Privacy policy

This policy explains what Momentum Life, an Obsidian plugin, does with your data when you enable its optional Google Tasks sync. It describes the behaviour of the plugin as published, and it is updated in the same release as any change to that behaviour.

Where your data lives

Momentum Life is a local plugin. Every task, habit, workout, meal and note it manages is stored as a plain Markdown file inside your own Obsidian vault, on your own device.

The task data the plugin reads from Google Tasks is written only to Markdown files inside your local Obsidian vault. There is no account to create, no database owned by the author, and no copy of your tasks held anywhere else.

Who talks to Google

All Google Tasks API requests are made from your own device, directly to tasks.googleapis.com. Your task content does not pass through any server operated by the author, and the author has no server that stores it.

The OAuth broker

Signing in to Google requires a confidential client secret that must not be shipped inside a public plugin. For that reason, and only for that reason, the sign-in step passes through a small service operated by the author, called the OAuth broker.

The broker takes part exclusively in the OAuth handshake: it exchanges the authorization code Google returns for access tokens, and it renews an expired access token. It does not receive, does not process and does not store the content of your tasks. Task data never touches it.

The broker is stateless. It does not persist tokens, authorization codes or user identifiers. It keeps no database, no log of your identity and no record of your requests' contents.

Tokens

When you connect your Google account, Google issues an access token and a refresh token. Both are stored only in the plugin's local configuration file (data.json, inside your vault's plugin folder) on your own device.

They stay there until you disconnect Google in the plugin or delete that file. They are not retained in any system controlled by the author.

Data we read and write

When the sync runs, the plugin reads and writes exactly the following fields of your Google Tasks data, and nothing more:

Task title — mirrored to and from the note title.
Task notes — mirrored to and from the note body.
Due date — mirrored to and from the note's due date.
Completion status — so completing a task on one side completes it on the other.
Task identifier — stored in the note so the same task is matched reliably after a rename.
Task list identifier — to keep each board paired with its list.

No other data in your Google Account is read or written. The plugin requests a single permission, covering Google Tasks only. It has no access to Gmail, Google Drive, Google Calendar, your contacts or your profile.

How the data is used

The data obtained through the Google Tasks permission is used solely to perform the synchronisation you asked for, on your own device.

It is not sold. It is not transferred to third parties. It is not used for advertising. It is not used to train artificial intelligence or machine learning models.

No telemetry

Momentum Life collects no telemetry and no analytics about your use of the sync or of the plugin. There is no usage tracking, no crash reporting service and no identifier assigned to you.

Revoking access

You can end the plugin's access to your Google account in two ways, and either one is enough:

In the plugin — open the Momentum Life settings and use the disconnect control. The tokens stored on your device are deleted and the plugin immediately stops making any request to the Google Tasks API. To also withdraw the permission you granted, use the second method below.
In your Google Account — open Third-party apps & services and remove access for Momentum Life. This revokes the permission at Google, so the stored tokens stop working.

In both cases, the task notes already in your vault are kept. Revoking access stops future synchronisation; it never deletes your notes.

Deleting your data

Tokens — disconnect Google in the plugin, or delete the plugin's data.json file. That removes the stored access and refresh tokens from your device.
Synchronised content — delete the task notes from your vault. Because the content lives only in your vault, deleting those files deletes the data.
On Google's side — tasks you no longer want in Google Tasks are deleted in Google Tasks itself, or in your Google Account.

There is nothing for the author to delete on your behalf, because the author holds no copy of your data.

Changes to this policy

This policy is versioned alongside the plugin's source code. If the plugin's behaviour around collecting, transmitting, storing or retaining your data changes, this page is updated in the same release as that change, and the date below changes with it.

Contact

Questions about this policy or about your data: jaime.nagase@gmail.com.

Last updated: 2026-08-15