Privacy Policy

Stickyboard is a sticky-note kanban app available as a web app at stickyboard.dev and as a Chrome extension that replaces the new-tab page. This policy explains exactly what data we collect, why, who processes it on our behalf, and the rights you have over it.

1. Who runs Stickyboard

Stickyboard is operated by an independent developer (the "operator," "we," "us"). It is a personal project, not a registered company. Contact details are at the bottom of this page.

2. What data we collect

2.1 Account data

• Email address — required to sign in. Login uses a one-time code sent to your email; we never store passwords.
• One-time login codes — short-lived codes generated when you request to sign in. They expire automatically and are not retained after use.
• Session token — issued after successful sign-in and stored in your browser's localStorage. Sent with each request to identify your account. Cleared when you sign out.

2.2 Board content

If you use Stickyboard without an account, none of this reaches us at all: your boards, notes, and notebook pages are stored only in your own browser (IndexedDB) and are never sent to our servers. They are sent to us only if you later create an account and choose to bring them with you.

• Sticky notes — the text, color, position, and ordering of every note you create, plus the board it belongs to.
• Notebook pages — the title and free-text body of any notebook page you write alongside a board.
• Board membership — when you share a board, we record the recipient's email address and the role you granted (owner or editor). Invitation tokens are stored until accepted, declined, revoked, or expired.

2.3 Technical data

• Server logs — our hosting providers automatically record IP address, timestamp, request path, and user agent for each API request. Used for security, debugging, and abuse prevention. Rotated regularly.
• Active board preference — the ID of the board you last viewed is saved in localStorage so we can re-open it on your next visit. Never leaves your browser.
• Aggregate web analytics — when you visit the hosted web app at stickyboard.dev, Google Analytics records a randomly assigned client ID (the _ga cookie), your truncated IP address, the pages you view, and basic environment details (browser, device, country). This is used in aggregate only to understand how many people use Stickyboard and which parts they reach. Google Analytics is not loaded inside the Chrome extension — the extension is exempt from this collection entirely.
• Product analytics — on the hosted web app only, we record a small set of named product events (for example: a note was created, a note was completed, an account was created) via PostHog, together with a randomly assigned identifier stored in your browser's localStorage. If you are signed in, that identifier is associated with your account ID and email address so we can tell repeat use from new use. We never send PostHog your board content — no note text, no notebook pages, no board names. PostHog is not loaded inside the Chrome extension, and the library is not even included in the extension package.

We do not collect: your browsing history, your location beyond country level, mouse/keystroke telemetry, advertising identifiers, or any cross-site fingerprint. The Chrome extension requests no permissions other than chrome_url_overrides (replacing the new-tab page).

3. How we use it

We use the data above strictly to:

• Authenticate you and keep you signed in.
• Store and sync your boards and notes across devices.
• Deliver login codes and board invitation emails.
• Operate, secure, and debug the service (e.g. investigating an incident reported via support).
• Measure aggregate usage of the web app so we can understand which features people reach and prioritise accordingly. We do not look at individual users in analytics.
• Comply with legal obligations when required.

We do not sell your data, use it for advertising, train AI models on it, or share it with any party not listed in Section 5.

4. Boards you publish

You can publish a board so that anyone with its address can read it, without an account. This is off for every board until you switch it on, and you choose which boards it applies to.

When a board is published, a published board's page shows its name, its colours, and the notes on it — titles, descriptions, checklists and sketches — alongside the username you picked. Anyone who has the link can see it, and search engines can index it.

Some things are never published, even on a published board:

• your email address;
• the board's notebook pages;
• notes you have moved to the bin;
• the assignee written on a note, since that is often someone else;
• your other boards, unless you publish those too;
• when notes were created, edited or finished, and how much focus time you logged against them.

You can unpublish a board at any time from the same menu, and the address stops working immediately. Copies already made by other people or by search engines are outside our control, so treat publishing as permanent for anything sensitive.

You may also allow anyone with the link to add and move notes on a published board. We do not ask those visitors for an account or an email address, and we do not record who they are, so notes they add are not attributable to anyone. Only you can move notes to the bin.

A separate setting controls whether stickyboard.dev/your-username lists your published boards. It is off unless you turn it on; publishing a single board never adds it to a public index on its own.

