Privacy

What is stored about you

• Your account. Your name, your email address, and a hash of your password, never the password itself. If you sign in with Google, also Google's account identifier for you, the email address on that account, and the URL of your profile picture.
• What you write. Your projects, their steps, the stage you put each one in, and the reason you gave when you parked or dropped something. This is the app; it is why you are here.
• A history of changes. Which project changed, what kind of change it was, and when, so the app can tell you how long something has really been sitting.
• Your preferences. Theme, pointer, zoom direction, the picture on your avatar, and where you last left the canvas.
• Your IP address, in two narrow places: against failed sign-in attempts, so a stranger cannot guess at your password indefinitely, and against a sign-up request. It is attached to the attempt, not to your account.
• Sessions. A random token identifying the browser you signed in from. Signing out deletes it, and so does "sign out everywhere".

Cloudflare Web Analytics is switched on at the edge and counts page views. It sets no cookie and builds no profile of you, and it is the only measurement anywhere in this app. There are no advertising identifiers, no tracking pixels in the emails, and nothing is ever sold or shared for marketing.

People you share with

A share link shows what you chose to put behind it and nothing else. Someone opening an editing link is asked for a name and a colour so you can see who changed what; that name is whatever they typed and is never verified. Guests get no account and no access to anything outside the link.

Two things are held back from every link unless you deliberately turn them on: the reasons you gave for parking or dropping something, and projects you dropped. They are the most personal things in this app and they do not travel by default.

A link can be revoked at any time, and revoking is permanent. Only a hash of the link is stored, so nobody, including whoever runs this app, can read a live link back out of the database.

Other companies involved

• Cloudflare runs the app, the database and the session store, and its Web Analytics counts page views. Everything above lives there.
• Resend delivers email, sign-up confirmations, password resets, invites and anything you asked to be told about. It sees the address and the message.
• Google, only if you choose to sign in with Google. The app asks for your name, email address and profile picture, and nothing else. It cannot read your Gmail, your Drive or your contacts.
• An AI provider, only when you use the assistant. The text of that conversation and the projects it needs to answer are sent to the model that runs it. If you never open the assistant, nothing is ever sent.
• Public lookups. If a step you write is a domain, a YouTube link or a GitHub link, the app asks that service about it so it can tell you whether the domain is free or whether the video moved. Only the address you wrote is sent.

The operator

One account runs this service, and it can open any workspace on it, including yours, and read what is on the board. That is how a spam workspace gets stopped and how a broken account gets looked at, and you should know it is possible rather than assume it is not.

Two things bound it. Every time a workspace is opened that way it is written to an audit log with the operator's address, what was looked at and when; there is no route in this app that deletes from that log. And the operator can only read: there is no way to sign in as you, and nothing the operator does can appear in your history as though you did it.

Ask at the address below and you will be told whether your workspace has ever been opened this way, and when.

How long it is kept, and getting rid of it

Your projects are kept until you delete them. Deleting a project hides it and keeps the row, so it can be put back, that is deliberate, because this app's whole position is that a decision you made is worth keeping. Ask at the address below and everything, including those rows, is removed permanently.

Ask at the same address for a copy of what is held about you. Sign-in attempt records expire on their own.

Contact

brassdeck@scalewiseva.com. A person reads it.

If this page and the app ever disagree, the app is the bug. Say so at that address.