Privacy notice

A short, plain-language summary of what this service stores and why. Operators of a Retroboard instance should adapt it to their organisation and jurisdiction.

Accounts

• Email address, display name and a salted password hash (never the password itself).
• Session records (a hash of the session cookie and its expiry) so you stay signed in.
• Single-use tokens for email verification and password reset, stored as hashes and expiring quickly.

Joining without an account

Guests are not anonymous to the service. When you join without an account, your browser receives a random, HTTP-only cookie that identifies it as the same guest when you come back. We store a hash of that cookie, the display name you chose, and when you joined and were last seen. Anyone with access to the server and its logs can see technical metadata such as IP addresses in web-server logs.

If the facilitator hides author names, other participants (including the facilitator) do not see who wrote a card in the app — but the association is still stored so you can edit your own cards.

Board content

Room titles, columns, cards and votes are stored until the room owner deletes the room or their account. There is no automatic expiry in this version. Exports are generated on request and are not stored.

Technical data

• Server logs record request method, path, status and timing — not passwords, cookies or card text.
• Room links carry their access code after a #, which browsers never send to servers, so it does not appear in logs.
• Online presence is kept in memory only while you are connected.

Your choices

• Room owners can delete a room, which permanently removes its cards, votes and participant records.
• Owners can replace a room link at any time to stop new people joining with the old one.
• Clearing your browser cookies ends your guest identity; you can join again as a new guest.