Introduction
At Fruitask ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our workspace management platform.
Information We Collect
Account Information
- Name and email address
- Profile picture (optional)
- Account preferences and settings
- Authentication credentials (securely hashed)
Workspace Data
- Workspaces, tables, and row data you create
- Files and attachments you upload (stored in Fruitask storage or an external provider you connect)
- Comments and collaboration messages
- Activity logs and revision history
Integration & Credential Data
- API keys, secrets, and OAuth tokens you provide for integrations always stored encrypted at rest (see "API Keys & Third-Party Credentials" below)
- Connection status and configuration for storage and other third-party providers you set up
Technical Information
- IP address and browser type
- Device information
- Usage patterns and feature interactions
- Error logs for debugging purposes
How We Use Your Information
- To provide and maintain our services
- To authenticate your identity and secure your account
- To enable collaboration features with your team
- To send important notifications about your account
- To improve our platform and develop new features
- To provide customer support
- To comply with legal obligations
Data Security
We implement industry-standard security measures to protect your data:
Password Security
Passwords are never stored. We use bcrypt hashing with salt, making it computationally infeasible to reverse.
Encryption in Transit
All data transmitted between your browser and our servers is encrypted using HTTPS/TLS protocols.
Access Control
Role-based permissions ensure only authorized users can access your workspaces (Owner, Admin, Editor, Viewer).
Two-Factor Authentication
Optional 2FA adds an extra layer of security to your account using time-based one-time passwords.
Transparency Note
Your workspace data (tables, rows, comments) is stored in our database without client-side encryption. While protected by access controls and encrypted in transit, this data is technically accessible to system administrators. This is standard practice for SaaS applications that require server-side features like search, filtering, and collaboration. For highly sensitive data, we recommend using additional encryption tools before uploading.
File Storage & Your Files
Fruitask includes a built-in file storage feature so you can upload and manage attachments. You control how each file is stored and who can access it.
Public & Private Files
- Public files are served from a stable public URL and can be opened by anyone who has the link.
- Private files are not publicly accessible. They are served through a temporary, signed URL that expires (by default after 1 hour).
- You can switch a file between public and private at any time.
Expiration & Extending Access
- A private file's access link expires automatically once its validity window ends.
- You can extend a private file's access for a chosen duration for example 1 hour, 3 days, 1 week, or up to about 1 month (a maximum of 30 days).
- When a link expires, the file is not deleted it simply becomes inaccessible until you generate or extend a new signed link.
Export & Deletion
- Export: You can export your stored files as a single ZIP archive and download it from our system at any time.
- Empty your storage: You can permanently remove all files from your Fruitask storage. This action is irreversible.
Bring Your Own Storage Provider
Instead of Fruitask's built-in storage, you may connect your own external storage provider, including Google Drive, OneDrive, Dropbox, Cloudinary, or Cloudflare R2. When you do:
- Files you upload are stored directly in your connected account, under that provider's terms and privacy policy.
- You manage the connection, storage limits, and any costs with that provider.
- You can disconnect or switch providers at any time from your account settings.
API Keys & Third-Party Credentials
Fruitask follows a "bring your own credentials" model for many integrations (for example AI providers, storage providers, email/SMTP, and automation services). When you provide credentials such as API keys, secrets, or OAuth tokens:
- They are encrypted at rest using AES‑256 encryption before being stored in our database.
- They are never returned to your browser in readable form our interface only shows whether a credential is set or a provider is connected (e.g. a "Connected" status), not the secret itself.
- They are decrypted only on our server, only at the moment they are needed to perform the action you requested.
- You can update, rotate, or remove your credentials at any time from your account settings.
- Fruitask-issued API tokens (for our own REST API/MCP) are shown to you once on creation and stored only as a hash thereafter; you can revoke them anytime.
You remain responsible for the credentials you supply and for complying with each third-party provider's terms.
FruitMail & Connected Mailboxes
FruitMail is an optional email client that you can connect to an existing Google Workspace/Gmail, Microsoft 365/Outlook, custom IMAP/SMTP, or Fruitask-hosted Stalwart mailbox. Fruitask accesses a mailbox only after you connect it and uses that access to provide the mail features and automations you choose.
Mailbox data we process
- Mailbox identity, provider, folders, quotas and connection status
- Sender and recipient addresses, names, subjects, timestamps, message identifiers, headers and previews
- Message bodies, attachments, drafts, replies and read, starred, spam or folder state
- Search terms and the mail actions you request, including sending, moving and deleting messages
- Automation cursor and delivery identifiers used to detect new mail and prevent duplicate automation runs
Where messages are stored
For externally connected mailboxes, the provider remains the authoritative message store. Fruitask retrieves messages through the provider or mail server and sends requested changes back to it; deleting or moving a message in FruitMail can therefore change the provider mailbox. Mailboxes hosted on Fruitask's Stalwart deployment are stored on infrastructure operated for Fruitask. Attachments uploaded while composing with an external provider may be held temporarily by Fruitask for up to one hour and are removed after use or expiry.
