Privacy

Your account. Signing in with Google gives Polytrack your name, work email address and profile picture. They are kept in a signed session cookie rather than a user database — there is no account record to delete.

Your work. Tasks, comments, reactions and notifications, each stamped with the email of whoever created it, plus an audit trail recording every change to a task and who made it.

Google Chat spaces. A sync reads the name, description, activity date, membership and roles of the organisation’s project spaces. It reads space metadata and membership only, never messages.

Your calendar. The Tasks page reads the next seven days from your own primary calendar each time it renders, and shows them only to you. Nothing from your calendar is written to the database.

Anyone signed in can see every project, task and comment, and can create or change tasks and comments. Project names, space descriptions and Chat roles can only be changed by an administrator. Your calendar is yours alone: it is read as you, and appears on no one else’s page.

There is no analytics, no advertising and no tracking of any kind. Nothing is sold, and nothing is shared outside the organisation. Google is the only third party involved, because the data already lives in the organisation’s own Google Workspace.

Tasks and comments last until someone deletes them; deleting a task deletes its comments too. The audit trail outlives the task it describes — a deletion is itself recorded — so a record of who changed what remains after the work is gone. The Chat snapshot is replaced wholesale by each sync. Notifications are kept, though only the fifty most recent are shown.

One cookie, set at sign-in, holding the session described above and expiring after twelve hours. Your light or dark theme choice is kept in your browser’s local storage and is never sent to the server. There are no other cookies.

The server logs the method, path, status and duration of each request. Query strings are stripped before anything is written, so sign-in tokens never reach the log.

Ask whoever administers Polytrack for your organisation — they can also remove anything here on request.