed, an admin can export it from Team settings at any time — the data, with the files up to 5 GB; past that we send the files another way. What our Terms reserve about deletion after an account ends still stands, so take your export while it is a button.

A person who leaves is not erased either. Taking someone out of a team turns their access off; it does not delete what they did. Their name stays on the tasks, notes, time, and history they authored, because that record belongs to the team's account of its own work.

The count of visits to this site is pruned. The page-by-page detail is kept for 90 days. The visitor records are kept for 400 days from the last visit, matching the cookie — except that a visit which turned into an account, or came close to one, is kept with the account it explains.

Closing an account. Export your data first from Team settings, then cancel from the Billing page — or ask through the contact form and a person will see to it, including an Enterprise team or anything the buttons do not cover.

Messages sent through the contact form, with the visit details above, are kept until we choose to delete them. The record that you asked for our emails is kept while you are subscribed, as evidence of that request.

Depending on where you live — the EU and UK under GDPR, California under the CCPA and CPRA, and a growing list of other places — you have rights over the personal information we hold about you: to know what we have, to get a copy of it, to correct it, to have it deleted, to limit or object to some uses of it, and not to be treated worse for asking.

We will honour those requests from anyone, wherever you live, whether or not a law makes us.

Two practical notes. Much of it is already in your hands: your name, email, timezone, notification choices, passwords, two-factor settings, and active sessions are all yours to change inside your account. And where the information sits inside someone else's team — because you work for them, or they invited you as a guest — that business controls those records, so we will point you to them rather than edit their content on your behalf.

To make a request, use the contact form. Say what you want and how to reach you. A person reads it and answers, within the time the relevant law allows and sooner where we can. We may need to confirm you are who you say you are before we act on it.

We do not sell or share personal information as those laws use those words, so there is no opt-out for you to exercise.

sjTasks is a business tool sold to organizations, and it is not for children. You must be at least 18 to hold an account. We do not knowingly collect information from children, and if we find that we have, we will delete it.

We may update this policy. When we do, the date at the top of the page changes, and if the change matters we will tell active customers rather than hope they re-read it. Continuing to use sjTasks after a change takes effect means you accept it.

Questions about any of this go through the contact form, and a person answers them. Our Terms of Service cover the rest of the relationship.