Privacy policy

Who we are

Zugaz is a project-management app for business teams. It is operated by Echelon One Pty Ltd (ABN 78 618 159 354), 29 William Street, Norwood, South Australia 5067 ("we", "us"). This policy explains what personal information Zugaz collects, why, where it goes, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Questions or requests: privacy@zugaz.com.

The short version

• We collect what we need to run your team's boards: your account details, the tasks and notes you and your colleagues add, summaries of team meetings, and, if you choose to connect them, read-only access to the events on your Google Calendar and the transcripts of meetings you record with Fireflies.
• We use AI to suggest how important and urgent each task is, to turn meeting notes into to-dos, to answer your questions in Ask Zugaz and to draft a first version of a task. You can change or delete anything it produces.
• We do not sell personal information, we do not use it for advertising, and nothing you put into Zugaz is used to train AI models.
• Your data is stored in Australia (Sydney). Some service providers we rely on are overseas, mainly in the United States.
• You can disconnect Google Calendar or any meeting source, export your data or have it deleted at any time.

What we collect

Account information

Your name, work email address and, if you sign in with Google, your Google profile name and photo. We use this to identify you, to show your name on tasks you own, and to send you the emails you ask for. If a colleague invites you, we keep your email address until you join or the invitation is cancelled.

Work you put into Zugaz

Tasks, projects, sections, notes, comments, checklists, due dates, owners, links and your organisation's written goals. Your colleagues may add tasks that name you or assign work to you. We also keep a record of changes (who changed what, and when) so your team can see what moved.

Meetings

Zugaz can read meeting transcripts in two ways: from a meeting source you connect yourself (see "Meeting sources you connect" below), or, for organisations Echelon One supports directly, from a notetaker Echelon One runs. Either way, Zugaz reads the transcript to produce the meeting title, a short summary, the decisions made, the names of the people who spoke and the actions agreed. The full recording and transcript are not kept in Zugaz. Each task Zugaz creates from a meeting you connect keeps the line it came from, up to 200 characters, so you can see why the task exists; tasks marked private keep no quote. We instruct the AI to leave out money figures, pay, health, personal matters and negotiation positions, and to send sensitive actions to the owner's private board rather than a shared one. For the notetaker Echelon One runs, an automatic keyword screen also removes transcripts that match certain legal, medical and personal-banking terms before any AI sees them. It is a coarse filter and will miss things. If something should not be there, tell us and we will remove it.

Meeting summaries and quotes can mention people who do not use Zugaz, such as clients or guests. If that includes you and you want something corrected or removed, write to us.

Google Calendar (only if you connect it)

If you choose to connect your Google Calendar, Zugaz requests one permission: read-only access to the events on calendars you own (calendar.events.owned.readonly). For events from 7 days ago to 30 days ahead, Zugaz reads the event title, start and end times, and the names and email addresses of the people invited, who may include people who do not use Zugaz. Zugaz does not read event descriptions or attachments, skips events you have marked private, and cannot create, change or delete anything in your calendar.

Meeting sources you connect (only if you connect one)

You can connect a meeting source in Settings, under Connections, and choose where its tasks go: your organisation's boards, only your own board, or paused.

• Fireflies.ai. You give Zugaz your own Fireflies API key. Zugaz stores it encrypted and uses it only to list the meetings you recorded and read their transcripts, starting three days before you connected. It does not read meetings recorded by other people in your Fireflies team.

You can pause or disconnect a source at any time. Disconnecting deletes the stored key straight away. Tasks already created stay, and you can remove any of them.

Usage and technical information

Basic technical records needed to run and secure the service: sign-in times, device and browser type, IP address and error logs. We use Cloudflare Web Analytics, which counts page visits without cookies or cross-site tracking. Fonts on our pages are loaded from Google Fonts, which receives your IP address when your browser fetches them. We do not use advertising trackers.

Cookies and browser storage

Zugaz keeps your sign-in session, and the accounts you have used on that browser, in your browser's local storage, along with small preferences such as which view you last used. We do not use cookies for tracking. When you sign in, Cloudflare Turnstile checks that the request comes from a person rather than a bot; it reads signals from your browser to do that and does not set advertising cookies. If an email we send bounces or is marked as spam, our email provider tells us and we stop sending to that address.

