1. What we store
Account: your email address, a hashed password, and the name and role you choose to show teammates. Your work: organizations, projects, tasks, comments, attachments, project documents, sprints, favourites, and the activity journal (who changed what, when) that powers notifications. Billing: whether your account holds a Pro subscription, which plan, and when it renews. We never see or store card numbers; RevenueCat and its payment providers, or Apple, handle payment details. Notifications: if you switch on push notifications, the push endpoint your browser or phone gives us, so we can send them.
2. What we do not do
No advertising, no advertising identifiers, no third-party analytics scripts, no selling or renting data, no profiling. The only cookies and local storage we use keep you signed in and remember preferences such as your theme.
3. Where it lives and who processes it
Data is stored with Supabase (database, authentication and file storage, hosted in the United States, us-east-1). The web app is served by Vercel. Subscriptions are managed by RevenueCat; on the web, checkout runs through RevenueCat’s payment provider, and in the iPhone app purchases go through Apple. Each of these processes data only to provide its part of the service, under its own privacy terms. We share nothing else with anyone unless the law requires it.
4. Who can see your boards
Only you and the people you invite: members of an organization see its projects, and project members see that project. Access rules are enforced in the database itself, not just in the app.
5. How long we keep it
For as long as your account exists. Deleting a task or project removes it; the activity journal keeps a short text record (the task’s title and what changed) so teammates’ history still reads correctly. Deleting your account removes your profile, your personal projects, organizations you created and everything in them, your subscription record, and your push subscriptions. Backups roll over within 30 days.
6. Your choices and rights
You can edit your profile, export your boards, switch notifications off, cancel a subscription, and delete your account from inside the app, without asking us. If you are in the EU, UK or another place with data-protection rights, you can also ask us to access, correct, port or erase your data, or object to how we use it; write to the address below and we will answer within 30 days.
7. Children
NeonBoard is not directed at children under 16 and we do not knowingly collect their data.
8. Security
Connections are encrypted, passwords are hashed, row-level security policies in the database decide who can read what, and secrets are kept in a vault rather than in code. If we ever learn of a breach that affects you, we will tell you promptly.
9. Changes
We update the date at the top when this policy changes and tell you in the app or by email about anything material.