This Privacy Policy applies to the Hubito web application (collectively referred to as “Hubito”, “we”, “us”, “our”, or “the Service”), accessible at https://hubito.harisarshad.site/. Hubito is an executive workspace and task command center for structured project execution and daily workflow momentum.

Hubito is an executive productivity workspace, Kanban cadence command center, 7-day horizon daily planner, meeting scratchpad, and Pomodoro focus timer. We are committed to complete transparency regarding the collection, processing, storage, protection, and disclosure of your personal data, particularly information obtained via Google Identity Services (Google OAuth 2.0).

1. What Google User Data is Accessed by Our Application

When you elect to sign in to Hubito using Google Single Sign-On (SSO) or link your Google Account, our application accesses standard identity claims provided by Google Identity Services. We access only non-sensitive identity data strictly necessary to authenticate your account and provision your isolated cloud workspace:

• Your Name: Your full display name, given name, and family name linked to your Google Account.
• Your Email Address: The primary verified email address associated with your Google Account.
• Your Profile Picture / Avatar URL: The public HTTPS image URL pointing to your Google profile picture.
• Unique Google Subject Identifier (Subject ID / sub claim): A permanent, unique alphanumeric identifier issued by Google to distinguish your account across login sessions.
• OAuth Token Metadata: Expiration timestamps and authentication token lifecycles issued by Google during OAuth handshake.

The specific OAuth 2.0 scopes requested from Google are limited to the following basic profile scopes:

2. Other User-Created & Technical Information Collected

To provide full task management and focus tracking capabilities, Hubito collects and stores the following categories of information that you create or transmit while using the application:

A. User-Created Productivity Data

• Task Information: Task titles, descriptions, due dates, scheduled times, estimated duration / ETAs, priority levels (P1 Urgent to P4 Low), custom section/swimlane assignments (e.g. Inbox, In Progress, In Review, Completed), and completion status.
• Subtask Checklists: Checklist items, subtask titles, inline edits, and completion toggle states.
• Comments & Activity Discussions: Messages, timestamps, updates, and soft-deleted comment audit entries attached to tasks.
• Meeting Scratchpad Notes: Markdown-formatted notes, action items, and documentation authored within the Meeting Scratchpad slide-over drawer.
• Pomodoro Focus Metrics: Timer sessions initiated, focused minutes logged, and session completion records.

B. Technical, Telemetry & Network Data

• Log Data: Standard server access logs including IP address, browser type and version, operating system, referring URL, date and time of each request, and HTTP status codes.
• Browser Local Storage: Client-side preferences such as dark/light UI mode (hubito_theme), active view layout (board, calendar, or list), collapsed swimlane states (hubito_collapsed_sections), and local offline task queues.

3. How Our Application Uses Google User Data & Information

We use your personal data and Google user data strictly to deliver, maintain, and optimize the features of Hubito. Specifically, data is used for:

1. Authentication & Session Management: To verify your identity via Google OAuth 2.0, establish an authenticated JSON Web Token (JWT) session, and eliminate the need for separate passwords.
2. Database Row-Level Security (RLS) Enforcement: To cryptographically restrict database queries in our PostgreSQL cloud database so that only your verified Google user ID (auth.uid() = user_id) can read, create, update, or delete your tasks and notes.
3. Workspace Personalization: To display your name and profile avatar in the navigation header, user settings dropdown, task comments, and activity audit trails.
4. Cross-Device Real-Time Synchronization: To sync your tasks, checklists, notes, and Pomodoro focus timers across your mobile devices, laptops, and web browsers in real time via Supabase Realtime WebSockets.
5. Customer Support & Bug Resolution: To troubleshoot user-reported issues and maintain application uptime and security.

Strict Limitation of Use: We use Google user data ONLY for providing or improving our application’s core functionality. We do NOT use Google user data for reasons other than providing or improving your application’s functionality. We do not use your data for advertising, marketing, profiling, or training generalized artificial intelligence (AI) / machine learning (ML) models.

4. Explicit Negative Data Practices (What We NEVER Do)

To ensure uncompromising user privacy and complete compliance with Google Trust & Safety standards, we uphold the following strict prohibitions:

• NO Selling or Renting: We do NOT sell, rent, lease, monetize, or trade your Google user data or personal information to third parties, data brokers, or marketing aggregators under any circumstances.
• NO Advertising or Retargeting: We do NOT use Google user data or task contents to serve advertisements, display targeted ads, or build marketing profiles. Hubito is completely free of third-party advertisements and tracking scripts.
• NO Generalized AI / ML Model Training: We do NOT transfer or feed your Google user data, task notes, or comments into generalized machine learning models, neural networks, or Large Language Models (LLMs).
• NO Cross-Site Tracking: We do NOT track your activity across third-party websites or share browsing behavior with data analytics brokers.
• NO Human Reading of Private Content: No human employee, contractor, or developer reads your private task descriptions, notes, or comments unless: (a) you have provided explicit written consent during a technical support ticket, or (b) we are compelled to comply with a valid court order or statutory requirement.

