Legal
Privacy Policy
Last updated 19 October 2026
This policy explains how Shyft Stack handles personal data in ShyftBoard: the web app, the Chrome extension and the Windows app. For content in workspaces, the workspace owner decides what is stored and why; we process it on their behalf. For your account and our own operations, Shyft Stack is responsible.
What we collect
- Account data: your name, email address, password (stored only as a secure hash by our authentication provider), profile picture, time zone and preferences. If you sign in with Google we receive your name, email and picture from Google.
- Workspace content: boards, lists, cards, comments, checklists, labels, files you upload, and the members of each workspace.
- Marketplace order data: when you click the extension on a Fiverr order, the order title, status, dates, requirements and file links. The price, buyer name, buyer username and order messages are kept only if the workspace owner turns them on. The extension reads nothing until you click it, and reads only the order you are viewing.
- Encrypted credentials: logins you choose to store on cards are encrypted at rest; revealing one is recorded in the card’s activity.
- Usage and security data: sign-in events, an audit log of membership, security and settings changes, and technical logs (IP address, browser and device type) kept to operate and protect the Service.
Why we use it
- To provide the Service you asked for (performance of our contract with you).
- To keep it secure, prevent abuse and fix problems (our legitimate interests).
- To send account emails such as invitations, security notices and the notifications you choose (contract and legitimate interests).
- To meet legal obligations such as tax records for paid plans.
We do not sell personal data, show advertising, or use workspace content to train AI models.
Who processes it for us
- Supabase (database, authentication, file storage).
- Vercel (hosting of the web app).
- Resend (sending email).
- Google (only if you choose to sign in with Google).
These providers act on our instructions under data-processing terms. Data may be processed outside your country, including in Asia-Pacific and the United States, with appropriate safeguards.
How long we keep it
- Workspace content: for as long as the workspace exists; deleted workspaces are removed permanently 30 days after deletion.
- Account data: until you delete your account.
- Notifications: 180 days. Board activity: one year. Audit log: for the life of the workspace.
- Email delivery records: 90 days. Backups held by our database provider follow its retention.
Your choices and rights
You can update your profile, change notification emails, export a workspace you administer, and delete your account from Account settings. Depending on where you live you may also have rights to access, correct, delete or port your data and to object to or restrict processing. Ask us at hello@shyftstack.com; if your data belongs to someone else’s workspace we will pass your request to its owner. You may also complain to your local data-protection authority.
Security
Access is enforced in the database with row-level security for every request, traffic is encrypted in transit, files are stored in private buckets with short-lived links, stored credentials are encrypted with AES-256-GCM, and two-step verification is available for every account.
Cookies
We use only the cookies the Service needs to work. See the Cookie Policy.
Children
ShyftBoard is not intended for people under 16.
Changes
We will post updates here and, for material changes, tell account holders by email before they take effect.
Contact
Shyft Stack, hello@shyftstack.com.