Privacy

Who holds your data

Brassdeck is operated by ScaleWise VA LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. The company is responsible for the information described below, and is who to write to about any of it, at hello@brassdeck.com.

What is stored about you

• Your account. Your name, your email address, and a hash of your password rather than the password itself. If you sign in with Google, Brassdeck also receives the Google account identifier associated with your account, your Google account email address, and your profile picture URL.
• What you write. The content you create in the app, including your cards, their steps, the stage assigned to each card, and reasons you provide when parking or dropping something.
• Change history. Which card changed, the type of change, and when it occurred.
• Preferences. Your theme, pointer settings, zoom direction, avatar image and the last place your canvas was.
• IP addresses. Used in limited circumstances, including protecting against repeated failed sign-in attempts and processing account registration requests.
• Sessions. Signing in creates a session token for your browser session. Signing out, including "sign out everywhere", invalidates the relevant tokens.
• Analytics. Cloudflare Web Analytics, to measure page views and basic usage. No advertising identifiers, no tracking pixels in email, and personal information is never sold or shared for marketing.

People you share with

A sharing link provides access only to the content you choose to make available through that link. People using an editing link may be asked for a name and colour so changes can be identified in the shared workspace; the name is not independently verified.

People opening a sharing link do not receive an account and cannot reach anything outside the content that link covers. Reasons you gave for parking or dropping something, and dropped cards, are excluded from shared views unless you deliberately turn them on. You can revoke a link at any time, and once revoked it can no longer be used.

Third-party services

• Cloudflare. Hosting, the database your cards live in, session storage, the analytics that counts page views, and the routing that carries mail sent to us. It terminates the encrypted connection, so everything reaching Brassdeck passes through it.
• Resend. Delivers service email: sign-up confirmations, password resets, invitations and other messages you ask for. It receives the address and the message content needed to deliver them.
• Google. If you choose to sign in with Google, Brassdeck receives what is needed to authenticate you. It does not reach your Gmail, Drive, contacts or any unrelated account content.
• OpenRouter, and the model provider behind it. When you use the assistant, what you type is sent to OpenRouter, which passes it to the company running the model. So is whatever the assistant reads to answer you: because it works by looking things up on your board, that can include card names, the steps written on them, stages and dates. The model in use is DeepSeek V4 Flash. OpenRouter chooses which provider serves it and may use a different one between messages, so the company handling it is not fixed.
• If you never open the assistant, none of that happens. No card, step or note is sent to any AI service unless you ask it something, and the connector below is the other direction entirely: your own Claude or ChatGPT reaching in, on your instruction. Brassdeck does not train models on your content and does not sell it.
• Public lookups. Writing a domain, a YouTube link or a GitHub link as a step sends that address to the matching service so it can be looked up: YouTube and Google APIs, GitHub, and the domain registries listed by IANA. Only the address is sent, never the rest of the card.
• Payments: Polar. Subscriptions are sold by Polar Software Inc. (polar.sh) as the merchant of record. When you subscribe you give Polar your card and billing address, and Polar handles the charge, the tax and the receipt. What Brassdeck receives back is your workspace's id, the plan, its status and its dates, and the email you paid with. Brassdeck never sees or stores card details.

How long it is kept, and getting rid of it

Your cards and workspace information are kept until you delete them or ask for your account and its contents to be deleted. Deleting a card from the app hides it and keeps the row so it can be put back, which is deliberate: this app's whole position is that a decision you made is worth keeping. Ask at the address below and everything, including those rows, is removed permanently.

Some information may be held for a limited period where it is needed for backups, security, legal or other legitimate operational reasons.

Access requests

You can ask for a copy of the personal information held about your account. You may be asked to verify your identity before an access or deletion request is completed.

Contact

Privacy questions, data-access requests and deletion requests go to hello@brassdeck.com.