5. With Whom We Share, Transfer, or Disclose Google User Data

We will not sell your data to third parties, but we may share it with our partners who help us provide our services.

We do not transfer or disclose your information to third parties for purposes other than the ones provided. We do not transfer Google user data to third parties for reasons other than providing or improving our application’s functionality. We disclose data solely to the following vetted, industry-standard infrastructure sub-processors strictly required to operate Hubito:

6. Data Protection Mechanisms for Sensitive Data

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information and apply industry best practices across all software layers:

• Encryption in Transit: All data transmitted between your browser, our web servers, and database APIs is encrypted using Transport Layer Security (TLS 1.3 over HTTPS). Plaintext HTTP traffic is rejected and automatically upgraded.
• Encryption at Rest: All database records, user profiles, tasks, and notes are encrypted at rest using industry-standard Advanced Encryption Standard (AES-256) through our cloud database host (Supabase).
• PostgreSQL Row-Level Security (RLS): Every table in our database enforces strict RLS policies. Database operations are cryptographically checked against the authenticated user’s JSON Web Token (JWT). No user can query, modify, or view another user’s records.
• Defense-in-Depth HTTP Headers: We enforce strict HTTP response headers including Content-Security-Policy, Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Cross-Origin-Opener-Policy: same-origin-allow-popups.

7. Disclosures About Data Retention and Deletion

We retain your personal data and Google user data only for as long as your account is active and as necessary to fulfill the services provided.

You maintain full ownership and control over your data. We provide the following clear mechanisms for data deletion and revocation:

A. In-App Deletion of Content

You can delete individual tasks, subtasks, and notes at any time using the delete icons within the application. For comments, Hubito supports user-managed soft deletion where comments are archived and retained in the database for auditing purposes. You can permanently delete any item upon request.

B. Permanent Account & Complete Data Erasure

You may request permanent, irrevocable erasure of your account and all associated cloud data at any time. To request deletion:

1. Send an email from your registered Google account email address to: [email protected].
2. Use the subject line: “Hubito Data Deletion Request”.
3. Include your registered email address and user name.

Turnaround Guarantee: Upon receiving your request, our team will permanently purge your user profile, tasks, subtasks, notes, comments, activity logs, and authentication tokens from all active databases and automated backups within 7 business days. A confirmation email will be sent once deletion is complete.

C. Revoking Google OAuth Access

You may revoke Hubito’s access to your Google Account at any time. When you revoke access, Hubito will no longer be able to access your Google profile data. To revoke access:

1. Visit your Google Account Permissions Center.
2. Locate Hubito in the list of third-party apps with account access.
3. Click on the application and select “Remove Access” (or “Delete all connections”).

8. Google API Services User Data Policy Compliance (Limited Use Disclosure)

9. User Rights & Regulatory Compliance (GDPR & CCPA)

Depending on your location, you have statutory rights regarding your personal data:

• Right to Access (GDPR Article 15): You have the right to request a complete copy of the personal data we hold about you.
• Right to Rectification (GDPR Article 16): You can correct inaccurate or incomplete data directly inside your profile or task cards.
• Right to Erasure (GDPR Article 17): You can demand permanent deletion of your data (“Right to be Forgotten”) as described in Section 7.
• Right to Data Portability (GDPR Article 20): You may request an export of your tasks and workspace data in a structured, machine-readable format (JSON).
• California Consumer Privacy Act (CCPA / CPRA): California residents have the right to know what personal information is collected, request its deletion, and be free from discrimination. We do not sell or share personal information as defined under the CCPA.
• Children’s Online Privacy Protection Act (COPPA): Hubito is not directed to children under 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately for deletion.

10. Policy Updates & User Notification

We are committed to notifying users if we change how our application uses Google user data. If we make material modifications to this Privacy Policy, we will notify you by:

• Posting a prominent announcement notice on the Hubito homepage and within the application workspace prior to changes taking effect.
• Updating the “Last Updated” date at the top of this Privacy Policy.
• If required by Google OAuth verification policies, seeking renewed consent prior to accessing new or expanded scopes.

11. Application & Organization Information

For any questions, privacy concerns, data subject requests, or Google OAuth compliance inquiries, please contact:

• Application Name: Hubito
• Application URL: https://hubito.harisarshad.site/
• Privacy Policy URL: https://hubito.harisarshad.site/privacy
• Terms of Service URL: https://hubito.harisarshad.site/terms
• Contact Email: [email protected]
• Response Time Guarantee: We respond to all privacy, security, and deletion requests within 48 business hours.