Privacy Policy

Last updated: March 2025

This policy describes how Squirra ("we", "our") collects, uses, and protects your data when you use our application and, where applicable, when you sign in with Google.

Who we are

Squirra is a GTD-based task and reference organizer. When we request access to your data (including via Google Sign-In), we do so solely to provide and improve this service.

Data we collect and why

Account data: Email address and, if you provide it, your name. We use these to create and identify your account and to communicate with you about your account if needed.
Authentication: If you sign in with Google, we receive your email, name, and profile picture from Google only to create or link your account. We do not use this data for advertising, resale, or any purpose other than providing Squirra.
Usage data: Tasks, projects, references, tags, areas, and related content you create. This data is stored to provide the organizer and backup/restore features.
Sessions and tokens: Session and API tokens (stored in hashed form) to keep you logged in and to allow secure use of the browser extension.

How we use your data

We use your data only to:

Provide and operate the Squirra service
Authenticate you (email/password or Google Sign-In)
Store and sync your tasks, projects, and references
Improve the application and fix issues

We do not sell, rent, or share your data with third parties for advertising, data brokering, or surveillance. We do not use your data for personalized or interest-based advertising.

Google Sign-In (if used)

If you choose "Sign in with Google", we request only the minimum information needed to identify you: email address, name, and profile picture. We use this solely to create or link your Squirra account. Our use of Google user data complies with the Google API Services User Data Policy.

Storage and security

Your data is stored on infrastructure provided by Cloudflare (Pages and D1). Traffic is encrypted in transit (HTTPS). Passwords are hashed with PBKDF2-SHA256; session and API tokens are stored in hashed form. We take reasonable measures to protect your data from unauthorized access or disclosure.

Data retention and your rights

We retain your account and content data for as long as your account exists. You can delete your data by using in-app backup/restore and account deletion options where available, or by contacting us. You may request access, correction, or deletion of your personal data.

Changes to this policy

We may update this policy from time to time. If we change how we use Google user data or other personal data in a way that affects you, we will notify you and, where required (e.g. for Google), ask for your consent before using data in the new way.

Contact

For questions about this policy or your data, you can contact us via the contact details provided on the Squirra website or application.

← Back to Squirra · Terms of Service