Privacy policy

This policy explains what personal data Retroloop (“we”, “us”) collects when you use the service at www.retroloop.app, why we collect it, and the choices and rights you have. We collect only what we need to run retrospective boards. We don't sell your data, show ads or use analytics or tracking tools.

Who is responsible

Retroloop is the data controller for the personal data described here. For any privacy question or request, email contact@retroloop.app.

What we collect

Your account

• Your name and email address.
• Your password, stored only as a one-way hash. We can't read it. Accounts created with Google have no password.
• A random code that picks your avatar. It isn't derived from your name or email.

Sign in with Google

If you continue with Google, Google shares your account ID, name and email address with us. We use them to create your account or sign you in. We don't receive your Google password or access to anything else in your Google account.

What you put on boards

• Board names and settings, the cards you write, the GIFs you attach, and your votes.
• Which boards you belong to, whether you host them, and when you last opened each one.

Board names, card text and attached GIFs are stored encrypted (see Security). Everything on a board is visible to the board's members. A board's link is its invite: anyone who opens it, including chat apps like Slack or WhatsApp building a link preview, sees the board's name and its host's first name and avatar, but none of its cards. Cards are blurred on other members' screens until the host reveals them, but their text is still sent to those members' browsers, so don't treat the blur as a way to keep something confidential.

Sign-in sessions and technical data

• For each device you're signed in on: the IP address and browser details (user agent) used to sign in, and when. You can see these sessions in your account settings and sign out of all other devices.
• Our server logs record requests, including IP addresses, to keep the service running and secure.

Emails and messages

If you ask to reset your password, we send an email to your address. If you email us, we keep the conversation so we can answer.

Why we use it, and our legal basis

• To provide Retroloop (your account, sign-in, boards, cards, votes and live updates): performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep the service secure and working (sessions, logs, rate limits, preventing abuse): our legitimate interest in running a safe, reliable service (Art. 6(1)(f)).
• To answer your messages and requests: performance of our contract, or our legitimate interest in helping you (Art. 6(1)(b) and (f)).
• To meet legal obligations, where they apply (Art. 6(1)(c)).

Cookies and local storage

We use only what's strictly needed for the service to work, so we don't ask for cookie consent:

• A cookie that keeps you signed in on this device.
• A session cookie for temporary data, such as the security token that protects forms against forged requests.
• Your light or dark theme choice, saved in your browser's local storage. It never leaves your device.

We don't use analytics, advertising or third-party tracking cookies.

Who else receives data

We share personal data only with the services we need to run Retroloop:

• Hetzner Online GmbH, our hosting provider. The app and its database run on a Hetzner server in Helsinki, Finland, inside the EU.
• Our email provider, to deliver password reset emails.
• Google, only if you choose to sign in with Google. Google's own privacy policy applies to your Google account.
• DiceBear (api.dicebear.com) draws avatars. Your browser loads each avatar from DiceBear, which receives your IP address and the random avatar code, but not your name, email or the board you're viewing.
• GIPHY, if you use GIF search. Your search terms are sent to GIPHY from our server, without your identity. GIF images load from GIPHY in your browser, which gives GIPHY your IP address, but not the board you're viewing.

We may also disclose data when the law requires it. Our own servers are in the EU, but Google, GIPHY and DiceBear may process data outside the European Economic Area. Where that happens, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework, or on the European Commission's standard contractual clauses.

How long we keep it

• Account and board content: until you delete it or delete your account.
• Sign-in sessions: until you sign out or end the session, or your account is deleted.
• Server logs: for a limited time, then they're deleted or overwritten.
• Backups: deleted data can remain in backups until those backups are replaced.

When you delete your account, we delete your profile, sessions, Google connection, cards and votes. Boards you host pass to another member, or are deleted if nobody else is on them. Boards you joined stay with their other members.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected, which you can do for your name, email and password in your account settings;
• have your data erased, which you can do yourself by deleting your account;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format.

To use any of these rights, email contact@retroloop.app. We'll reply within one month. You also have the right to complain to a data protection authority: in Portugal, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority in the EU country where you live or work.

Security

Connections to Retroloop are encrypted with HTTPS, and passwords are stored only as hashes.

Board names, card text and attached GIFs are encrypted in the database with AES-256-GCM. The encryption keys are kept outside the database, so someone who obtained only a copy of the database couldn't read them. Your name, email address and sign-in details are not encrypted this way, because we need them to find your account when you sign in.

Live updates travel through a message queue that holds the rendered cards for about a minute before they're deleted. Deleted data is overwritten in the database files rather than left behind.

No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

Children

Retroloop is meant for work teams and isn't intended for children under 16. We don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change significantly affects how we use your data, we'll let you know before it takes effect.

Contact

Questions about this policy or your data: contact@retroloop.app.