Privacy policy

This is template text, not legal advice. It describes what the software in this repository actually does with personal data, which is a useful starting point — but a privacy policy is a legal document about your product, your jurisdiction and your processors. Have a lawyer write or review the version you publish, and replace this file entirely.

What this describes

This page explains what data the product collects, why, and how long it is kept. It covers the software itself, not any third-party service you decide to connect to it.

Data we collect

Account data. Your email address, your name if you give one, your chosen language, and a hash of your password. The password itself is never stored and cannot be recovered from the hash — a forgotten password is reset, not retrieved.

Organization data. The organizations you belong to, your role in each, and who invited you.

Security data. The times and approximate origins of your sign-ins, active sessions and the devices they were started on, and an audit record of actions that change access — invitations, role changes, deletions.

Operational data. Server logs containing request identifiers, timing and error information. These are retained for a limited period and are used to diagnose faults.

What we do not do

The product does not sell personal data, does not use it to train models, and does not include third-party advertising or tracking scripts. Any analytics that a deployment enables is disclosed on this page and asks for consent before it stores anything on your device.

How long data is kept

Account and organization data are kept while the account exists. When an account is deleted, the personal data associated with it is removed, and records that must be retained for accounting or security reasons are stripped of identifying detail rather than kept intact.

Your rights

You can export your data, correct it, or delete your account from within the product. Where the law gives you additional rights — objection, restriction, portability, or a complaint to a supervisory authority — those apply too, and the contact address below is where to start.

Sub-processors

A deployment of this software typically involves a hosting provider, a transactional email provider, a payment processor and an object store. Whichever ones you use must be listed here by name, with the categories of data each one handles.

Contact

Questions about this policy go to the support address in the footer of this page.