Tusk
English

Tusk Privacy Policy

Version dated 2 November 2026

This Policy explains which personal data are processed when you use tusk.best, Tusk applications and related services, why they are needed, with whom they are shared and how you can manage your data. It also sets out the controller's policy on personal data processing.

The processing involved depends on the version, platform and features you choose. Simply opening the website does not send us the contents of your tasks or diary. This Policy provides information about processing and does not replace consent where the law requires it. Using the website or accepting the Terms of Use does not, by itself, constitute consent to every kind of processing.

1. General provisions

“Controller” or “we” means the person providing Tusk and organising the processing of personal data. Their details and contact information appear in section 15.

This Policy covers website visitors, application users, account holders, participants in sharing, purchasers and people who contact support. Independent processing by external websites, stores and payment services is also governed by their own rules.

2. Data and purposes of processing

2.1. Website and network connections

When a network request is made, the server and infrastructure providers receive the IP address, time, requested resource address, request result and information about the browser or application and operating system. This information is needed to deliver pages and files, operate the service, prevent abuse and investigate faults. It may be included in technical logs.

2.2. Accounts and authentication

Account processing uses your email address, account and sign-in provider identifiers, and information about email verification and authentication. Signing in through Google may also provide the name and profile picture supplied by Google. Depending on the available email sign-in method, your password is processed by Firebase Authentication or Tusk's authentication service. Our own service stores a protected representation for password verification, rather than the password in plain text. Verification results and tokens are needed to provide and protect access.

Email is used to verify your address, restore access, respond to enquiries and send necessary messages about your account, purchases, security and significant service changes. Marketing emails require a separate legal basis, including prior consent where mandatory.

2.3. Tasks and planning

The application processes the task names and descriptions, subtasks, lists, tags, schedules, dates, reminders, completion and skip records, numerical goals, timers, templates, days off, appearance settings and service identifiers that you create. These are needed for planning, notifications, statistics, achievements and carrying out your commands.

During local use, data are stored on your device. With cloud synchronisation, they are sent to Tusk's server, stored there and delivered to your other devices. Ordinary synchronised tasks do not have end-to-end encryption that makes their contents accessible exclusively to you. Not all local files and exports are encrypted.

2.4. Diary

The diary contains your entries, pages, section structure and service information. With cloud storage, its contents are transmitted and stored in encrypted form. Access to keys depends on the mode:

  • Account-based recovery. Tusk stores and recovers the key using server-side safeguards. This mode does not make it technically impossible for the controller to recover the key.
  • User-controlled keys and end-to-end encryption. Decryption depends on your secret and keys on trusted devices. Server-side recovery through an account key is not provided. Losing the necessary secrets and trusted copies may make your entries inaccessible.

Local locking and end-to-end encryption are different safeguards. Changing modes does not automatically delete files you previously exported or external copies. Diary data are not included in a diagnostic task snapshot for support.

2.5. Sharing

Sharing involves processing the content you select, participants, their identifiers, invitations, roles, permissions and actions involving shared materials. Participants receive data within the access you grant. Revoking access does not automatically destroy exports, screenshots or independent copies they have saved.

2.6. Purchases

Trial and paid access, purchase verification and restoration, prevention of purchase reuse and refunds use the account identifier, product, amount and currency, order and transaction identifiers, dates, payment status and access period. Contact details needed for a mandatory receipt are processed to document the payment.

Full card details and the security code are entered with the payment provider or store. Tusk does not request them through support and does not store full card details or the security code in its purchase database.

2.7. Support

An enquiry includes its type, subject, text, reply address, reference number and submission time. The application may attach its version and build, platform, error information and environment details: device model, system version, language, time zone, screen, scaling and font settings. A reply address is required on the website; in the application it may be optional. These data are needed to respond and investigate the issue.

Do not include passwords, tokens, payment credentials or unnecessary information about yourself or others in free text. Content you include becomes part of the enquiry.

3. Optional diagnostic task snapshots

Before sending an enquiry in the application's feedback form, you can review and change whether to attach a task snapshot. You can send an enquiry without a snapshot; selecting the option alone sends nothing.

