Back to home

Privacy Policy

How Introsio handles your data, tasks and habits — written in plain English, without the legal jargon.

Updated November 2026 ~5 min read 16 sections

Overview

Introsio is a workspace for your tasks, projects, habits, deadlines and focus sessions, with an MCP server that lets AI assistants you connect plan and execute projects on your behalf. This policy explains what we collect to run it, who else processes it, and how to take it with you or delete it.

We do not sell your data and we do not run advertisements. We do not use advertising or cross-site tracking. We measure page views on the public site and in the app with Vercel Web Analytics, which sets no cookies.

Information We Collect

We only collect data you explicitly provide or generate by using Introsio:

• Account Information: Your email address and a hashed version of your password (if using local authentication).
• Profile Information: Your display name and profile avatar.
• Productivity Data: The projects, sections, tasks and subtasks you create, habits you track, completion logs, streak records, focus timer sessions, and pictures you upload as a project icon or banner.
• Developer Mode projects: Project context (purpose, tech stack, constraints, decisions), plans and their progress, and the outcomes, file paths and branch or pull-request names that agents report.
• Activity measurements: Counts of what you completed, rearranged (edits, reschedules, undone completions) and focused on, by day and week, which power insights.
• Insight notes: Observations a connected assistant records about how you work. You can see and remove every one in the app.
• Settings: Your timezone setting and notification preferences (for example, email toggles and summary schedules).
• Messages to us: What you send through the contact form or by email.

How We Use Information

The information we collect is used exclusively for the following functional purposes:

• Account Management: Authenticating you and maintaining your session securely across devices.
• Product Functionality: Rendering your dashboard, calculating habit streaks, organizing your tasks based on your timezone, and answering the AI assistants you connect.
• Insights: Measuring your activity so that you, or an assistant you connect, can review it.
• Notifications: Delivering task reminders, habit alerts, and weekly or monthly summaries via email or browser push, according to your exact preferences.
• Support: Investigating bugs you report and responding to your contact requests.
• Security: Monitoring rate limits to prevent brute-force attacks and protecting your account against unauthorized access.

Notifications & Communications

Introsio sends notifications across two channels: email and browser push. You retain complete control over both.

We process data to deliver:

• Reminders: Upcoming tasks and incomplete daily habits.
• Summaries: Weekly and monthly aggregations of your productivity statistics.

You can toggle any category of notification on or off in your Settings. If you disable a channel or a specific summary, the backend service explicitly filters your account out of those dispatch queues.

Cookies & Local Storage

We use essential cookies and local storage entirely for authentication, security, and UI state. We do not use tracking or advertising cookies.

AI Assistants (MCP)

You can connect an AI assistant such as Claude, ChatGPT or a coding agent to Introsio over MCP. You approve each connection on a consent screen and choose its scopes: read (your projects, tasks, habits and focus), write (create and change them) and insights (your activity measurements and insight notes).

What a connected assistant reads is sent to that assistant’s provider (for example Anthropic or OpenAI) and is handled under their terms and privacy policy, not ours. Every request is checked against the connection you approved, and you can revoke a connection at any time in Settings; it stops working immediately.

GitHub Connector

If you connect GitHub, the authorization is held by Composio, which brokers requests to GitHub for us; Introsio never stores your GitHub token. We store only which repository (by GitHub’s id) and branch a project is linked to. Repository content is read live when you open it and is not copied into our database. Disconnecting GitHub, deleting the project or deleting your account removes the link and revokes the connection.

Google Sign-In

If you choose to authenticate via Google, we use Google Identity Services to securely verify your identity.

We request only the minimum required scope: your email, name, and profile picture. We store this information in our database to create and maintain your Introsio account. We do not request access to your Google Calendar, Drive, or any other Google service.

Third-Party Services

We use the following services to run Introsio. Each receives only what it needs for its job, and we never sell your personal information.

• Hosting and databases: Vercel (the web app), our API servers, MongoDB (your workspace data) and Redis (short-lived queues and rate limits).
• Email: our SMTP email provider, for sign-up codes, reminders, digests and summaries.
• Browser push: your browser’s push service (for example Google, Mozilla or Apple) carries the notifications you turn on.
• Error monitoring: Sentry receives error reports with secrets and query strings removed.
• Analytics: Vercel Web Analytics counts page views without cookies.
• In-app insights: the daily and weekly insights shown in the app are written by an AI model provider (Google Gemini or OpenRouter) from your activity measurements.
• Voice dictation: if you dictate a task, the audio is streamed to Deepgram for transcription and is not stored by Introsio.
• GitHub connector: Composio, as described above.
• Sign-in: Google Identity Services, if you sign in with Google.
• Password safety: when you set a password we check it against Have I Been Pwned; only the first five characters of its hash leave our server.

Data Retention

Your productivity data is retained for as long as your account is active. Deleted tasks and projects go to the Recycle Bin first (if you keep it on) and can be restored from there until you empty it. When your account is deleted, your information is permanently removed from our active databases; copies in database backups expire with those backups.

Account Deletion

You can delete your account at any time from the Settings page.

Because deletion is destructive, we require authorization: local accounts must re-enter their password, and Google accounts must type a confirmation phrase.

Your account is then scheduled for deletion 30 days later, every session is signed out, and we email you the date. Signing back in during those 30 days cancels the deletion. After them, your account and all its data — tasks, projects, habits, logs, focus sessions, insight notes and notification settings — are permanently erased, and any GitHub connection is revoked.

Security Practices

We use industry-standard security practices to protect your information:

• Encryption: All data in transit is encrypted using HTTPS/TLS, and sensitive authentication credentials are securely hashed.
• Access Control: Our application endpoints are protected by secure authentication protocols and strict permissions.
• Abuse Prevention: Automated protection mechanisms guard against unauthorized login attempts and malicious activity.

Your Choices & Rights

You have the right to access, modify, or delete your personal information:

• Updates: You can update your display name, timezone, and notification toggles directly in Settings.
• Consent: You can revoke browser push permissions at the operating system or browser level, or disable email summaries via the in-app toggles.
• Export: You can download your tasks and habits as CSV files at any time from Settings.
• Assistants: You can see and revoke every connected AI assistant, and remove any insight note, in the app.
• Erasure: You can execute a complete data wipe by deleting your account.
• Support: If you need help with your privacy rights, contact us and we will handle the request.

Children’s Privacy

Introsio is not intended for use by children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us so we can immediately delete the account.

Changes to This Policy

We may update this policy as we add new features or as privacy regulations evolve. If we make material changes, we will notify you via email or a prominent notification within the Introsio application before the change takes effect.

Contact Us

If you have questions about this Privacy Policy or how your data is handled, please reach out:

• Support: support@introsio.app
• Legal: legal@introsio.app
• Contact form: introsio.app/contact

Terms of Service — The rules for using Introsio, including accounts, acceptable use and termination.

Read Terms of Service