Privacy

What is stored

• Your account: an account name and the name you use in each workspace you belong to, your email address, a bcrypt hash of your password (never the password), when the account was created and when the address was confirmed, and the avatar image if you uploaded one (stored as a 128 pixel copy; the original is not kept).
• What you write: the threads you start and the messages you post, with their timestamps, in the workspaces you belong to.
• Where you belong: your workspace and channel memberships and your role in each workspace.
• Read state: when you last opened each thread, used to show unread markers and, to the other members of a thread, that you have seen its latest message. Typing indicators are sent to the people in the same thread as you type and are never stored.
• Invitations: when you invite someone, their address is stored until the invitation is accepted, expires after 7 days, or is revoked. The link itself is never stored; only a hash of it is.
• Devices: the notification token your device gets from Apple or Google, stored with the platform it came from while you are signed in to the iOS or Android app so a message can reach you. It is deleted when you log out of the app, and when Apple or Google reports the token as gone.
• Logs: request logs hold the path, status and timing of requests and never the query string, message contents, addresses or the secret part of any link. They are kept for a short time on the server for troubleshooting.
• Script errors: in the iOS and Android app only, when a script on a page fails, the error message, the file and line it came from and your device's user-agent string are written to the same request log. It is how the app is debugged without a cable attached. Nothing you wrote is included, and it is kept for as short a time as the rest of the log.

Where

On hardware we own and operate in Sweden. The database is backed up nightly, encrypted, to object storage at Cloudflare; backups are kept for 30 days and are the only copy that leaves our hardware.

Cookies and third parties

Two cookies, both strictly necessary: your session, and a token that protects forms against cross-site requests. No analytics, no advertising, no third-party scripts, fonts or images: every request your browser makes for this site goes to this site.

Emails (invitations and address confirmation) are sent through a transactional email provider, which sees the recipient address and the message.

Notifications go through Apple's push service on iOS and Google's (Firebase Cloud Messaging) on Android, which deliver them to your device: that service therefore sees the sender's name, the channel name and the first part of the message. Nothing is sent for a thread you are already looking at, and turning the app's notifications off in iOS or Android settings stops it entirely. The Android app contains no other Google service: no analytics, no advertising id, no third-party crash reporting — the script errors above go to our own log and nowhere else.

How long

Until you delete your account or the workspace is deleted, plus the 30-day backup window.

Your rights

• Export: download everything stored about your account as JSON from your profile.
• Delete: delete your account from your profile. Your account, memberships and read state are removed immediately. Messages you wrote stay in their threads, attributed to a deleted account, so the conversations other people took part in remain whole; ask a workspace owner if you need individual messages removed.
• Correct: your password can be changed on your profile; contact us to change a username or your address.

Contact

The operator is Scriptdrift Software Consulting AB, Sweden: johan@scriptdrift.se.