Legal

Privacy Policy

Effective date: 23 May 2026  ·  Last updated: 23 May 2026

1. Who we are

RetroCanvas ("we", "us", "our") provides a collaborative retrospective board application for agile teams. For privacy inquiries, contact us at privacy@retrocanvas.app.

2. What data we collect

Account data. When you create an account you provide your name, email address, and a password. Your password is stored as a one-way bcrypt hash — we cannot recover it.

Board and card content. Any text you add to boards, columns, cards, or comments is stored and associated with your account.

Anonymous activity. If you use the app without creating an account, we store a randomly generated identifier (UUID) in your browser's local storage to remember your cards and votes within a session. This identifier is device-specific and is not linked to any personal information unless you later create an account.

Feedback submissions. If you use the in-app feedback widget, we collect your message, an optional emoji rating, an optional category, and optionally your name and email if you provide them. We also record your IP address for rate-limiting purposes.

Jira credentials. If you connect a Jira account, we store your Jira domain, email address, and API token so we can create issues on your behalf.

Session tokens. We store authentication tokens in your browser's local storage to keep you signed in. These expire and are invalidated on logout.

3. How we use your data

  • To provide and operate the RetroCanvas service
  • To send transactional emails (password reset) via our email provider, Resend
  • To respond to feedback you submit
  • To enforce rate limits and protect the service from abuse
  • To enable Jira integration features at your request

We do not sell your data, share it with advertisers, or use it to build advertising profiles.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), our legal basis for processing your personal data is:

  • Contract performance — processing necessary to provide the service you signed up for (account management, board content, authentication).
  • Legitimate interests — security, fraud prevention, and rate limiting (IP address in feedback submissions).
  • Consent — where you have explicitly provided information (e.g. name and email in the feedback widget).

5. Third-party services

Resend — We use Resend to send password reset emails. When a reset is requested, your email address is transmitted to Resend to deliver the message. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Fonts — DM Sans and Inter are self-hosted and served directly from RetroCanvas servers. No font requests are made to Google or any third party.

6. Data retention

We retain your account data for as long as your account is active. Feedback submissions, including IP addresses, are retained for up to 12 months.

If you delete your account (when this feature is available), your personal data and content will be permanently removed.

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access — request a copy of the data we hold about you.
  • Rectification — request correction of inaccurate data.
  • Erasure — request deletion of your data ("right to be forgotten").
  • Portability — request your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Restriction — request that we restrict processing while a dispute is resolved.

To exercise any of these rights, email privacy@retrocanvas.app. We will respond within 30 days.

8. Security

We protect your data using industry-standard practices: passwords are hashed with bcrypt, connections are encrypted in transit via HTTPS, and access to production systems is restricted to authorized personnel. No security measure is perfect — please use a strong, unique password and contact us immediately if you suspect unauthorized access to your account.

9. Children's privacy

RetroCanvas is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

11. Contact

For privacy-related questions or data requests, email privacy@retrocanvas.app.