How we use it

Purpose	Information used
Run your boards, show tasks to the right people, keep a change history	Account information, your work in Zugaz
Send the morning to-do email and the other notifications you choose	Account information, your tasks
Turn agreed meeting actions into tasks and post meeting agendas to your team's chat group	Meeting summaries, transcripts from a meeting source you connect, your tasks
Suggest how important and urgent each task is, with a one-line reason, and pick "three things today"	See "How Zugaz uses AI" below
Show your upcoming meetings next to the tasks they relate to	Calendar events (if connected)
Answer your questions in Ask Zugaz, and write a first draft of a task with Draft with AI	The tasks you can see, your organisation's goals, recent team meeting summaries and decisions, and your own calendar events (if connected)
For organisations Echelon One supports directly, and only with their agreement: close a task when Zugaz sees the work done	Sent emails, signed agreements and code changes that match an open task
Keep the service secure, fix faults, prevent abuse	Technical information, account information
Meet legal obligations	Whatever the obligation requires

We do not use personal information for any other purpose unless you agree or the law allows it. We do not send marketing emails. If we ever want to, we will ask first, and every such email will identify us and let you unsubscribe.

How Zugaz uses AI

To suggest where each task belongs, Zugaz sends an AI model the task titles and notes, your organisation's written goals, short excerpts of your organisation's recent meeting transcripts and, if you have connected it, your calendar event details. For tasks on your private board, it may also use planning notes you have chosen to give Zugaz. The model returns a score and a short reason.

• Who sees the result. Scores and reasons for shared tasks are shown to the people who can already see the task. Meetings from your calendar, and any reason that draws on them, are shown only to you; colleagues see the score with a general reason. Results for your private board are shown only to you.
• The AI provider. The provider uses this data only to return the result. Its commercial terms forbid it from using the data to train models, and it deletes the data within 30 days (longer only if its safety systems flag misuse).
• Ask Zugaz and Draft with AI. When you ask Zugaz a question, it sends the AI model the tasks you can already see, your organisation's goals, recent team meeting summaries and decisions and, if you have connected it, your own calendar for the next week, and shows you the answer. Draft with AI sends the task's title, notes, project and your organisation's goals. Neither stores your question or the answer; we keep only a daily count to apply the limit. They only read: they never change a task.
• What is automatic. Scores never change a task. Meeting actions are different: after a meeting, Zugaz creates the to-dos that were agreed, with the person and date named in the meeting. The owner can edit or delete them. For organisations Echelon One supports directly, and only with their agreement, Zugaz can also close a task when it sees evidence the work is done (a sent email, a signed agreement, a code change), records that evidence on the task, and never closes it again once a person reopens it. Nothing else about a task changes unless a person changes it.
• Your choice. You can switch the Quadrant view to "Rules" placement, which uses only dates and priorities.

Automated decisions

Zugaz uses computer programs to (a) score how important and urgent tasks are, using the information described above, (b) create agreed meeting actions and assign them to the person named in the meeting, and (c) for organisations Echelon One supports directly, close a task when it sees evidence the work is done. No decision about your employment, pay or access to a service is made by a computer program in Zugaz. People can change or delete anything these programs produce.

Google user data

In practice that means:

• Use. We use Google Calendar data only to show your meetings in Zugaz, to inform the task suggestions described above, and to answer your own questions in Ask Zugaz, all of which you can see in the app.
• Sharing. We share Google Calendar data only with the AI provider that produces the task suggestions and Ask Zugaz answers, and only after you have agreed to that on the screen where you connect your calendar. We do not share it with anyone else except where needed for security or required by law.
• No selling, advertising, lending or AI training. We never sell Google user data, never use it for advertising, never use it to assess credit-worthiness, and never use it, or let anyone else use it, to train or improve AI or machine-learning models.
• No human reading. No person at Echelon One reads your calendar data unless you ask us to look at specific events (for example, to fix a problem you report), it is needed to investigate security or abuse, or the law requires it.
• Storage. The access token Google gives us is stored encrypted and is used only to read your events. Event details, and anything Zugaz derives from them, such as a suggestion's reason or a score that took an event into account, are kept for no more than 30 days and then deleted or recalculated without the event.
• Your control. Disconnect at any time in Zugaz under Settings, or at myaccount.google.com/permissions. When you disconnect, we revoke and delete the token straight away and delete stored event details within 30 days.

