Privacy Policy

This Privacy Policy explains how AgileKit, operated by Bohdan Ivanchenko, an individual entrepreneur in Ukraine doing business as AgileKit ('we', 'us', or 'our'), collects, uses, and protects personal information when you use our website, application, and related services.

Depending on how you use the service, we may collect: (a) account and profile data, such as display name, email address, authentication identifiers, and avatar image; (b) collaboration data, such as room memberships, issues, votes, session history, the stickies (including any GIF links), votes, and action items you add to retros, and messages or feedback you send us; (c) device and usage data, such as IP address, browser information, page visits, and diagnostic events; and (d) integration data, such as connected Jira account metadata and encrypted OAuth tokens when you connect a third-party integration. In a retro we store who wrote each sticky, so its author can edit it; unless the retro's settings show authors, other participants see what was written but not who wrote it.

We use strictly necessary cookies and similar technologies for authentication, security, fraud prevention, CSRF protection, and user preferences. We also use an analytics consent cookie to remember your choice. Non-essential analytics tools, such as Google Analytics and Vercel Speed Insights, stay off unless you actively allow them.

We use personal information to provide and secure the service, authenticate users, maintain planning sessions and retros, support collaboration features, send sign-in emails, operate integrations you request, troubleshoot and improve the product, comply with legal obligations, and, where you consent, measure product usage through analytics.

Where laws such as the GDPR or UK GDPR apply, we generally rely on one or more of the following legal bases: performance of a contract or steps taken at your request, our legitimate interests in operating and securing the service, your consent for optional analytics or similar choices, and compliance with legal obligations.

We may share personal information with service providers that help us operate the product, such as infrastructure, database, authentication, analytics, email delivery, GIF search, and integration providers. Depending on the features you use, current examples may include Convex, Vercel Speed Insights, Google Analytics, Google sign-in, Resend, GIPHY, and Atlassian. When you search for a GIF in a retro, your search terms are sent to GIPHY through our server. GIFs, in search results and on stickies, load in each viewer's browser directly from GIPHY, Tenor, or Imgur, which receive that viewer's IP address and browser information under their own privacy policies. We may also disclose information when required by law, to protect rights and safety, or in connection with a reorganization, sale, or transfer of the service.

We and our service providers may process personal information in countries other than the country where you live. When that happens, we take steps designed to protect the data, such as relying on contractual safeguards, provider transfer mechanisms, or other lawful measures where required by applicable law.

We retain personal information for as long as needed to provide the service, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and feature. Planning poker rooms, and retros started by guests, are deleted automatically after 5 days without activity. A retro started by a signed-in account, or by a guest who later signs in, is kept until its owner deletes it. If a retro's owner deletes their account, the retro passes to the member who joined it first, or is deleted if nobody else joined. Stickies and action items you added to a retro that is kept stay in it after you delete your account, without your name. You may request deletion of your account data, but we may keep limited records where required for security, fraud prevention, or legal compliance.

We use reasonable technical and organizational measures designed to protect personal information, but no system is completely secure. We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on users.

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent. You may also have the right to complain to your local data protection authority. We do not provide a public GitHub workflow for privacy requests because those channels can expose personal data; please use email for privacy-related requests. You can delete a retro you own from its settings, and a signed-in account from Settings.

AgileKit is not directed to children. We do not knowingly collect personal information from children under 13, or a higher age where local law requires. If you believe a child has provided personal information to us, please contact us so we can review and delete it where appropriate.

We may update this Privacy Policy from time to time. If we make material changes, we will update the 'Last updated' date and, where required, provide additional notice or request consent before the changes apply.

For privacy questions or requests, contact Bohdan Ivanchenko at support@agilekit.app. Postal contact: Nauky Ave, 86, Dnipro, Dnipropetrovs'ka oblast, 49000, Ukraine.