The snapshot contains a transformed copy of the structure of tasks, lists, tags, schedules, completions, timers, days off and settings. Text, identifiers, icons and certain other values are transformed, and some service fields are removed. Relationships, dates and numerical parameters needed for reproduction are retained. A snapshot therefore cannot be considered guaranteed anonymous. It may include transformed information from tasks imported from a calendar.

The diary, encryption keys, passwords, authentication tokens and bank card details are not included. The snapshot is sent to Tusk solely to investigate the enquiry, stored separately with encryption, and made available to an authorised developer with access logging. It is not used for advertising or sent as an attachment to Crashlytics.

Retention is up to 30 days from receipt. For earlier deletion, email support@tusk.best and include the enquiry reference. Task snapshots are not attached automatically on the website.

4. Automatic diagnostics and security

Tusk reports. To detect and fix failures in startup, saving, synchronisation and restoration, the application automatically collects and sends minimal technical error reports as part of its operation. They may contain random installation and launch identifiers, application version and build, platform, available device and system parameters, error type, sanitised stack traces, allowlisted technical events and repeat counts. Task and diary contents, messages, photos and videos, passwords and tokens are not included in these reports. Reports are not used for advertising.

There is no user switch for collecting or sending these reports; opening the feedback form is not required. Without connectivity, reports remain in a bounded device queue until a retry or expiry; recurring failures are grouped. Delivery cannot be guaranteed in every situation. Processing is subject to the legal bases and user rights described in this Policy.

Firebase Crashlytics. Supported Android, iOS and macOS versions use a separate Google service for crash diagnostics. It receives technical information about errors and the device, installation identifiers, and system and application versions. An exception message may contain data fragments related to the error. You can direct questions about diagnostics and deletion to the controller.

freeRASP / Talsec. Mobile versions check application and device security, including signs of application modification, root access, jailbreak, debugging and environment spoofing. Talsec receives results, technical installation and device identifiers, and the IP address. The provider may derive an approximate location and network operator from the IP address to prevent abuse. Under its terms, information is also used to develop security products and conduct aggregate security research. The absence of a name does not make these data fully anonymous.

5. Google Calendar and other connections

You choose whether to connect a calendar through Google's permissions. Tusk receives information about events accessible under the permission: names, descriptions, dates, times, time zones, recurrence rules and identifiers. Export and synchronisation send the corresponding information from selected tasks and technical identifiers to Google. The permission screen shows the scope of access.

Data are used for the planning, import and synchronisation features you choose. If an imported task is included in Tusk cloud synchronisation, sharing, exports or an optional snapshot, the relevant sections of this Policy apply. People do not view Google data without a basis permitted by Google's rules, such as your separate permission to investigate an issue or a security necessity.

Use of information from Google APIs complies with the Google API Services User Data Policy, including Limited Use. These data are not used for advertising, data sales or training general-purpose artificial intelligence models.

You can switch off import and export in Tusk and revoke access through your Google Account connections. This does not automatically delete imported tasks or events created in Google: delete them in the relevant service. Earlier versions may use Google Tasks, Facebook sign-in and Cloud Firestore for synchronisation, enquiries and archives; such processing is linked to the feature used. Older versions may also download fonts from Google Fonts.

6. Device features, Hulp and exports

  • Notifications. Permissions are used to display and schedule reminders. Their contents may be visible on the lock screen, depending on system settings.
  • Microphone. Hulp dictation, when you enable it, uses on-device recognition on a supported device. We do not send audio or command text to an external generative AI service. A system keyboard or dictation tool you independently choose is governed by its own rules.
  • Hulp. The built-in assistant interprets commands on your device. The result is processed as an ordinary action: for example, a created task may be synchronised. Dialogue context is used in the current session; Hulp does not create a separate cloud conversation history with an external language model.
  • Biometrics. For local unlocking, we receive the result of the system check. Fingerprint templates and face images used for that check are not sent to Tusk's controller.
  • Files. A backup, CSV, PDF or other export writes selected information to a file or sends it to an application you choose. Recipients and cloud drives process it under their own rules. Protect copies according to their contents.

You can revoke permissions in device settings; the relevant feature may become unavailable. GPS is not required for ordinary planning. A provider deriving an approximate location from an IP address is a separate form of processing.