Credentials and disconnection
- OAuth access and refresh tokens and custom-mail app passwords are encrypted at rest using authenticated AES-256 encryption.
- Disconnecting removes Fruitask's stored connection, temporary draft attachments, open-tracking records and mail-automation cursor and delivery records for that connection.
- Disconnecting does not delete messages held by your provider. You may also need to revoke Fruitask in the provider's security settings to remove the provider-side authorization grant.
Sender identity and brand images
Fruitask may compare a sender's email address with Fruitask accounts to offer a profile image and a “Reply in FruiChat” shortcut. It may also perform server-side BIMI DNS and brand-logo retrieval to display authenticated or administrator-configured sender branding. These logo requests are made by Fruitask rather than by your browser.
Optional open tracking
If the deployment enables open tracking and you turn it on for a message, Fruitask adds a small invisible image with a random token to the outgoing HTML email. A request for that image records an approximate open signal, including first and last open time and open count. Fruitask does not retain the recipient's IP address or user agent for this feature. Image proxies, security scanners and blocked images can make these signals inaccurate, so they are not proof that a person read the message. Open records expire after 90 days by default and never later than 365 days under the configured retention limit.
Mail AI
“Write with AI” sends the writing instruction you enter to the configured AI provider and places the returned plain text into the editor. Fruitask does not send your inbox or the opened email to Mail AI as part of this feature. The general AI-provider terms below also apply.
AI Features & AI Provider Data Handling
Several Fruitask features are powered by external AI providers including OpenAI, Anthropic (Claude), and Google (Gemini). When you use an AI feature, only the content needed to fulfil that specific request is sent to the provider (for example your prompt, the row or note you are working on, or the documents in the knowledge base you are querying). We do not send your entire workspace, and AI features do not run unless you invoke them.
No training on your data
- Fruitask does not use your content to train, improve, or fine-tune any AI/ML model neither our own nor anyone else's.
- We access these providers through their business/API tiers, which unlike consumer chat products do not train models on data submitted via the API by default.
- Providers may retain request data for a short period for abuse and safety monitoring before deletion, under their own policies.
- We do not sell AI-related data, and we do not use it for advertising.
When you bring your own API key
Fruitask supports Bring Your Own Key (BYOK). If you supply your own OpenAI, Anthropic, or Gemini key, requests are made against your provider account, and that account's terms, retention settings, and data-usage configuration apply instead of ours.
Your responsibility when using your own key: please confirm that data training / model-improvement is opted out on your provider account. Most major providers do not train on API data by default, but this is not universal notably, Google's free Gemini API tier may use submitted data to improve their products, whereas the paid tier does not. If you handle confidential, regulated, or Google Workspace–derived data, use a paid tier with training disabled.
Each provider's handling of data is governed by its own policy: OpenAI API data usage, Anthropic Privacy Policy, and Google Gemini API Terms. You can disable AI features or remove your stored AI credentials at any time from your account settings.
Google API Services Limited Use Disclosure
Some Fruitask features access Google APIs on your behalf, but only after you explicitly connect your Google account and grant consent. These include signing in with Google, connecting Google Drive as a storage provider, reading and appending rows with the Google Sheets automation actions, uploading videos with the YouTube automation action, and using Gmail through FruitMail to read, search, compose, send and organize messages and attachments. We request only the scopes those features need, and you can disconnect your Google account at any time from your account settings or via Google Account permissions.
Fruitask's use and transfer to any other app of information received from Google APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. Raw or derived user data received from Google Workspace APIs is not used, transferred, or sold to train, improve, or fine-tune generalized or foundational AI/ML models.
In practice this means data we receive from Google APIs is used solely to provide the feature you enabled, is never sold, is not used for advertising, and is not shared with third parties except as needed to operate that feature at your direction or where required by law. Google OAuth tokens are encrypted at rest and never exposed to your browser, as described above.
Cookies and Local Storage
We use cookies and browser storage for three purposes: keeping you logged in, measuring how the service is used (analytics), and showing relevant advertisements. Some cookies are set by third-party services (Google) operating under their own privacy policies.
