HustlyTasker · Legal

Privacy Policy

This policy explains how HustlyTasker collects, uses, and protects your personal data.

Last updated: 08/05/202610 sections
1

Data we collect

When you use HustlyTasker, we collect:

Account information

  • Email, display name, password (hashed)
  • Phone number (optional)
  • Avatar (if you upload one)

Usage data

  • Tasks, comments, and files you create
  • Workspace member information
  • Work history and performance metrics

Technical data

  • IP address, user agent (for audit logs + brute-force protection)
  • Login times and access devices
  • Session cookies to keep you signed in
2

How we use your data

  • Provide and operate the Service
  • Authenticate your identity when you sign in
  • Send notification emails (task assigned, deadlines, ...)
  • Analyze usage to improve the product
  • Prevent fraud, spam, and abuse
  • Comply with the law when there's a valid request
3

Data security

Password hashing
Passwords are hashed with bcrypt (cost 12) — plaintext is never recoverable.
Encrypted connections
HTTPS/TLS is required for all communication.
Data isolation
Database isolation per workspace — data never leaks between organizations.
Brute-force protection
Login attempts are rate-limited (5 failed tries → 15-minute lockout).
Audit log
An immutable audit log records every important action.
Password reset OTP
SHA-256 hashed, expires in 10 minutes, max 5 attempts.
4

Cookies and storage

We use the following cookies:

CookiePurposeDuration
sessionSession JWT (httpOnly, Secure, SameSite=Lax).7 days (30 days if "Remember me" is checked)
tracking_session_idShort-lived session UUID for analytics.30 minutes
NEXT_LOCALEPreferred language for the client portal.No expiry
5

Third-party sharing

We DO NOT sell your personal data. We only share it with essential service providers that operate the Service:

Vercel

Hosting (US, EU)

Neon

PostgreSQL database (US)

Resend

Transactional email delivery

Vercel BotID

Signup bot protection (passive detection)

Upstash Redis

Rate limiting

Have I Been Pwned

Password leak checks (k-anonymity, password never sent)

6

Your rights (Vietnam's PDPL)

Under Vietnam's Personal Data Protection Law No. 91/2025/QH15, you have the right to:

  • View the personal data we store about you
  • Correct inaccurate information
  • Delete your account and all associated data
  • Withdraw consent to data processing
  • Object to certain types of processing
  • File a complaint with the competent authority

To exercise these rights, please email privacy@hustlytasker.xyz with the subject line "PDPL Request".

7

Data retention

Active accounts
Data is kept for as long as your account remains active.
After account deletion
Data is deleted within 30 days.
Audit log
Kept for 90 days for security purposes.
Login attempts
Kept for 90 days.
Email tokens & OTP
Deleted immediately after they expire.
8

Children under 16

HustlyTasker is not intended for anyone under 16 years old. If we discover an account belonging to a child, we will delete it immediately.

9

Policy changes

We may update this Policy. Material changes will be notified by email at least 30 days in advance. The current version is always available at: /legal/privacy

10

Contact

Privacy questions

privacy@hustlytasker.xyz
Email us
Email us