⚠ TEMPLATE — NOT LEGAL ADVICE. A drafting skeleton to be completed and reviewed by
qualified privacy counsel (GDPR/CCPA as applicable) before publishing. Replace every
[bracketed] placeholder and delete this banner.
Privacy Policy
Last updated: [DATE] · Controller: [COMPANY, address] ·
DPO/contact: [privacy@…]
What we collect
- Account: email, name you provide, authentication timestamps. Passwords are handled by our auth
provider (GoTrue) and stored only as salted hashes.
- Content: the boards, comments, and sharing settings you create.
- Operational: minimal server logs for security and reliability. [State exactly what
logs contain and retention — the deployment is configured to exclude tokens, PII, and board content from logs.]
- Billing (paid plans only): the billing contact, address, VAT / tax id and invoices. Card details are
collected and held by Stripe, never by us.
- Usage counts and crash reports — only with your consent: daily feature counts with no identifier, and
the first line of an error. See the Cookie Policy.
- Support messages you send from the app, and an email address to answer.
- Invite codes: who invited whom, to grant the referral credits.
How we use it & legal bases
To provide the service, secure it, and communicate about your account. [Map each purpose to a
GDPR art. 6 legal basis; state whether any processing relies on consent and how to withdraw it. No advertising
or third-party sale is performed unless you add it here.]
Sharing & sub-processors
The service is self-hosted on infrastructure we control. Sub-processors: [list — e.g. email/SMTP
provider, object storage, hosting — with locations and DPAs]. We do not sell personal data.
Your rights
- Access / portability (art. 15/20): “Download my data” exports everything we hold about you as a JSON
file (served by
export_my_data).
- Erasure (art. 17): you can request deletion of your account; we remove your identity and content and
anonymise authorship on retained shared comments, except where a legal hold applies. [State the
retention/hold policy and the completion SLA.]
- Rectification, objection, restriction: [describe how to exercise these].
Security, retention, transfers, breach
[State encryption in transit/at rest, backup retention, data location and any international
transfer mechanism, and your breach-notification commitment (GDPR 72h). These must reflect your actual
deployment and be reviewed by counsel.]
Contact
Privacy questions or requests: [privacy@…]. Supervisory authority: [relevant DPA].