Privacy policy.

When This Section Applies

This section applies only when you, as a TaskWiz administrator, voluntarily click "Sign in with Google" within TaskWiz to generate a volunteer registration or survey form in your own Google Account. If you do not use this feature, none of the disclosures in this section apply to you.

Data Accessed (Google OAuth Scopes)

When you authorise TaskWiz, we request the following Google OAuth scopes - and only these scopes:

We do not request access to your Gmail, Calendar, Contacts, the rest of your Google Drive, or any other Google service. We do not request offline access or refresh tokens.

In addition to the scopes above, the OAuth sign-in flow returns standard profile information (your Google account email and identifier) so we can confirm which account the form will be created in.

Data Usage

TaskWiz uses the data accessed under these scopes for one purpose only: to create a Google Form in your Google Account that volunteers can use to register for an event.

Specifically, we use the access token you grant - held briefly in memory on our backend during the request - to:

• Create a new Google Form titled with your event name.
• Add the questions you have configured in TaskWiz to that form (for example: name, email, phone, task preferences, tags).
• Return the new form's ID to your browser so you can open the form in Google Forms and distribute it.

We do not:

• Read or collect any responses submitted to the form. All responses remain entirely within your own Google Account, under your control.
• Modify, delete, or read any other files in your Google Drive
• Access any Google data for any purpose other than the one stated above.
• Use Google user data to develop, improve, or train generalised or non-personalised AI and/or machine-learning models.
• Use Google user data for advertising purposes.
• Allow humans to read Google user data, except (a) with your explicit consent for specific data, (b) for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised and is used for internal operations.

Limited Use affirmation. TaskWiz's use and transfer of information received from Google APIs adheres to the https://developers.google.com/terms/api-services-user-data-policy, including the Limited Use requirements.

Data Sharing

We do not share, sell, transfer, or otherwise disclose any data obtained through Google OAuth scopes to any third party, including but not limited to advertisers, data brokers, analytics providers, or AI/ML model providers.

The only network destination that data obtained under these scopes is sent to is Google's own APIs (googleapis.com), to perform the form-creation operation you requested. No other entity receives this data.

Data Storage and Protection

• Access tokens are not persisted: The Google OAuth access token issued to TaskWiz is held only in memory on our backend for the few seconds required to create the form, and is then discarded. It is never written to our database, logs, or any other persistent storage.
• No refresh tokens: We do not request access_type=offline, so Google does not issue us a refresh token, and we have no ability to act on your Google Account once the form creation request has completed.
• Encryption in transit: All traffic between your browser, TaskWiz, and Google APIs is encrypted using TLS (HTTPS).
• Hosting: TaskWiz is hosted on Google Cloud Platform within secure, access-controlled environments. Application credentials (the OAuth client secret used to identify TaskWiz to Google) are stored in Google Cloud Secret Manager and are accessible only to authorised TaskWiz services.
• Access controls: Access to TaskWiz production systems is limited to authorised engineering personnel and protected by single sign-on with multi-factor authentication.

Data Retention and Deletion

• Access tokens: Discarded from memory immediately after the form-creation request completes (typically within seconds). We retain no copy.
• The Google Form itself: The form is created in your Google Account. It belongs to you, is stored by Google under your account, and TaskWiz does not retain a separate copy of its contents or responses. You can edit, archive, or delete the form at any time from https://forms.google.com or https://drive.google.com.
• Form responses: Responses are collected by Google and stored in your Google Account. TaskWiz never receives, stores, or processes them.
• Revoking TaskWiz's access: You can revoke TaskWiz's authorisation to your Google Account at any time by visiting https://myaccount.google.com/permissions and removing TaskWiz.
• Account: Because we hold no refresh token and do not persist your access token, revoking access immediately and completely terminates any ability for TaskWiz to interact with your Google Account.
• Deletion requests: You may also request deletion of any TaskWiz side records associated with your account by contacting us at the address in Section 9. We will respond within 30 days.