1. DATA PRACTICES FOUND

Based on the code audit, these are the actual data practices currently implemented.

Account and profile data

• The app collects email and password for standard registration/login.
• The app also supports optional first name and last name.
• The backend stores user profile fields including:
  • email
  • firstName
  • lastName
  • authProvider (local/google)
  • googleId (for Google-authenticated accounts)
• Passwords are hashed before storage.
• Password reset flow stores a hashed reset token and reset-token expiry timestamp.

Authentication/session data

• Backend issues JWT session tokens after successful login/register/Google auth.
• On device, auth token is stored in Expo SecureStore (with migration from older AsyncStorage token storage).
• App also stores a local user object in AsyncStorage for convenience (for UI/session bootstrap).

Google authentication data

• Google sign-in is implemented as an option (email/password auth is also available).
• The mobile app requests Google scopes: openid, profile, email.
• Backend verifies Google ID token and consumes Google claims such as:
  • email
  • email verification status
  • given_name/family_name
  • subject identifier (Google user ID)

Task and subtask data

• Backend stores user task data:
  • title, description
  • status, priority
  • due date/time
  • completion/status timestamps
• Backend stores subtasks (title/description/status/completion timestamps).