GentleTasks Open the app

Privacy Policy for GentleTasks

Beta version — under legal review. GentleTasks is in a small private beta. This document is a working draft that hasn’t been reviewed by a lawyer yet; when it changes in a way that matters, the app asks you to agree again.

Effective date: October 2, 2026 (beta version 2026-10-beta1)

This Privacy Policy describes how GentleTasks ("the App," "we," "us") handles information when you use the App. GentleTasks is made by Ahem Studios, based in Alberta, Canada. GentleTasks is a behavioral tracking and routine support tool for families of neurodivergent children. Because of what the App does, the information you enter into it is sensitive — it can include your child's name, medication schedule, and behavioral history. This policy explains exactly what is collected, who can see it, and how you stay in control of it.

If you have questions about this policy or want to request that data be deleted, contact us at support@gentletasks.com.

Private beta. GentleTasks is in a small, invitation-only beta. The way it works may change; when this policy changes in a way that matters, the App asks you to agree again. Please keep your own copy of important records (Settings → Me → My Data → Download all data) — during the beta our database plan may not keep long-term backups.

Laws we follow. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA). Our privacy contact — the person responsible for how we handle personal information — can be reached at support@gentletasks.com.


1. The Short Version


2. Information We Collect

2.1 Account Information

To use the App you sign in with a Google account or an email address and password (handled by Supabase Authentication — we never see or store your password). We store your email address and display name so that family members can identify you and so we can operate your account. You may also choose a title for yourself in each family you belong to (for example "Mom", "Stepdad" or "Guardian"); it is shown to that family's members and its assigned doctor next to your name.

Each family keeps a member history: who joined, left, was removed, had their role changed, or (a doctor or teacher) stopped seeing one of the children, when, and by which admin — with the reason, if the admin gave one when removing someone. Only the family's admins can see it; a person who is removed sees the family's name, who removed them and the reason once, the next time they open the App. It is erased with the family, and a person's entries are erased with their account.

We also record which version of the Terms and this policy you agreed to, and when. During the private beta, if you ask to create a new family we keep that request — the family name you gave, your optional note, your email and display name, and our answer — so we can approve it; only Ahem Studios sees it. It is deleted with your account.

If you are a doctor or other clinician interested in GentleTasks for your practice and leave your details on the Welcome screen, we keep what you enter — your name, your role, your clinic, its city and province, an optional phone number and an optional note — with your sign-in email, so we can contact you about it. Only Ahem Studios sees it; it gives you no access to any family; it is deleted with your account (or ask us to delete it sooner). Please don't include any patient information.

The same goes for teachers and school or district staff interested in GentleTasks for their school: we keep your name, role, school or district, its city and province, roughly how widely you'd use it, an optional phone number and an optional note, with your sign-in email, only to contact you about it. Please don't include any student information.

Asking to join the beta on our website. If you use the Ask to join the beta form on gentletasks.com, we keep what you enter — your name, email, whether you're a parent, doctor, teacher or something else, your city and province if you give them, and an optional note — so we can reply about the beta. You don't need an account, and it gives you no access to anything. Only Ahem Studios sees it, and we use it only to reply. To stop spam, the form's server keeps a scrambled (hashed) code made from your internet address, never the address itself, for one day. The website itself still uses no scripts, cookies or tracking. Please don't include your child's details or any health information in the note.

2.2 Family & Child Profile Information

Parents and guardians may enter information about their children, including: the child's name, date of birth, diagnosis (e.g. ADHD, ASD), allergies, prescribing physician and pharmacy contact details, an avatar color, and optionally a title such as "Daughter" or "Son". Children can be added as "managed profiles" that require no email address or account of their own. A parent can also connect a child's own sign-in (for example their Google account) to that child's profile, so the child can see their own tasks on their own device; that sign-in can see only that child's tasks and theme, never a sibling's or clinical records. It can also see that child's own star jar and daily recap: their bonus points with the reasons and note a parent wrote for them, and which of their tasks were finished or need another try that day (never incidents, clinical notes, or a parent's notes on ordinary tasks). A parent can disconnect it at any time, which removes that sign-in from the family.

2.3 Routine & Behavioral Data

The App records task and routine activity: which tasks were completed, when, how long they took, how much help was needed, the child's emotional reaction, skipped tasks and reasons, and behavioral incident records (severity, triggers, duration, recovery time, and free-text notes written by a parent). Until a parent reviews it, a child's finished task is kept as a waiting review (which task and routine, when, how long it took, whether it was skipped, a teen's own notes); approving it turns it into a task log and denying it deletes it. Each task log, incident and medication dose also records which family member entered it, shown to the family and its assigned doctor as "Logged by …". If that person's account is deleted, the entry stays but no longer names them.