Processing is carried out for specified purposes and to the extent necessary. It includes collection, recording, organisation, storage, correction, use, disclosure to authorised recipients, restriction, deletion and destruction. Automated tools are used, with authorised people involved, for example, when responding to support enquiries.

  • A contract initiated by you: your account, chosen cloud features, purchases, access and related enquiries; point 5 of part 1 of Article 6 of Federal Law No. 152-FZ.
  • Legal obligations: payment records, lawful requests and data subject rights; point 2 of part 1 of Article 6 of Law No. 152-FZ.
  • Legitimate interests, with respect for your rights: protecting accounts, preventing fraud, and service security and stability within lawful limits; point 7 of part 1 of Article 6 of Law No. 152-FZ. This does not replace mandatory consent.
  • Separate consent: optional diagnostic attachments, advertising and other cases in which the law requires it. Consent is obtained separately from acceptance of the Terms and can be withdrawn.

If the GDPR applies, the corresponding bases are contract, legal obligation, legitimate interest or consent under Article 6 of the GDPR, depending on the purposes above and subject to any additional required conditions. We do not use solely automated decisions about users that produce legal or similarly significant effects.

Not all possible data are mandatory. Refusal affects the particular feature: without necessary account data, cloud data cannot be linked; without purchase confirmation, paid access cannot be granted; without calendar permission, the connection cannot be made. Refusing a snapshot does not prevent you from sending an enquiry.

Do not unnecessarily include information about health, religion, political opinions or other special categories of data. You must have a lawful basis for using and disclosing information about other people.

8. Recipients and countries of processing

The controller and authorised people access data only to operate the service, provide support, ensure security and comply with the law. Providers receive information needed for their role, subject to contractual and legal requirements.

  • Tusk infrastructure. Russian Cloud.ru infrastructure is used for the website and server functions. Hosting, storage, key protection and service email delivery providers process information to provide those services.
  • Google / Firebase. Authentication, calendars, Crashlytics and the earlier-version features identified above. Further details: Firebase privacy information and Google's Privacy Policy.
  • Talsec. Security checks and technical data described in section 4; freeRASP data policies.
  • YooKassa / YooMoney, banks, Google Play and the App Store. Payments, purchase verification and restoration, refunds and payment records, depending on the purchase method.
  • Recipients you select: sharing participants, calendars, applications and services to which you send data.
  • Competent authorities and other parties: where legally justified and to the extent required.

Foreign providers may process information outside Russia. According to Google's documentation, Firebase Authentication processes data in the United States; other Google services also use global infrastructure. Hosting Tusk's server in Russia does not mean every participant in processing is located in Russia. Ask the controller about applicable recipients, countries and safeguards for a particular transfer.

Processing of Russian citizens' data is subject to applicable localisation and cross-border transfer requirements. Mandatory notifications and other procedures must be completed before the relevant processing; accepting this Policy does not replace them. If the GDPR applies, transfers outside the relevant territory require the bases and safeguards it provides; information about these and available copies can be obtained from the controller.

We do not sell personal data or provide task, diary or calendar contents to advertising intermediaries for personalised advertising.

9. Retention

  • Accounts and cloud data: while the feature is used and the data remain necessary to perform the contract, until the data or account are deleted; after the legal basis ends, within lawful deletion periods. Signing out or uninstalling the application does not delete the cloud account.
  • Enquiries submitted through Tusk forms, their context and server-side snapshots: up to 30 days from receipt. Our own automatic diagnostic events are also retained for up to 30 days. Error recurrence summaries without enquiry text or snapshots are deleted 180 days after the last corresponding event.
  • Email correspondence: until the issue and associated obligations are resolved; where a dispute or mandatory legal requirement applies, for the period needed for that purpose. This is determined by the subject of the enquiry and the applicable period for considering or defending the claim.
  • Unsent enquiries, their attachments and our own diagnostics on the device: up to 7 days, or until earlier submission or deletion.
  • Crashlytics: Google specifies 90 days for crash data and identifiers before deletion from live and backup systems begins. The provider's rules are linked in section 8.
  • Restore history: daily points within 14 days, weekly points within 90 days and monthly points within 365 days. Yearly points may be kept longer for historical recovery while that purpose remains valid. Older archive mechanisms and local backups may keep the latest seven copies. Rotation does not replace compliance with a deletion request.
  • Payment records and evidence of operations and requests: for the statutory period or while needed for a specific unresolved claim. Service records proving deletion and preventing purchase reuse may be retained separately on an independent legal basis; this does not permit indefinite retention of task contents.
  • Logs and security: while necessary to identify and investigate faults and abuse, taking account of the category, age, any open investigation and mandatory period. You can ask the controller about the specific period and basis.
  • Local data and exports: until deleted by you or the system. Copies held by independent recipients are governed by their rules and the law.

