Privacy Policy

Last updated: July 17, 2026

Catai Task Loop ("we", "our", "the site") is a privacy-first productivity tool. The browser-only MVP stores task data in your browser; paid-plan and Team features may process subscription, seat, workspace, quota, and analytics metadata as described below. We do not sell your task content.

1. Browser task data

• Your task titles, notes, goals, evaluations, and loop history are stored in your browser's localStorage in the browser-only MVP.
• We do not currently upload task bodies to Catai servers in the browser-only MVP. Clearing browser storage may delete the data, so export before resetting the browser.

2. OpenAI API key (BYOK) — Free tier

If you are on the Free plan, you can optionally paste your own OpenAI API key in Settings to unlock AI features (the key bumps the Free quota from 10 to 100 tasks/month, and you pay OpenAI directly for usage).

• The key is stored only in your browser's localStorage under catai:openai-key. We never upload it, never log it, and never see it.
• When you trigger an AI assist, the relevant task content is sent from your browser directly to api.openai.com using your key. OpenAI may retain prompts for up to 30 days for abuse monitoring per their Usage Policies.
• Removing the key (via Settings → "Remove key") deletes it from localStorage and reverts the Free quota to 10 tasks/month.
• Pro and Team plans always use the platform's OpenAI key. You do not paste a key on those plans.

3. OpenAI usage on Pro / Team plans

On Pro ($19/month) and Team ($89/month) plans, AI features are powered by the platform's OpenAI account. When you trigger an AI assist, the relevant task content is sent from your browser to a Cloudflare Worker, which forwards the request to OpenAI under the platform's billing.

• We log only metadata: timestamp, plan tier, task count, token usage, and the request outcome (success/error). We do not store the prompt text on our servers.
• The worker enforces monthly task quotas server-side. Quota data is used solely for billing, anti-abuse controls, and preventing unexpected operating costs.
• OpenAI's data-handling terms apply to the prompts themselves; see OpenAI's API Data Usage Policy.

4. Where your data lives

All loop data is stored in your browser using localStorage. Clearing your browser data deletes it. We have no server-side copy of your task bodies.

5. Subscription, Team, and quota data

If paid plans or Team workspace features are enabled, we may process email and basic account details, subscription status, invoices, seat count, workspace membership, and Owner/Member role metadata. Tier quota data is used for billing, anti-abuse controls, and preventing unexpected operating costs. Stripe processes payment-card details and applicable billing address information; we do not store full card numbers.

6. What we collect for anonymous usage analytics

We use privacy-respecting analytics to understand which pages and features are useful. Specifically:

• Google Analytics 4 (if enabled): page views, anonymized IP, no cross-site identifiers shared with us.
• Microsoft Clarity (if enabled): anonymized session replay for usability, with sensitive form fields masked.
• Google AdSense (if enabled): serves ads. AdSense may use cookies to deliver and measure ads. You can opt out via Google Ads Settings.

These services are only loaded after you give consent where required by law (for example in the EEA / UK). The site owner can switch any of them off via environment variables.

7. Cookies and local storage

We do not set first-party cookies for tracking. Third-party services (Analytics, AdSense) may set their own cookies. See their policies:

• Google Privacy & Terms
• Microsoft Privacy Statement

8. Payments

Payments are processed by Stripe. We never see or store your card number. Stripe receives only the billing details needed to charge you. See Stripe's Privacy Policy.

9. Children

The site is not directed to children under 13, and we do not knowingly collect data from children.

10. Your rights

Depending on where you live (EEA / UK / California / etc.), you may have rights to access, correct, or delete personal data. Since we don't hold your task data on our servers, the data you control is the data in your browser.

For everything else, contact us via the contact page.

11. Changes

We may update this policy. The "Last updated" date at the top will reflect the change.