2.4 Medication Information

Parents may record each child's medications (name and dose) and log dose events — what was given, when, and whether a scheduled dose was skipped. Behavioral logs may record whether medication was active at the time of an event. Parents and the child's assigned clinician may keep medication notes — trial plans, observations, review dates, and the reasons a medicine was stopped, restarted or its dose changed. Medication notes are visible only to the child's parents / co-parents and assigned clinician — not to read-only members or the child's own login.

For a medicine marked as wearing off during the day, parents may log when it wore off ("Wore off"): the time, how strong it was (gentle / noticeable / hard), optional signs from a fixed list (e.g. irritable, tired) and an optional short note (up to 140 characters). A child's teacher may log the same at school only when the family shares medication with that teacher (a teacher who sees only "given" picks "Medication" without its name). These entries are seen by the child's parents and co-parents, view-only members with Medication switched on, and the child's assigned clinician — never the child's own login, and teachers only see the ones logged at school that day. They are used to show how long a medicine lasts and in the PDF report, are included in the family's data export and are erased with the child or family.

2.5 Health Measurements & Daily Journals

Parents may record height and weight measurements, sleep times and quality, and a daily journal with notes, day ratings and whether the child went to school that day (with an optional reason if they missed it).

2.5a School Information

Parents may record a child's school, grade, school days and times, support or plan notes (e.g. an IEP), and their teacher's name and email address. The teacher's details are stored only so the family has them in one place; the App does not contact the teacher from these fields or share them with anyone outside the family and the child's assigned clinician. If a teacher has joined GentleTasks through the family's invitation, the family can fill these fields from that teacher's own name, email and school in one tap; the family can also see each connected teacher's name, role, school and email. Please only add a teacher's details if you have a reasonable basis to do so.

2.5b A Child's Own Ratings of Their Day

In Child Mode a child can answer "How was school today?" and "How was your day?" with a face (1–5) and optional choices (for example what was hard at school, or what made the day good). A parent can also record the child's answer with them. A child's answer is only used in charts, reports and the clinician's view after a parent approves it; a parent can change or remove it. Parents and co-parents see all answers; read-only family members and the child's assigned clinician see approved answers only; the child's own login sees only their own. These answers are included in the family data export and are erased with the child's or the family's data.

2.6 Clinical Assessments & Clinical Notes

Parents may complete SNAP-IV behavioral assessments and other rating forms in the App (currently a medication side-effects rating and a weekly target-behaviour check-in). The answers, the scores worked out from them, any notes, and who entered them are stored per child. A parent may also type in a teacher's answers from a paper copy; these are marked as the teacher's and may include the teacher's name. Check-in goals (short descriptions of behaviours to work on) are stored per child and may be set by a parent or the child's assigned clinician. A child's assigned clinician may also request a form (with an optional due date, repeat and note); the request, whether it was completed or dismissed, and any note a parent adds when dismissing it are stored with the child's record. Children's own sign-ins cannot see any of this. Clinicians a parent has assigned may write clinical annotations and treatment plans, which are stored with the child's record.

2.7 Parent PIN and Child Picker Check

If you set a parent PIN, only a cryptographic hash of it is stored — never the PIN itself. If you set up the child picker check, we store the animal you chose for each younger child and, for a teen, only a cryptographic hash of their 4-digit PIN. Teen PIN hashes can be read only by the family's parents and co-parents.

2.8 Notifications

Parents using the Android app — or the web app in a browser where they turn notifications on — can get push notifications when a child's task is ready for review, when the child's doctor requests an assessment, when a teacher writes a school note or logs an incident at school, or when someone asks to join the family (each parent can turn each off in Settings → Notifications). Notifications never include the child's or teacher's name. Teachers can get a notification when a family writes a school note (switchable on their Classroom settings); these are only sent on the days and between the times the teacher chooses (weekdays 7 am – 6 pm unless they change it) in their own time zone, so the App stores those choices and each person's time zone name (for example "America/Toronto") on their profile — the one their device reports, or one they chose in Settings → My Time Zone. Each family also has one time zone name (set from a family admin's device, or chosen by an admin in Settings → Family) so that the family's day — when routines reset and which day an entry belongs to — is the same for everyone in it. To deliver them, the App stores a push token for each phone — a random identifier Android gives the App — or, for a browser, the push address and encryption keys the browser creates for this site; both are removed when you sign out. The notification text is generic ("A task is ready for review", "New note from school") and contains no names or details — never the note itself. Optional daily or weekly reminders are scheduled on your phone itself and are never sent to us.

2.8a Crash Reports, Usage Counts & Problem Reports

2.9 What We Do Not Collect

The App does not access your camera, microphone, contacts, or location. It reads a photo only when you pick one yourself to attach to a problem report. It contains no advertising SDKs, no third-party analytics or tracking SDKs, no social-media integrations, and no in-app purchases. We do not collect payment information from families — the App is free for families to use.


