Privacy Policy

Effective date: November 9, 2026

TaskRelay keeps a Notion database and a Todoist project in step. That means it needs access to both. This page says what it takes, what it does with it, where it is kept and how to get rid of it.

Who we are

TaskRelay is a Finch Relay product (finchrelay.com), operated by BuyFromUS LLC (United States), which is the data controller for the data described here. Contact: support@finchrelay.com.

What we collect

• From Notion: your name, email address and workspace name when you sign in with Notion; and the pages and properties of the databases you share with TaskRelay in Notion's own permission picker. Notion gives us nothing you have not shared.
• From Todoist: the projects of your account (so you can choose one) and the tasks of the project you sync: their name, due date, completed state and priority. Todoist asks you to allow reading, writing and deleting tasks because that is how a sync works.
• Your TaskRelay settings: which database is paired with which project, the properties you chose, the sync direction and your plan.
• Messages you send us through the feedback form or by email.
• Payments: nothing is charged during the beta. If you subscribe later, payment is handled by Stripe; we keep only your Stripe customer and subscription identifiers and your plan, never your card number.

How we use your data

For one purpose: running the sync you configured. We read your Notion database and your Todoist project, compare them and write the changes across so the two match. We also use your email address to reach you about your account and about a sync that stopped. We do not sell your data, use it for advertising, or use it to train models.

Where your data is stored

TaskRelay runs on servers we operate. Your Notion and Todoist access tokens, your settings and your sync state are stored in an access-controlled PostgreSQL database that is not reachable from the internet. The tokens are encrypted at rest (AES-256-GCM) with a key kept outside the database, and are never written to our logs. Sync state is the record that lets us tell a real change from a duplicate: the Notion page id, the Todoist task id and a hash of the content on each side. The title of each task that was created, changed or deleted is kept in your sync log, which is the activity list in your dashboard, for 30 days. The other contents of your pages and tasks pass through memory during a sync and are not stored. Traffic between you, TaskRelay, Notion and Todoist is encrypted with TLS. Database backups are taken nightly, encrypted, and pruned automatically.

Who we share it with

Only the providers that run part of the service you asked for: Notion (your workspace), Todoist (your tasks), our hosting provider, our email provider (Resend) for account emails and, once billing starts, Stripe for payments. We never sell your data. We would disclose it otherwise only if the law required it.

How long we keep it

Your account, tokens and settings are kept while your account exists. Sync logs are deleted after 30 days. When you delete your account, TaskRelay revokes its Notion and Todoist access, cancels any subscription, and deletes your tokens, connections, syncs, sync state and sync logs from our database immediately. Encrypted backups of the database are kept on a rolling schedule (daily for 30 days, then weekly and monthly, for at most 24 months) and are then deleted; a deleted account is not restored from them. Your Notion pages and Todoist tasks are not touched: they stay where they are and are yours.

Deleting your data

Open Account in TaskRelay and choose "Delete account", or email support@finchrelay.com and we will do it for you. You can also remove TaskRelay from Notion's connections settings or from your Todoist integrations settings; your syncs then stop.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Write to support@finchrelay.com and we will answer within 30 days. If you are in the EU or the UK these are your rights under the GDPR, and you may complain to your local data protection authority.

Cookies

TaskRelay keeps your session in one HttpOnly cookie. If you arrive from a link that ends in ?src= (for example our Notion listing), a first-party cookie (fr_src) keeps that one word for 30 days so we can tell where sign-ups come from. We use no tracking cookies, no advertising pixels and no third-party analytics.

Changes to this policy

If we change how we handle your data we will update this page and its effective date, and email you before a change that materially affects you.

Contact

Privacy questions: support@finchrelay.com.