Privacy policy
Last updated 8 November 2026
Capri is a task app at capritasks.xyz, with apps for Mac, Windows and Android. This page says what Capri keeps about you, why, and who else sees it. In short: only what it needs to run your account, nothing is sold, and there are no ads or tracking.
What Capri keeps
- Your account: your username, your email, and your password stored only as a one-way hash. If you use passkeys, only their public keys.
- Sign in with Google: if you use it, Google tells Capri your Google account's id, your email address and your name. Capri keeps the id and the email so it can recognise you next time. It doesn't get your Google password or anything else from your Google account.
- Todoist: if you connect Todoist, your Todoist token, kept encrypted on the server, so Capri can read and change your tasks there.
- Your tasks and settings: tasks, notes, sketches, schedules, reminders, themes and other settings you make in Capri. With Todoist connected, your tasks stay in Todoist and Capri keeps only its own extras.
- Co-Work: team projects and messages are shared with the people in that team.
- Sign-ins: a random session id in a cookie, so you stay signed in. It's the only cookie Capri sets. Your network address is checked to limit password guesses and isn't kept in your account.
- Bug reports: what you write when you report a bug, with your username and email so we can reply.
Why
Only to run Capri for you: signing you in, keeping your tasks, syncing them between your devices, sending reminders you ask for, password-reset and sign-in codes, and Capri+ receipts. Capri doesn't sell your data, show ads, or use analytics or tracking.
Who else sees it
- Google, if you sign in with Google, and to serve the fonts Capri uses.
- Todoist, if you connect it.
- Stripe, if you buy Capri+: it handles the payment and your card details. Capri never sees your card.
- Resend, which sends Capri's emails (codes, receipts, bug-report replies).
- Cloudflare, which carries the traffic between you and Capri's server.
- Your browser's or phone's push service, if you turn on notifications.
Each of them only gets what it needs for that job. Capri would only hand data to anyone else if the law required it.
How long
As long as you have an account. Signed-in devices you stop using are signed out after 180 days. To delete your account and everything Capri keeps about you, email [email protected] from your account's email, and it's done within 30 days. Payment records Stripe must keep by law stay with Stripe.
Your choices
- See and change your username, email, password, Google and passkeys under Account.
- Remove Google from your account under Account → Google.
- Ask for a copy of your data, a correction, or deletion at [email protected].
Security
Everything travels over https. Passwords are hashed, Todoist tokens are encrypted, and sign-ins are rate-limited. No service is perfectly safe, so use a password you don't use elsewhere, or a passkey.
Children
Capri isn't meant for children under 13, and doesn't knowingly keep data about them.
Changes
If this policy changes, the date above changes too. Big changes will be told to you in Capri or by email.