3. Children's Privacy

GentleTasks is designed for parents and guardians to record information about their children, with the parent in control at all times.

If you believe a child's information has been provided to us without parental consent, contact us at support@gentletasks.com and we will delete it.


4. How We Use Information

We use the information described above only to:

We do not sell your information. We do not use it for advertising or profiling. We do not train AI models on your family's data.


5. Who Can See Your Family's Data

Access is enforced at the database level by security rules, not just in the App's interface:

We (the developers) have administrative access to the database for operation and support purposes only, and access it in connection with a specific support request or technical issue. Inside the App, our support console shows totals (for example, how many families use the App) and a list of accounts and families so we can run the beta, answer support requests and stop misuse: for each account its email, name, sign-up date, roughly when it was last used, which families it belongs to and in what role, and whether it is active, suspended or scheduled for deletion; for each family its name, join code, creation date, when it was last used and how many adults, children, teachers and doctors it has. A child's own login appears by email only, without a name. The console never shows children's names, records or health information, and every list, look-up and action is recorded.

If an account breaks our Terms of Service we may suspend it (it can't sign in until we lift the suspension; nothing is deleted) or close it, and we may delete a family that breaks them — with the same 7-day window (shown to everyone in the family, and cancellable by its parents) as when a parent deletes it. The person sees a notice, with our reason if we gave one, the next time they open the App.


6. Third-Party Services & Data Storage

The App is built on Supabase (Authentication and a hosted Postgres database). Your family's data is stored in Canada — Supabase's Canada (Central) region, run on Amazon Web Services in Montréal — and processed under Supabase's privacy policy: https://supabase.com/privacy

Outside Canada. A few services we rely on are based outside Canada (mostly the United States): Supabase as a company (for support and operations), Google (Google sign-in and Android push delivery), browser push services, and GoDaddy (which hosts the gentletasks.com website files only — no family data). Information handled by them may be processed in, and accessible to courts and authorities of, those countries. Only what's described in this section reaches them — never your children's records.

If you sign in with Google, Google's own sign-in privacy terms also apply, since Google account sign-in is handled through Google's own Sign-In SDK regardless of which backend the App uses.

Push notifications on Android are delivered through Firebase Cloud Messaging, Google's notification service (the only way to reach an Android app that isn't open). Google receives the phone's push token, the generic notification text, and internal family and child identifiers (random ids, never names) used to open the right screen when tapped — no names, tasks, logs, or health information. Google's privacy terms apply to that delivery: https://firebase.google.com/support/privacy In a browser, notifications go through that browser's own push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). The message is encrypted so only your browser can read it; the push service sees only the browser's push address, the message size and when it was sent. When the App communicates over the network, your device's IP address is necessarily visible to these services as part of standard internet operation.

The App keeps a few things on your own device — unsaved edits on the Settings, Care and Tasks tabs, a running timer, your on-phone reminder choices, any crash reports or usage counts waiting to be sent, and entries made while the device was offline — tasks your child finished, rewards they claimed, their "How was school / your day?" answers, and logs, incidents, doses, journal entries and rating forms you added (kept until they're sent, or until you discard them or sign out), and — for family members only, never for doctors or teachers — a copy of your family's last 30 days so the App can open without a connection (removed when you sign out, switch family, or don't open the App for 30 days) — protected by your device's own security. It needs a connection to load your family's data and for most changes; while offline it shows what was already loaded.

The web version. If you use GentleTasks in a web browser (for example at our app. web address, or installed from the browser to your home screen or desktop), the same things are kept in that browser's own storage on your device instead, and are removed the same way (signing out clears them). The web version also stores a copy of the App's own program files so it can open without a connection — never your family's information. On a shared or public computer, sign out when you're done.


7. Data Retention, Export & Deletion


8. Security

We take the sensitivity of this data seriously:

No system is perfectly secure, and we cannot guarantee absolute security. If a breach of security affects your information and there is a real risk of significant harm, we will tell you as soon as we can, and report it to the Office of the Privacy Commissioner of Canada and Alberta's Information and Privacy Commissioner as the law requires. We keep a record of any breach.


9. Your Rights

You have the right to ask what personal information we hold about you, to have it corrected, to withdraw consent (by deleting your account or your family's data), and to complain. Most of this you can do directly in the App (view, correct, export, delete); for anything else, contact our privacy contact at support@gentletasks.com — we will answer within 30 days.

If you're not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).


10. Changes to This Policy

We may update this policy as the App evolves (for example, if clinic subscription features launch). When a change matters, the App tells you and asks you to agree again before you carry on, and the effective date above is updated. The current policy is always at gentletasks.com/privacy.


11. Contact Us

Ahem Studios — Alberta, Canada Privacy contact: support@gentletasks.com Web: https://gentletasks.com