Security

Your account and content are stored with Supabase on managed PostgreSQL, and the app is served by Vercel. If you subscribe, payment is handled entirely by Stripe — card details never reach our servers. If you turn on notifications, delivery goes through the platform push service for your device.

Each of these processes data only to operate the service, never for their own purposes.

Every connection is HTTPS. The site sends a Strict-Transport-Security header with a two-year lifetime, covering subdomains and submitted for browser preloading, so a browser refuses to talk to Taskmetrics over plain HTTP even on a first visit. Data at rest is encrypted by the managed infrastructure it sits on.

Authentication is handled by Supabase Auth. Taskmetrics never stores, logs or sees your password — signing in returns a signed token, and that token is verified cryptographically on every request before any of your data is read.

Every table has row-level security enabled, with policies that compare your user id against the owner of each row. This matters because it holds even if application code is wrong: a request that somehow asked for someone else's task would be refused by PostgreSQL itself, which is the layer no client can talk around.

Paid features are enforced in the same place. A Pro-only feature is closed at the database, not merely hidden in the interface.

The app sends these on every response:

A Content-Security-Policy restricting where scripts and styles may load from, and refusing to let the app be framed at all — which closes the click-through attack on a signed-in session, since Taskmetrics has one-click delete actions. X-Frame-Options: DENY repeats that for older browsers. X-Content-Type-Options: nosniff, and a Referrer-Policy that stops task and project ids in URLs travelling to other sites. A Permissions-Policy denies camera, microphone, geolocation, payment and USB access outright.

There is no third-party analytics, no advertising network and no session-replay tooling in Taskmetrics. The app sets two cookies, both necessary to run it, described on the cookies page.

You can delete your account from inside the app or from Account settings on the web. Deletion removes your sign-in identity first, so access stops immediately, and then every row you own — tasks, projects, time entries, journals, notes. It is immediate and permanent, with no recovery window.

In September 2026 the app went through a structured security review: a read of the source for authorization gaps, then live testing against production for cross-account access, authentication handling and whether paid features were genuinely closed at the database. Findings were fixed, including several database-level permission issues.

That review was internal. It is not a third-party audit, and it would be misleading to present it as one.

Stated plainly, because the absence matters more than the list above:

If you find a security problem, email support@taskmetrics.co with the steps to reproduce it. We aim to acknowledge within three business days.

Good-faith research is welcome. Please test only against your own account, don't access or alter anyone else's data, and don't degrade the service for other people. We won't pursue action over research that stays inside those lines.