In short
Sticky Widget runs entirely on your own computer. It talks to Google and to nobody else. There is no server belonging to this app, no account to create, and no analytics of any kind. Nothing you write in a task is ever seen by the developer.
What the app accesses
When you connect your account, the app asks Google for one permission:
https://www.googleapis.com/auth/tasks, which allows it to
see, create, edit and delete your Google Tasks and task lists. That is
the only permission requested, and it is what the app needs to show
your tasks and let you change them.
The app does not request access to your email, your contacts, your calendar, your files, or your profile information, and it cannot read them.
How your data is used
Your task lists, tasks, their notes and their due dates are read from Google so they can be displayed on your desktop, and written back to Google when you add, edit, complete, reorder or delete something. That is the entire use.
Google user data is never used for advertising, never sold, never shared with anyone, and never used to train any machine-learning or artificial-intelligence model.
Where your data is stored
- Your tasks are cached in a database file on your computer, so the notes can be drawn instantly and without a network request. This file lives in your own Windows user folder.
- The sign-in token that keeps you connected is stored in Windows Credential Manager, the part of Windows built for secrets. It is never written to a file, never written to the app's logs, and never leaves your computer except to Google when the app renews its access.
- Your preferences — note positions, colours, which lists are open — are kept in a small settings file on your computer. These never leave it: Google Tasks has no such fields, so they exist only locally.
What is sent over the network
The app connects to Google's servers only: the Tasks API
(googleapis.com) and Google's sign-in service
(accounts.google.com, oauth2.googleapis.com).
It also checks GitHub for new versions of the app; that check sends
nothing about you or your tasks.
One exception is worth stating plainly: if you paste a link to an image into a task description, the app displays that image, which means your computer requests it from whatever website hosts it. That website will see that a request was made, as it would if you opened the link in a browser. No task content is sent with the request.
Sharing
Your data is not shared with anyone. There are no third-party services, no trackers, no advertising networks, and no analytics libraries in the app. The only party your data reaches is Google, which is where it already lives.
Retention and deletion
The local cache exists only to serve you and can be removed at any
time. Choosing Disconnect in the app's settings
deletes the stored sign-in token immediately. Uninstalling the app
removes the app; to remove the cached data as well, delete the
in.startupmission.stickywidget folders in
%LOCALAPPDATA% and %APPDATA%.
You can also revoke the app's access to your Google account at any time at myaccount.google.com/permissions. Deleting a task in the app deletes it in Google Tasks, and deleting your tasks in Google is handled by Google.
Google API Services User Data Policy
Sticky Widget's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Children
The app is not directed at children under 13 and collects no information from anyone.
Changes
If this policy changes, the new version will be published on this page with a new date above. The app's source code is public, so any change in what it does with your data is visible in its history.
Contact
Questions or concerns: open an issue on GitHub.