Privacy Policy

Last updated: 2026-08-28.

This page explains what data Markboard collects, why, and how it's used. This instance is self-hosted — your data lives in a database the operator runs directly, not a third-party cloud data platform.

What we collect

• Account info: your email address, and optionally a display name, bio, and profile picture.
• Sign-in credentials:if you use a password, it's stored as a salted bcrypt hash, never in plain text. If you sign in with Google, GitHub or Microsoft instead, we store the link to that account, not your password on that service.
• Content you create: workspaces, boards, cards, card descriptions, comments, checklists, labels, dates, and any files you attach.
• Activity data: a log of who changed what on a board, for collaboration and audit purposes.
• API keys and connected apps: if you create an API key or connect an AI assistant, we store only a one-way hash of the credential — the raw value is never stored in reversible form — along with which app it is, what you allowed it to reach, and when it was last used.

The demo board

The demo boardneeds no account and creates none. It runs entirely in your browser: the cards you add, move and edit there are held in your browser's storage for that tab and are never sent to us, so nothing you do in the demo reaches the server or survives closing it.

AI assistants and connected apps

Markboard can be connected to an AI assistant (such as Claude or ChatGPT) so it can work with your boards on your behalf. Two things are worth being explicit about:

• A connection acts as you, and no wider. When you connect an assistant you choose what it can reach — all your workspaces read-only, or a single workspace or board, optionally with write access. It can never see a board you cannot see, and it can never delete a board, workspace or account.
• What leaves Markboard is what the assistant asks for. When the assistant reads a card, that card's content — title, description, comments, checklists and any text attachment it opens — is sent to whoever operates that assistant, and is handled under their privacy policy, not this one. Nothing is sent to them unless a tool is called.

You can see every connected app, and disconnect any of them immediately, under Settings → Connected apps. Disconnecting takes effect at once — it does not wait for a token to expire. API keys are listed under Settings → API keys and can be revoked the same way.

Cookies and browser storage

Every cookie here is strictly necessary, and there are no advertising or analytics cookies: one keeps you signed in, two more protect the sign-in form against cross-site request forgery and remember where to return you afterwards, and connecting a board to Slack or Discord sets a short-lived one that lasts only for that authorization.

Display preferences — your theme, light or dark, board filters, per-column grouping, and whether you have dismissed the notice offering this site in another language — are kept in your browser's own storage and are never sent to us. That is also why they do not follow you to a different browser or device.

Third parties

The following services are used only where the operator has configured them:

• Google, GitHub or Microsoft — only if you choose to sign in with one of them instead of a password.
• Resend — sends invite, email-verification and password-reset emails.
• Oracle Cloud Infrastructure — hosts the server, and (where the operator has enabled it) stores file attachments and the encrypted nightly database backups.
• Slack or Discord— only for a board where a workspace admin has added an outgoing webhook. In that case the board's activity — who changed which card, and card titles — is sent to the channel they chose. Card descriptions, attachments and email addresses are never included.
• Sentry — receives details of unexpected errors, to help fix bugs. Not used for tracking or advertising.

We don't sell your data, and there are no ads on this service.

Data retention and deletion

Your data is kept for as long as your account exists. You can delete your account yourself at any time from Settings → Security.

Deleting is immediate but not instant-forever: your account is hidden straight away — you are signed out everywhere, your API keys and connected apps are disconnected, and your name, handle and picture stop appearing anywhere in the app — and then permanently deleted after 30 days. During those 30 days you can restore it, using the link we email you or by signing in again. We email you when deletion starts, three days before the deadline, and once it is complete.

What is permanently deleted at the end of that period:

• Your profile, password, API keys, connected apps and notifications.
• Any workspace that only you belonged to, including every board, card and uploaded file in it.

What is kept: comments, cards and files you added to other people'sworkspaces. Those are that workspace's record rather than yours to remove, so they stay where they are — but your name is taken off them and they are no longer linked to you or to any identifier of yours. If you are the only owner of a shared workspace, ownership passes to another member so that the people still using it do not lose access.

One limit worth stating plainly: encrypted backups of the database are retained for up to a year for disaster recovery, so a copy of deleted data may remain in those backups until they age out. Backups are not used to restore individual accounts, and the backup store is configured so that it cannot be selectively edited.

If you cannot reach your account — you have lost access to your email address, for example — write to us at support@markboard.work and we will delete it for you.

Security

Passwords are hashed with bcrypt; sign-in and every action that changes data are rate-limited against abuse; every request runs over HTTPS in production.

Changes to this policy

This policy may be updated as the service changes. Material changes will be reflected here with an updated date.

Contact

Questions about this policy, or a data request? Email us at support@markboard.work.