Privacy policy
How the pilot handles your data.
This policy describes the private TaskVictory WF02 Pilot, operated by the TaskVictory project operator. Only authorized synthetic files are permitted; the pilot is not accepting customer data.
What the app accesses
With the operator’s consent, the app uses Google’s drive.file permission to access app-authorized files and folders. It reads submitted CSV contents and file metadata, including names and IDs, and creates duplicate-review reports, original-identifier audit information and completion records.
Authorization checks also read a Drive account identifier and folder-access information to confirm that a replacement credential accesses the same account and folders. OAuth credentials permit these requests.
How the data is used
Data is used to review records within a submitted file, deliver reports, prevent repeat processing, recover interrupted work and verify authorized access. Processing uses deterministic Python rules. File contents are not sent to an AI model or used to train machine-learning models.
Google user data is not sold or used for advertising. Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Where data is stored
- Google Drive: stores the submitted files and generated reports.
- The operator’s computer: stores the OAuth client configuration, refresh token and authorization metadata in a private local directory. Normal processing removes its temporary working copies. Local credentials rely on device and account protections; the app does not itself encrypt those files.
- Private GitHub repository and GitHub Actions: store code, synthetic evidence, workflow logs and run artifacts. When processing runs in GitHub Actions, submitted file contents are processed on GitHub-hosted infrastructure. OAuth credentials are supplied through repository secrets.
The operator controls access to the Google account, computer and private repository. Normal application logs are designed to exclude tokens and authorization URLs.
Retention and deletion
Drive files and repository evidence remain until the operator removes them; there is no automatic deletion period for these records. Current run artifacts are configured for seven-day retention. Evidence saved in repository history lasts beyond that artifact period.
The operator can delete Drive files, local credentials, repository secrets and stored evidence. Removing a current repository file does not erase earlier commits or provider backups. Provider logs and backups may remain under the relevant provider’s retention controls.
For access or deletion questions, contact info.taskvictory@gmail.com. Requests are reviewed against the actual storage locations and available deletion controls.
Withdrawing Google access
The operator can remove the app through Google Account connections. Revocation stops future authorized access but does not delete files or reports already saved. Obsolete local credentials and repository secrets should also be removed when no longer needed.
These information pages
The page code contains no analytics, advertising, tracking pixels, forms or cookies. These pages are hosted through ChatGPT Sites, with Cloudflare hosting infrastructure. These service providers may process request information, such as IP address and browser details, to serve and protect the pages under their own privacy and retention policies. The static page code adds no analytics or tracking scripts.
Contact and updates
The operator can be reached at info.taskvictory@gmail.com. This policy will be reviewed before any change to the pilot’s data use, providers, permissions or access.