Your tasks live in tasks.json in a private GitHub repo. Make a fine-grained token that can only see that repo, with Contents: Read and write. It stays on this device.
tasks.json