Account
Your email, the name you choose, and your password, stored only as a hash that the original password can’t be recovered from. If you turn on two-factor authentication, we store your authenticator app secret in encrypted form.
Privacy policy
Your tasks, your data.
Actayo stores what it needs to work. It doesn’t use advertising cookies, and it doesn’t sell your data.
Tasks and workspace
Tasks, projects, sections, labels, comments, filters, busy time, time entries, and workspace settings. We use them only to make Actayo work for you.
Everyone in a workspace sees the names and email addresses of its members. When someone invites you, we store your email address, your role, and who invited you until you join or decline, the invitation is revoked, or 30 days after it expires.
Security records
When you sign in or change your security settings, we store the time, IP address, and browser so that misuse of your account can be detected. For active sessions, you also see the device name.
Cookies and your browser
The actayo.com site doesn’t use cookies. The app at app.actayo.com uses one essential cookie that keeps you signed in, and it remembers your chosen theme and sidebar layout in your browser. We don’t use advertising or tracking cookies.
Site analytics
Visits to actayo.com are counted by Cloudflare Web Analytics. It sends Cloudflare the page address, the page you came from, your browser, device type, country, and load times. It doesn’t set cookies or fingerprint your browser. It doesn’t run in the app at app.actayo.com.
Contact form
The name, email, topic, and message you send through the contact form, along with your IP address and browser, are emailed to the Actayo inbox through Amazon SES. We use them only to reply to you.
Integrations
We store webhook URLs as you enter them and encrypt their secrets. API keys are stored only as a hash. You see the full key just once, when you create it.
Actayo sends account email, such as address verification, password resets, and workspace invitations, through Amazon SES in the EU (Frankfurt). We keep a list of addresses that bounced or reported our email as spam, so we don’t email them again.
If your workspace turns on Email to Inbox, messages sent to its address are received by Amazon SES, which checks them for spam and viruses. Each message is stored with its attachments in Amazon S3 in the EU (Frankfurt) for up to 400 days, so you can download the attachments from the task it became. The sender, subject, and delivery status stay in the workspace’s Email to Inbox history.
Effective date
This summary is effective as of . If Actayo adds any other analytics, advertising cookies, or a new data processor, we’ll update this page before that happens.