Privacy Policy

Effective October 2, 2026. TaskRunner, Inc. provides TaskRunner and processes information only as needed to authenticate users, connect authorized computers, execute requested remote-computer operations, secure the service, and provide support.

Account and authentication data

We process account identifiers, email addresses, optional display names, session and recovery records, OAuth authorization records, and security-related request information. If you use Google or Microsoft sign-in, those providers process the information required for authentication under their own policies.

Authorized computer and MCP data

We process authorized device identifiers, computer names, account associations, provider aliases, connection status, last-seen data, granted permissions, and command-routing metadata. When you ask ChatGPT or another authorized client to use TaskRunner tools, the service may transmit and process the specific file paths and file contents, directory listings, search queries and results, configuration values, process and terminal commands, process output, system status, and diagnostics required to fulfill that request. TaskRunner does not use this access to browse unrelated content on its own.

Purpose and handling

Remote-computer data is used to perform the user-requested operation, return the result, enforce account and device authorization, prevent abuse, maintain reliability, and troubleshoot failures. Command and audit metadata may be retained for security, reliability, and support. Credentials, machine tokens, and stored vault records are protected using one-way hashing or encryption where applicable and are not intentionally exposed in the user interface.

Sharing and service providers

We do not sell personal information. Data may be processed by infrastructure, hosting, email, identity, and security providers only as needed to operate TaskRunner. When TaskRunner is used from ChatGPT, information submitted to or returned through the plugin is also processed by OpenAI according to the user's OpenAI account settings and OpenAI's applicable policies. We may disclose information when required by law or to protect users, the service, or others from abuse or security threats.

Retention

The essential rw_session account cookie has a maximum age of 30 days and is cleared when you sign out. Remote-session ticket nonces become eligible for deletion once their expiry is more than 24 hours past. Remote-session signaling records become eligible for deletion more than 24 hours after the session closes. When the application is running, expiry cleanup is scheduled approximately once per minute; outages can delay deletion. Support-worker replay nonces older than 24 hours are periodically cleaned when the worker reaches its maintenance trigger, not at a guaranteed deadline.

Account, device, authorization and audit records have no single fixed retention deadline: they are kept while required for an active account, abuse prevention, operational integrity, legal obligations or dispute resolution, subject to applicable privacy requests and law. Transient command payloads and results are kept as long as operationally needed, and may persist in security or diagnostic records where necessary. Revoked credentials and expired sessions are invalidated, although hashed or audit evidence may remain for security. These configured cleanup windows are not guaranteed deletion deadlines for other data categories.

Your controls

You can manage authorized devices, revoke sessions and integrations, sign out, rename or remove devices, and rotate account installation credentials from TaskRunner. You can stop using the plugin at any time and disconnect its authorization from your OpenAI or TaskRunner account. For access, correction, deletion, or other privacy requests, use the support contact available at cloudtaskrunner.com.

Security

TaskRunner uses HTTPS, account-bound authorization, scoped permissions, protected local credential storage, and server-side access controls. No internet service can guarantee absolute security; users should grant only the permissions and device access they intend to use.

Cookies

Read the Cookie settings page for the current account-session cookie and browser controls.

Changes

We may update this policy as TaskRunner changes. Material changes will be reflected by updating the policy text and effective date.