Who we share it with

Inside your organisation, people see what the workspace settings allow: shared boards are visible to your organisation's members, and your private board is visible only to you. Outside your organisation, we share personal information only with the service providers that run Zugaz for us, under terms that limit their use of it to providing their service:

Provider	What they do	Where
Supabase	Database and sign-in; server functions	Database in Australia (Sydney); server functions may run in other regions; United States company
Cloudflare	Hosts the website and app, protects it from attack, counts page visits	Global network; United States company
Google	Sign in with Google; Google Calendar if you connect it; web fonts	United States
Fireflies.ai	Your meeting transcripts, if you connect Fireflies, read with your own key	United States
Resend	Sends Zugaz emails	United States
Anthropic, directly or through OpenRouter (which passes the request to Anthropic)	The AI models behind task suggestions, meeting summaries, Ask Zugaz and Draft with AI	United States
Telegram	Delivers meeting agendas and task lists to team chat groups your organisation uses	United Arab Emirates and other countries

We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or restructure of the business. If the business that operates Zugaz is sold, we will tell you first, and Google user data will only move with your explicit prior consent.

Overseas disclosure

Your data is stored in Australia. Some of the providers above are based in, or process data in, other countries, mainly the United States and, for Telegram, the United Arab Emirates. Before using any of them we take reasonable steps, through their contracts and published data-protection terms, to make sure they handle personal information consistently with the Australian Privacy Principles, and we remain responsible for how they handle it.

Security

Data is encrypted in transit and at rest. Access inside Zugaz is enforced by database rules, so a person only receives the tasks they are allowed to see. Access by our own staff is limited to what is needed to run and support the service. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, whether or not the law requires it.

How long we keep it

• Account information and your work in Zugaz: for as long as your organisation uses Zugaz, then deleted from our live systems within 90 days of the account closing, unless the law requires us to keep it.
• Google Calendar event details and anything derived from them: no more than 30 days. Tokens: until you disconnect.
• Transcripts from a meeting source you connect: not stored. The quote on a task stays with the task. Your Fireflies key: until you disconnect.
• Ask Zugaz and Draft with AI: questions, answers and drafts are not stored (a draft you add to a task stays with the task). A daily count of questions: 7 days.
• Technical logs, including error reports from the app: up to 90 days (error reports: 30 days).
• An address that bounced or complained: kept on our do-not-send list, even after the account is deleted, so we never email it again.
• Backups: deleted data drops out of our backups within a further 30 days.

Manage or delete your data

• Your work. Edit or delete any task, comment or note you own directly in Zugaz.
• Google Calendar. Disconnect in Settings, Calendar. We revoke access immediately and delete event data within 30 days.
• Emails. Change how often you get the morning email, or turn it off, in Settings, or use the link at the bottom of any email.
• See, correct or export. Most of your information is visible and editable in Zugaz. Download a copy of your data yourself in Settings, Account. For anything else, email privacy@zugaz.com; we respond within 30 days.
• Delete your account. Delete it yourself in Settings, Account, or email privacy@zugaz.com from your account's address and we will confirm within 5 business days and delete within 30 days. Shared work your organisation keeps (tasks you created on shared boards) stays with your organisation; Settings shows what that covers before you confirm.

Complaints

If you think we have mishandled your personal information, write to privacy@zugaz.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Children

Zugaz is a workplace tool and is not intended for anyone under 18.

Changes to this policy

If we change this policy, we will tell you by email or in the app at least 30 days before the change takes effect (or as soon as practicable for changes that only fix errors or reflect new law), and update the date at the top. If a change would allow a new use of Google user data, we will ask for your consent first.