Privacy Policy

Last updated 30 August 2026

This policy describes what Stackboard collects when you use it, why, and what happens to it. Stackboard is operated by [legal entity name], [registered address] ("we", "us").

What we collect

Your account. When you sign in through a provider — GitHub, GitLab, Bitbucket, or your organization's identity provider — we receive and store your email address, a display name, and a profile picture where the provider supplies one. You can change the name and picture, and set a timezone, from your own settings. We record the time of your most recent sign-in.

What you put in. The repositories you connect, the apps you register, the groups you create, and anything you write in their names, descriptions and settings.

Credentials you give us. Access tokens for connected git providers, and any environment variables you mark as secret, are stored encrypted at rest. Environment variables you mark as public are stored as written, because the browsers running your app receive them.

Proxy activity. Where an app calls an external API through Stackboard, we record the target, the path, the method and whether the call was allowed, so an owner can see what their app is asking for. Request and response bodies are not recorded.

A session cookie. One cookie, stackboard_session, which identifies your signed-in session and expires after 30 days. It is strictly necessary to sign in, and we set no advertising or analytics cookies.

What we do with it

We use it to run the service: to sign you in, to show you what you have access to, to run your apps, and to let the people who administer your organization manage who belongs to it. We do not sell it, and we do not use it to build a profile of you.

Who else sees it

People in your organization. Administrators can see the roster: names, email addresses, roles and last sign-in. Anyone you share an app with can see that you own it.

Providers you connect. Signing in or connecting a repository sends a request to that provider under their own terms.

[Subprocessors]. [List hosting, email delivery and any other processor here, with the country each operates in.]

We disclose data otherwise only where the law requires it.

How long we keep it

Your account and what you created stay until they are deleted. Removing somebody from an organization removes their membership, not their account. Deleting an organization deletes what belonged to it. [State the retention period for proxy logs and backups.]

Your rights

Depending on where you live you may have the right to see the data we hold about you, correct it, have it deleted, or object to how we use it. Write to [contact email] and we will answer within [period]. You can also complain to your local data protection authority.

Security

Secrets are encrypted at rest and sessions are carried over HTTPS. No service can promise perfect security, and we do not.

Changes

If we change this policy we will update the date above, and tell you in the application where the change is material.

Contact

[contact email], or [postal address].