5. Who we share it with

We use the following sub-processors to operate the service. Each receives only the data needed for its specific job:

• Railway (privacy policy) — hosts our backend application, PostgreSQL database, and Redis cache. Stores all account data and board content listed in Section 2.
• Resend (privacy policy) — delivers transactional email (login codes and board invitations). Receives the recipient email address and the message body.
• Google Fonts (privacy policy) — serves typography assets to your browser. Google may log your IP address when the font is fetched. We do not send Google any account data.
• Google Analytics (privacy policy) — measures aggregate usage of the hosted web app at stickyboard.dev (pageviews, session count, browser, country). Receives a randomly assigned client ID, your truncated IP address, and event metadata. Does not receive your email address, board content, or any account identifier. Not loaded inside the Chrome extension.
• PostHog (privacy policy) — measures product usage of the hosted web app at stickyboard.dev (named events such as creating or completing a note). Receives a randomly assigned identifier, event metadata, and — when you are signed in — your account ID and email address. Does not receive your board content, notes, or notebook pages. Not loaded inside the Chrome extension.

We do not transfer data to third parties for their own purposes, do not use data for credit / lending decisions, and do not share data outside the approved use cases above.

6. Cookies and local storage

Stickyboard uses no advertising cookies. The hosted web app at stickyboard.dev sets Google Analytics cookies (_ga, _ga_*) to measure aggregate usage as described in Section 2.3. These cookies are first-party, last up to two years, and are not set inside the Chrome extension.

Beyond that, the only client-side storage is your browser's localStorage, which holds:

• Your session token (so you stay signed in across page reloads).
• The ID of your last-active board (so we can re-open it next time).
• A pending invitation token, if you arrived via an invitation link before signing in. Cleared as soon as the invitation is handled.
• A flag remembering that you dismissed the "install the Chrome extension" banner.
• Interface preferences — your font choice, whether the notebook opens wide, and similar display settings.
• On the hosted web app only, the randomly assigned PostHog analytics identifier described in Section 2.3. PostHog uses localStorage here rather than cookies.

Stickyboard also uses your browser's IndexedDB to keep a local copy of your boards, notes, and notebook pages. This is what lets the app open instantly and keep working offline. If you use Stickyboard without an account, this local copy is the only copy — it never leaves your browser, and clearing your browser data deletes it permanently.

Signing out, or clearing site data in your browser, removes all of these. To opt out of Google Analytics on the web app, you can install Google's official opt-out browser add-on or block third-party cookies. PostHog is configured to respect your browser's "Do Not Track" setting: with it enabled, no product events are sent at all. Using the Chrome extension avoids both Google Analytics and PostHog entirely, and using Stickyboard without an account means no board content ever reaches our servers. In every case the rest of Stickyboard continues to work normally.

7. Retention and deletion

• Account and board data are kept for as long as your account is active.
• Login codes expire after a few minutes and are not retained after use.
• Invitation tokens are deleted once the invitation is accepted, declined, revoked, or expired.
• Server logs are rotated by our hosting provider on their standard retention schedule (typically days to weeks).

To delete your account and all associated boards, email us at the address in Section 12. We will remove your data within 30 days, except where retention is required by law.

8. Your rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) gives you the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Delete your account and data ("right to be forgotten").
• Export your data in a portable format.
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority.

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what we collect, to delete it, and to opt out of sale of personal information. Stickyboard does not sell personal information.

To exercise any of these rights, email us — see Section 12.

9. Security

• All traffic between your browser and our servers is encrypted with HTTPS / TLS.
• Authentication uses email-delivered one-time codes; we never see or store a password.
• The database is hosted in a managed environment with provider-level encryption at rest and routine backups.
• API requests are authenticated per-user; you can only read and write boards you own or have been explicitly invited to.

No system is perfectly secure. If you discover a vulnerability, please report it to the contact email below before disclosing it publicly.

10. Children

Stickyboard is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced in-app or by email to the address on your account. The "Last updated" date at the top reflects the most recent revision. Continued use after a change indicates acceptance.

12. Contact

Questions, data requests, or security reports — email petritavd@gmail.com.