Privacy Policy

App: Google Tasks MCP · Effective date: 2 October 2026 · Last updated: 2 October 2026

1. Who we are

This Privacy Policy applies to Google Tasks MCP (the "app"). The app is a local Model Context Protocol (MCP) server that lets you manage your Google Tasks from Claude Desktop. It is built on the open-source google-tasks-mcp project (MIT License) and uses a Google OAuth client registered under the name "Google Tasks MCP".

Developer contact: goushanchao@gmail.com. In this policy, "we" and "the developer" mean the person who maintains this app and this website.

Google Tasks MCP is not made, endorsed or reviewed by Google or by Anthropic.

2. Data the app accesses

The developer does not collect any personal data through the app. The app has no user accounts, sends no telemetry and no crash reports, and contains no analytics or advertising code. On your computer, the app handles the following data:

The app does not receive or store your Google password. It does not request your name, email address, profile, contacts, or access to any Google service other than Google Tasks.

3. How Google Tasks data is accessed, processed and used

• The app requests a single Google permission (OAuth scope): https://www.googleapis.com/auth/tasks, which allows it to view and manage your Google Tasks. If you run it in read-only mode, it requests only https://www.googleapis.com/auth/tasks.readonly.
• The app accesses your Google Tasks only when Claude Desktop calls one of its tools as part of a request you made, for example listing tasks, searching your tasks, creating a task or marking one complete.
• Requests go directly from your computer to Google's API at https://tasks.googleapis.com over HTTPS. Your task data never passes through any server run by the developer.
• Your Google Tasks data is used only to provide the features you ask for: showing, searching, creating, changing, moving, completing and deleting your tasks and task lists.
• Your data is not used for advertising, profiling, analytics or any other purpose. The developer does not use it to develop, improve or train any AI or machine-learning model.
• Changes, such as creating, editing, moving or deleting a task, are made only when you ask for them through Claude Desktop. Deleting a task or a list in Google Tasks is permanent.

4. Google authorization (OAuth) and token handling

• You authorize the app on Google's own consent page, which opens in your web browser. You can see the requested permission there before you agree.
• The app uses Google's recommended flow for installed apps. The sign-in result is returned only to a temporary listener on your own computer (http://127.0.0.1), protected with PKCE and a random state value. This listener closes after authorization or after 5 minutes.
• After authorization, the app saves the tokens to a file on your computer, and Google may refresh the access token periodically. The app is designed never to print or log tokens.
• Tokens are sent only to Google: to the Google Tasks API with each request, and to Google's OAuth service when the access token is refreshed. They are never sent to the developer.

5. Where data is stored: local computer, not a remote server

Everything the app stores is stored locally on your computer:

• Windows: %APPDATA%\google-tasks-mcp\tokens.json
• macOS and Linux: ~/.config/google-tasks-mcp/tokens.json (or under $XDG_CONFIG_HOME if set)
• The location can be changed with the GTASKS_TOKEN_PATH environment variable.

The token file is plain JSON. It is not encrypted by the app. It is protected by your operating system's user-account file permissions: on macOS and Linux the app sets the file so only your user account can read it, and on Windows it sits in your personal user profile folder. Anyone who can sign in as your user account on that computer could read it.

The developer does not operate a backend for this app. Your tasks and tokens are not stored on peqdo.com or on any other server run by the developer. Your tasks remain stored by Google in your Google account, as always.

The app writes short status and error messages to its standard error output. Claude Desktop may save these in its own log files on your computer. The app does not include tokens in these messages.

6. Sharing with third parties

The developer does not sell, rent, trade or share your data with anyone. Because of how the app works, data does flow to the following parties:

• Google: the app sends your requests and tokens to Google's APIs in order to read or change your Google Tasks. Google's handling of your data is governed by the Google Privacy Policy.
• Claude Desktop and Anthropic: the app returns the results of each request (for example, the titles, notes and due dates of the tasks you asked about) to Claude Desktop, so that Claude can answer you. This is the user-facing feature you are asking for. Claude Desktop sends conversation content, including these results, to Anthropic to generate Claude's replies. That processing happens in your Claude account, is under your control, and is governed by Anthropic's terms and privacy policy, not by the developer. The developer receives none of this data.

We will not disclose Google user data to anyone else, except where required by law. Since the developer does not hold any of your Google user data, there is nothing for the developer to disclose.

7. Google API Services User Data Policy (Limited Use)

Google Tasks MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the user-facing features described on our home page and in this policy.
• Google user data is transferred to others only as needed to provide these features at your direction (to Claude Desktop, as described in section 6), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
• Google user data is not used or transferred for serving advertisements, including retargeting, personalized or interest-based advertising.
• Google user data is not sold, and it is not used to determine creditworthiness or for lending purposes.
• No human reads your Google user data, except with your affirmative agreement for specific messages, when needed for security purposes, to comply with applicable law, or when the data has been aggregated and anonymized for internal operations. Since the developer never receives your data, the developer does not read it.
• Google user data is not used to develop, improve or train generalized AI or machine-learning models.

8. Data retention and deletion

• Task data: the app keeps task data only in memory while it handles a request, and it is gone when the app process stops. Your tasks themselves stay in your Google account until you delete them in Google Tasks.
• Tokens: the token file is kept on your computer until you delete it. To remove it, delete the tokens.json file at the location in section 5, or delete the whole google-tasks-mcp folder. Deleting the file does not by itself revoke Google's authorization, so also follow section 9.
• Claude conversations: task content that appeared in a Claude Desktop conversation is kept according to your Claude settings. You can delete those conversations in Claude.
• Data held by the developer: none. If you email us, we keep the correspondence only as long as needed to answer you, and we will delete it on request.

9. How to revoke Google access

You can withdraw the app's access to your Google account at any time:

1. Go to your Google Account's Third-party apps & services page (https://myaccount.google.com/connections).
2. Select Google Tasks MCP.
3. Choose Delete all connections (or "Remove access").

After you revoke access, the stored token stops working immediately, and the app can no longer read or change your tasks. You can then delete the local token file (section 8) and remove the app from your Claude Desktop configuration.

10. Security

• All communication with Google uses HTTPS (TLS).
• Authorization uses Google's OAuth 2.0 flow for installed apps, with PKCE, a random state check, and a callback that listens only on your own computer (127.0.0.1).
• The app requests only the Google Tasks permission it needs. You can choose the read-only permission instead.
• The app does not run a public server, and it does not send your data to the developer. As a result, there is no central store of user data that could be breached.
• Tokens are stored in your user profile with operating-system file permissions, and the app does not include them in its output or logs. Keep your computer and user account secure, because anyone with access to your user account could read the token file.
• The app's source code is public, so anyone can inspect how it handles data.

No method of storage or transmission is completely secure. If you believe your token has been exposed, revoke access as described in section 9 and authorize again.

11. This website (peqdo.com)

This website is a static information page. It uses no cookies, no analytics, no advertising and no third-party scripts, fonts or trackers. Like most web servers, the server that hosts it automatically records basic request logs (IP address, date and time, requested page, browser user-agent). These logs are used only to operate and secure the site. They are not combined with app data, and they are deleted automatically on a rolling basis within 30 days.

12. Children

The app is not directed to children and is intended for people who are old enough to have their own Google account and Claude account under the applicable terms.

13. Changes to this policy

If the way the app handles data changes, we will update this page and its "Last updated" date before the change takes effect. If a change would use your data in a way you have not agreed to, we will ask for your consent first.

14. Contact

For privacy questions, requests or concerns, email goushanchao@gmail.com. We aim to reply within 30 days.