Privacy

What is stored

• Your account: an account name and the name you use in each workspace you belong to, your email address, a bcrypt hash of your password (never the password), when the account was created and when the address was confirmed, your time zone and the hours you pause notifications, if you set them, and the avatar image if you uploaded one (stored as a 128 pixel copy; the original is not kept).
• What you write: the threads you start and the messages you post, with their timestamps, in the workspaces you belong to.
• Where you belong: your workspace and channel memberships and your role in each workspace.
• Read state: when you last opened each thread, used to show unread markers and, to the other members of a thread, that you have seen its latest message. Typing indicators are sent to the people in the same thread as you type and are never stored.
• Invitations: when you invite someone, their address is stored until the invitation is accepted, expires after 7 days, or is revoked. The link itself is never stored; only a hash of it is.
• Devices: the notification token your device gets from Apple or Google, stored with the platform it came from while you are signed in to the iOS or Android app so a message can reach you. It is deleted when you log out of the app, and when Apple or Google reports the token as gone.
• Billing: when a workspace was started on this site, its plan, the status of its subscription, when the trial or the paid period ends, and the references Stripe uses for the customer and the subscription. Card details and the billing address are held by Stripe, not by us.
• Trials: so that each company gets one trial, the domain of the owner's email address (the whole address, if it is at a webmail provider such as Gmail) and the company's VAT number, kept after the workspace is gone. Ask us and we delete them.
• Logs: request logs hold the path, status and timing of requests and never the query string, message contents, addresses or the secret part of any link. They are kept for a short time on the server for troubleshooting.
• Script errors: in the iOS and Android app only, when a script on a page fails, the error message, the file and line it came from and your device's user-agent string are written to the same request log. It is how the app is debugged without a cable attached. Nothing you wrote is included, and it is kept for as short a time as the rest of the log.

Where

On a server in the EU that we run ourselves. The database is backed up nightly, encrypted, to object storage at Cloudflare; backups are kept for 30 days and are the only copy kept anywhere else.

Cookies and third parties

Your session and a token that protects forms against cross-site requests, both strictly necessary. Two more remember settings: your time zone, which your browser reports so times are shown and notifications paused in your local time, and your colour scheme, if you choose one. No analytics, no advertising, no third-party scripts, fonts or images: every request your browser makes for this site goes to this site.

Emails (invitations and address confirmation) are sent through a transactional email provider, which sees the recipient address and the message.

Payments go through Stripe. A company that starts a workspace here enters its billing details on Stripe's own page, so Stripe receives the owner's email address, the company name and billing address, the VAT number and, once one is added, the card, and handles them under its own privacy policy. Stripe also sends the invoices and receipts.

Notifications go through Apple's push service on iOS and Google's (Firebase Cloud Messaging) on Android, which deliver them to your device: that service therefore sees the sender's name, the channel name and the first part of the message. Nothing is sent for a thread you are already looking at, and turning the app's notifications off in iOS or Android settings stops it entirely. The Android app contains no other Google service: no analytics, no advertising id, no third-party crash reporting — the script errors above go to our own log and nowhere else.

How long

Until you delete your account or the workspace is deleted, plus the 30-day backup window. A workspace whose subscription has ended is read-only for 30 days, its owners are warned a week ahead, and then it is deleted with everything in it, together with the account of anyone who belonged to no other workspace.

Your rights

• Export: download everything stored about your account as JSON from your profile.
• Delete: delete your account from your profile. Your account, memberships and read state are removed immediately. Messages you wrote stay in their threads, attributed to a deleted account, so the conversations other people took part in remain whole; ask a workspace owner if you need individual messages removed.
• Correct: your password can be changed on your profile; contact us to change a username or your address.

Contact

The operator is Scriptdrift Software Consulting AB, Sweden: johan@scriptdrift.se.