Privacy Policy

1. Information we collect

• Account data — email, name, and avatar you provide.
• Organization data — organizations, memberships, roles, and content you create.
• Technical data — IP address, browser/user agent, and session metadata used for security and audit logging.

2. How we use information

To provide and secure the Service: authenticating you, enforcing organization access, maintaining an audit log of security events, and preventing abuse.

3. Cookies

We use strictly necessary cookies to keep you signed in (Supabase auth session cookies). These are essential and cannot be disabled while using the Service. We do not set analytics or advertising cookies unless you accept optional cookies in the consent banner.

We use Google Analytics to understand how the site is used. It runs in Google’s Consent Mode: until you accept optional cookies it sets no cookies and sends only cookieless, aggregated signals. Accepting allows it to set its analytics cookies; rejecting keeps it cookieless.

4. Service providers

• Supabase — database, authentication, and storage, as a data processor on our behalf.
• Google Analytics (Google LLC): website usage measurement, as described in section 3; subject to Google’s privacy policy.
• hCaptcha — bot protection on auth forms (when enabled); subject to hCaptcha’s privacy policy.

5. Your rights

You can access and update your data, export a copy, and permanently delete your account at any time from your profile settings. Depending on your region (e.g. GDPR/CCPA), you may have additional rights; contact us to exercise them.

6. Data retention & security

We retain data for as long as your account is active. Tenant data is isolated at the database layer with row-level security. When you delete your account, your personal data and any organizations you solely own are removed.

7. Changes & contact

We may update this policy; material changes will be communicated through the Service. Questions: [privacy@example.com], [Company], [address].