Privacy Policy

kbdt.dev ("kbdt", "we", "us", or "our") is a task management application. We are committed to protecting your privacy and being transparent about how we handle your information.

kbdt is designed as a cloud-synced application. Your task data is stored in the cloud, with a cached copy on your device so the app opens offline. This policy describes what information we collect, how we use it, and your choices.

Account Information

When you sign in, we receive basic profile data from your authentication provider (Google or GitHub): your name, email address, and profile photo, and for GitHub your username. This information is stored on our servers and used to identify your account, display your profile to collaborators, deliver invites sent to your email address or GitHub username, and manage subscriptions.

Task Data

Your tasks, notes, and outlines are stored in Cloudflare Durable Objects and associated with your account, with a backup in Cloudflare D1. A cached copy is kept on your device using IndexedDB. We do not read, analyze, or share your task content.

Collaboration Data

When you share a bucket with other users, your tasks in that bucket become visible to all members in real time. Invitations and membership records are stored in Cloudflare D1.

API Access

Crew users may generate API tokens to access their tasks programmatically (e.g., via MCP clients). These tokens are stored in Cloudflare D1 and grant access to the same data available in the app. You are responsible for safeguarding your API tokens.

Payment Information

If you subscribe to a paid plan, payment processing is handled entirely by Dodo Payments (our merchant of record). We do not store your credit card number or payment details. We receive only your subscription status and transaction identifiers.

Usage Analytics

We may collect anonymous, aggregated usage data (e.g., feature usage frequency, error reports) to improve the product. This data cannot be used to identify individual users and contains no task content.

• To provide and maintain the kbdt service
• To store your data and sync it across your devices
• To authenticate your identity
• To improve and debug the application
• To communicate service updates or changes

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Your task data is stored on Cloudflare's global network using Durable Objects with SQLite, with encryption in transit (TLS) and at rest. A cached copy is kept in your browser's IndexedDB so the app opens offline.

We apply reasonable security measures to protect your data, but no method of electronic storage is 100% secure. You are responsible for maintaining the security of your device and account credentials.

We retain your account information and cloud-synced task data for as long as your account is active. If you cancel your Crew subscription, your cloud data remains accessible for 30 days after the billing period ends, after which it may be deleted.

If you request account deletion, we will delete all associated data within 30 days. Local data stored in your browser is not affected by account deletion and remains under your control.

We use the following third-party services:

• Firebase(Google) — authentication
• Cloudflare— task data storage (Durable Objects), relational storage for user profiles, buckets, membership, invitations, API tokens, subscription status, and a backup of task data (D1), hosting, and API infrastructure (Workers)
• Dodo Payments— subscription billing, payment processing and sales tax, as merchant of record
• Google and GitHub— authentication providers and profile data (names, profile photos, GitHub usernames)

Each service has its own privacy policy. We encourage you to review them.

You may at any time:

• Export or delete your local data by clearing browser storage
• Request deletion of your cloud-synced data by contacting us
• Revoke authentication access through your Google or GitHub account settings
• Stop using the service entirely — your local data remains yours

kbdt uses only essential cookies required for authentication and session management. We do not use tracking cookies or third-party advertising cookies.

kbdt is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date above. Continued use of kbdt after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, please reach out at hello@kbdt.dev.