Privacy Policy

1. Who we are

This service is provided by KanoBoard. If you have questions about your data or want to use your privacy rights, reach us through our contact form.

2. Information we collect

Account information. Your name, email address, and a hashed password. You may also add an optional avatar. We do not offer third-party sign-in.

Workspace content. The workspaces, boards, columns, cards, comments, checklists, card files, assignments, activity, and notifications you and your collaborators create. Card files can be opened only by people who can see that card. We store this content so the Service can function.

Subscription information. If you buy a paid plan, we store subscription identifiers, plan, status, and renewal dates. We do not store card numbers, card brand, or the last four digits.

Contact messages. If you write to us through the contact form, we store your name, email address, phone number, subject, and message so we can reply.

Usage and device information. If you accept analytics cookies, Google Analytics records the pages you open, the site that referred you, and general device information. Firebase Performance Monitoring records page load and network timing. Like most services, we may also keep basic server logs (such as IP address and request time) for security and troubleshooting.

3. How we use information

• To provide and secure the Service, including signing you in and showing workspace content to the right people.
• To send service emails, such as verification codes, password resets, and account or billing notices.
• To process payments and manage subscriptions.
• To respond to messages you send us.
• To understand how the Service is used and improve it, only if you consent to analytics.
• To prevent abuse, spam, and automated sign-ups.

We do not sell your personal data and we do not serve ads.

4. Cookies and local storage

Cookies are small files a website stores in your browser. Local storage is a similar browser feature that keeps settings on your device.

Essential (always on). kanban_access and kanban_refresh are httpOnly session cookies that keep you signed in. kanban_cookie_consent remembers your cookie choice. kanban_app_theme, stored in your browser's local storage, remembers your theme. Access and refresh tokens are not stored in local storage.

Analytics (only with your consent). Google Analytics and Firebase Performance Monitoring are loaded only if you accept analytics cookies. If you decline, they are not loaded. You can change your choice at any time from Cookie settings.

5. Third-party services

We use the following providers to run the Service. They process data on our behalf or under their own terms:

• LemonSqueezy — payments. It is the merchant of record and handles checkout, tax, invoices, and card details.
• Google Analytics — usage analytics, only with consent.
• Firebase Performance Monitoring — page load and network timing, only with consent.
• Google reCAPTCHA — protects sign-up, sign-in, password reset, and the contact form from automated abuse. Google receives the page address and device signals described in the Google Privacy Policy.
• Resend — sends transactional emails such as verification codes and password resets.
• Cloudflare — DNS, CDN, and security for kanoboard.com.
• DigitalOcean — hosts the application and database.

6. Sharing within workspaces

Members of a workspace or board can see the boards and cards shared with them, including the names of other members. Do not put secrets in cards you share.

7. International transfers

We and our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for these transfers.

8. Data retention

• Account and workspace data is kept while your account is active.
• When you delete your account, your data is erased from our live systems immediately. Copies in backups are removed when those backups are replaced.
• Contact form messages are kept only as long as needed to handle your request.
• Server logs are kept only as long as needed for security and troubleshooting.
• Billing records may be kept as long as required for tax and accounting purposes.

9. Your rights

Depending on where you live (for example under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time.

• Update your name and avatar in Settings.
• Delete your account in Settings after confirming your email and password. Deletion is permanent: workspaces you own, along with their boards and cards, are erased. Your membership in someone else's workspace is removed, and that workspace stays.
• For anything else, including a data export request, use our contact form. We aim to respond within 30 days.

10. Security

Passwords are hashed, session cookies are httpOnly, and data is encrypted in transit using HTTPS. No system is perfectly secure, so we cannot guarantee absolute security.

11. Children

The Service is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has given us personal data, contact us through our contact form and we will delete it.

12. Changes

If we make material changes to this policy, we will notify you by email or in the app before they take effect. The date at the top shows the latest revision.