Once the purpose is achieved, consent is withdrawn without another basis, or a justified request is received, data are deleted, destroyed or properly anonymised within statutory periods. If immediate destruction of backup data is technically impossible, access and use are restricted and destruction is completed within the permitted period. Restoring a copy does not cancel a previously received deletion request.

10. Cookies and browser storage

Tusk's website does not use advertising or behavioural analytics trackers. For purchases, sessionStorage may store technical operation references, the product and account identifier so that refreshing a page does not accidentally create another purchase. Tusk passwords and authentication tokens are not stored there.

The new website's authentication keeps Firebase state in page memory; a full refresh or closing the tab may require you to sign in again. External Google sign-in, payment services and stores may use their own cookies and technologies under their own rules. Restricting browser storage may interfere with certain operations.

11. Rights and account deletion

Within applicable law, you can obtain information about processing and access your data, request correction, blocking, restriction or deletion, withdraw consent, object to processing based on legitimate interest and receive a portable copy where that right exists. You may contact Roskomnadzor, another competent supervisory authority or a court.

To delete your account, use the relevant command in the application or email support@tusk.best with the subject “Tusk: account deletion”. Provide the account email address and your request. If you no longer have email access, tell us: we will offer proportionate ownership verification. Your password, full card number and diary key are not needed for an enquiry.

Deletion ends access to associated cloud features and starts deletion of account-related data, except information retained on an independent lawful basis. Save the materials you need first. Independent copies outside the account do not disappear automatically. An automatically renewing subscription through an external store must also be cancelled in that store.

Enquiries and diagnostics may have separate references and may not be linked to the account. Supply the reference or other sufficient information to locate them. You do not need to create a new account to make a request.

We verify that a request belongs to you proportionately and respond within the lawful period. For access requests under Law No. 152-FZ, this is within 10 working days; if extended by up to 5 working days as permitted, we explain why. Processing cessation and destruction follow the periods in the relevant provision. Under the GDPR, the general response period is one month, with a permitted, reasoned extension. If a request cannot be fully fulfilled, we explain the grounds and ways to challenge the decision.

Withdrawal of consent applies going forward and does not invalidate earlier processing or processing on another independent legal basis.

12. Security

We apply necessary legal, organisational and technical measures: access controls, secure connections, authentication checks, key protection and restricted access to support attachments. The cloud diary and snapshots use the encryption safeguards designed for them. Diary recovery depends on the mode.

Risks cannot be eliminated entirely. Update your system, protect your device and email, check sharing participants and store keys and exports securely. If an incident occurs, we limit its consequences and fulfil applicable duties to notify authorities and users.

13. Minors

Tusk is a general-purpose planner. Where applicable law requires a legal representative's involvement in a contract, purchase or data processing, that involvement must be ensured. We do not knowingly collect children's data where proper authorisation is required but has not been obtained. Notify the controller of such cases so that we can investigate and take action.

14. Changes and service closure

The current version is published with its date. We communicate significant changes through available means on the website, in the application or by email. Where a new purpose or method requires new consent, it is requested before processing starts; a new version does not itself expand previous consent.

When the service closes, data are used to complete obligations, enable users to obtain their data as provided for, and comply with the law, then deleted within applicable periods. The right to discontinue service and the consequences for paid access are governed by the Terms of Use and mandatory law.

15. Provider and contact details

The personal data controller and provider of Tusk is Individual Entrepreneur Ursul Alexey Sergeevich, taxpayer identification number (INN) 540862460020, primary state registration number for individual entrepreneurs (OGRNIP) 321547600083721, Russian Federation.

Correspondence address: Krasny Prospekt, building 167/4, Novosibirsk, Russia, 630049. Email for privacy, data access and deletion enquiries: support@tusk.best.