Privacy Policy

1. Information We Collect

Information you provide

• Identifiers: email address, display name
• Account credentials: hashed password (never stored in plaintext)
• User-generated content: board cards, comments, vote data, action items
• Preferences: UI and display settings
• Profile photo (optional) — uploaded by you, stored securely server-side, and deletable at any time from your Profile page

Bitbucket integration data (optional)

If you choose to connect a Bitbucket workspace, we additionally collect and store:

• Atlassian API token: encrypted at rest using AES-256 via the ASP.NET Core Data Protection API. The token is never returned to the browser and is only decrypted server-side during a sync you initiate.
• Atlassian account email & workspace slug: used as the Basic Auth username when calling the Bitbucket API.
• Repository slugs: the repository identifiers you configure for each team.
• Pull request records: PR title, author account ID, author display name/nickname, state (open/merged/declined), lines added, lines removed, and creation date — fetched from Bitbucket on demand when you click "Sync Now".
• Bitbucket nickname mappings: the mapping you create between your AgileDeck team members and their Bitbucket usernames.

Information collected automatically

• Internet / network activity: IP address, browser user-agent (retained for security logging only)
• Usage data: aggregated page views and feature interactions collected to understand product usage and improve the Service
• Cookies & local storage: session tokens, CSRF tokens, preference data (see Section 8)
• Approximate visitor country: for public landing-page analytics, a visit is recorded only after you have stayed on the landing page for more than 5 seconds. Your browser derives an approximate country from your device's timezone setting and sends us only that country code — we do not inspect, use, or store your IP address for this feature. We store only aggregated country/day visit counts for the public heatmap, never any per-visitor identifiers.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate you and keep your account secure
• Send transactional emails (account verification, password reset)
• Respond to support requests
• Comply with legal obligations
• Power optional AI-assisted features (card rephrasing, retro insights, and team analytics summaries) using self-hosted infrastructure we control

3. Sharing Your Information

We do not sell your personal data. We do not share your personal data for cross-context behavioral advertising or targeted advertising. We may disclose information to the following categories of recipients:

• Cloud infrastructure & hosting providers — to store and serve the Service on our behalf under data processing agreements.
• Atlassian / Bitbucket API — when you initiate a sync, we send outbound requests to the Bitbucket REST API (api.bitbucket.org) authenticated with the credentials you provided. We do not share your personal data with Atlassian beyond what is inherent in those API requests (your API token and workspace identifiers). Atlassian's privacy policy governs their handling of those requests.
• Transactional email providers — solely to deliver account verification and password-reset emails you have requested.
• Error monitoring & analytics providers — third-party analytics and error-monitoring services may receive aggregated usage data such as page views, device/browser details, approximate location, and referrer information when analytics is enabled.
• Law enforcement / government authorities — when required by applicable law, valid legal process, or to protect the safety of users.
• Successor entities — in the event of a merger, acquisition, or asset sale; you will be notified before your data is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.

5. Security

We implement industry-standard security measures including TLS encryption in transit, hashed password storage, CSRF protection, and regular security audits. Atlassian API tokens stored as part of the Bitbucket integration are encrypted at rest using AES-256 (ASP.NET Core Data Protection) and are never exposed to the browser or included in API responses. For more details, see our Security Policy.

6. Your Privacy Rights

Depending on your state of residence, you may have the right to:

• Know / Access — request a copy of the personal data we hold about you and information about how we use it.
• Correct — request correction of inaccurate personal data.
• Delete — request deletion of your personal data, subject to certain legal exceptions.
• Portability — receive your data in a structured, machine-readable format.
• Opt out of sale or sharing — we do not sell or share personal data, but you may request confirmation at any time.
• Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.
• Remove your profile photo at any time from your Profile page

To submit a verifiable request, email support@agiledeck.org with the subject line "Privacy Request". We will respond within 45 days; where permitted by law we may extend by an additional 45 days with notice. We do not charge a fee for one request per 12-month period.

7. California & US State Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA provides you additional rights described in Section 6 above. In the preceding 12 months, we have collected the following <strong>categories</strong> of personal information:

• Identifiers (email address, IP address)
• Account credentials (hashed password)
• Internet or electronic network activity (usage events, user-agent)
• User-generated content (board data, comments)
• Third-party integration credentials (Atlassian API token — encrypted; Atlassian email; workspace identifiers) — only if you opt in to the Bitbucket integration
• Third-party sourced data (pull request records from Bitbucket) — only if you opt in to the Bitbucket integration

We have not sold any of these categories to third parties. We have not shared any of these categories for cross-context behavioral advertising.

Residents of Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws have equivalent rights described in Section 6. To exercise any right, contact support@agiledeck.org.

8. Cookies

We use cookies to operate the Service and improve your experience. For a full breakdown, see our Cookie Policy.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before they take effect.

11. Contact

For privacy requests or questions about this policy:

• Email: support@agiledeck.org (subject: "Privacy Request")

You may also use our contact page. We respond to all verifiable privacy requests within 45 days.