Strictly Necessary Cookies
These cookies are essential for the service to function and do not require consent.
| Cookie | Purpose | Set by | Duration |
|---|---|---|---|
refreshToken | Maintains your authenticated session and allows silent token renewal without re-login. HttpOnly and Secure not accessible to JavaScript. | FruiTask | 30 days (or until logout) |
Analytics Cookies
These cookies help us understand how visitors use the service so we can improve it. They are only loaded with your consent where required by law.
| Cookie | Purpose | Set by | Duration |
|---|---|---|---|
_ga | Distinguishes unique users for Google Analytics traffic reporting | 2 years | |
_ga_* | Maintains Google Analytics session state | 2 years | |
_gid | Distinguishes users for Google Analytics (short-lived) | 24 hours |
Advertising Cookies
We use Google AdSense to display advertisements on free-plan pages. Google may use cookies to show you ads based on your interests. These are only loaded with your consent where required by law.
| Cookie | Purpose | Set by | Duration |
|---|---|---|---|
IDE, NID, others | Used by Google to serve personalised advertisements and measure ad performance via Google AdSense / DoubleClick | Up to 13 months |
Google's use of advertising cookies is governed by Google's Advertising Policies. You can opt out of personalised ads via Google Ad Settings.
Browser Storage (localStorage / sessionStorage)
These values are stored locally in your browser only and are never transmitted to third parties.
| Key | Purpose | Storage |
|---|---|---|
| Access token | Short-lived JWT for API authentication | localStorage (Remember me) or sessionStorage |
| Remembered email | Pre-fills the login email field when "Remember me" is checked email only, never your password | localStorage |
| Theme preference | Remembers your light/dark mode choice | localStorage |
| UI preferences | Sidebar state, view preferences, and other layout settings | localStorage |
You can clear browser storage at any time via your browser's developer tools or by logging out.
Data Sharing
We do not sell your personal information. We may share your data only in these circumstances:
- With your consent: When you invite collaborators to your workspace
- Service providers: Cloud hosting, email services (who are bound by confidentiality)
- Storage & integration providers you connect: If you connect an external provider (e.g., Google Drive, OneDrive, Dropbox, Cloudinary, Cloudflare R2, AI or email providers), the relevant data is sent to that provider under your own account and their privacy policy.
- Google Analytics: Aggregated, anonymised usage data to help us understand how the service is used. Governed by Google's Privacy Policy.
- Google AdSense: Advertising data shared with Google to serve and measure ads on free-plan pages. Governed by Google's Advertising Policy.
- Legal requirements: When required by law or to protect our rights
- Business transfers: In connection with a merger or acquisition (with notice)
Your Rights
You have the following rights regarding your data:
Data Retention
- Active account data is retained while your account is active, except as described below
- Direct messages (FruitChat): by default, a direct conversation with no new messages for one year is cleared from the view of each participant who keeps "Clear inactive chats after 1 year" turned on. You can turn this off in Chat settings, and a participant who turns it off keeps their copy. Messages, and attachments that were uploaded only for that chat, are permanently deleted once every participant's copy has been cleared, whether by this setting or by clearing or deleting the chat. This began with an in-app notice and a 30-day grace period.
- Chat history may be kept longer where the law requires it, or while we investigate abuse or a reported violation
- FruitMail temporary draft attachments: up to one hour, or removed earlier after use
- FruitMail open signals: 90 days by default and no more than 365 days; removed when the mailbox is disconnected
- FruitMail connection and automation metadata: retained while the mailbox is connected and removed when it is disconnected or the account is deleted
- Deleted workspaces are soft-deleted and permanently removed after 30 days
- Account data is deleted upon request within 30 days
- Backups may retain data for up to 90 days for disaster recovery
Children's Privacy
Fruitask is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Continued use after changes constitutes acceptance.
Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us at:
Email: privacy@fruitask.com
Subject: Privacy Policy Inquiry
Social Platform Integrations (TikTok, Facebook & Instagram)
Fruitask automations can publish content to social platforms on your behalf. These integrations are entirely optional and only ever activate after you explicitly connect the relevant account and approve the permissions the platform asks for. If you never connect an account, we never contact these platforms and receive no data from them.
TikTok
When you connect TikTok for the "Upload Video in TikTok" automation action, we receive and store your TikTok account identifier, display name, username, and avatar image URL, together with the OAuth access and refresh tokens needed to act on your behalf. We use this data for exactly two purposes: to show you which account is connected, and to upload the video your automation specifies.
Your use of the TikTok integration is also subject to TikTok's own Privacy Policy and Terms of Service.
Facebook & Instagram (Meta)
When you connect Facebook for the "Post in Facebook Page" or "Create Instagram Post" automation actions, we receive and store your Meta account name and identifier, the list of Pages you manage (id, name, category) and any linked Instagram Business account, plus the access tokens required to publish. This is used only to let you pick a destination Page/account and to publish the content your automation defines.
Common to all platform connections: all access and refresh tokens are encrypted at rest, are never returned to your browser in readable form, and are decrypted server-side only at the moment an action you configured runs. Content you publish through an automation is transmitted to that platform under your own account and becomes subject to that platform's terms and privacy policy.