Privacy Policy

Information we collect

Account and sign-in: your email address, used to send a one-time sign-in code and to identify your account.

Subscription: your subscription status, plan, and customer identifier from our payment provider. We never receive or store your full card details (see Payments below).

Devices: a per-install identifier and a license token, so the app can verify your subscription and keep you signed in.

Referrals and payouts: if you join the referral program, your referral code, the referrals attributed to you, and the PayPal account you connect so we can pay you.

Product analytics: events describing how the app is used. By design these capture the shape of activity (feature types, durations, counts) and never your screen contents, window titles, file names, or any text you create.

Feedback: any message you send us and, if you attach one, a screenshot.

Technical: IP address and similar request metadata, used for security and rate-limiting.

We do not collect sensitive information, and we do not knowingly collect more than we need to run the service.

How we use it

To provide and secure the app, verify your subscription, and sign you in.

To run the referral program and pay referral rewards.

To respond to feedback and support requests.

To understand which features are used so we can improve the product.

To detect, prevent, and address abuse, fraud, or technical issues.

To meet our legal, tax, and accounting obligations.

Legal bases (EU and UK)

If you are in the EU, EEA, or UK, we rely on these legal bases under the GDPR and UK GDPR: performance of our contract with you (providing the app, processing your subscription, running referrals you join); our legitimate interests (securing the service, preventing fraud, and understanding product usage in a privacy-first way); your consent (optional analytics and any marketing email, which you can withdraw at any time); and compliance with legal obligations (tax and accounting records).

Payments

Payments are processed by Polar, which acts as the Merchant of Record for your purchase. Polar collects and processes your payment details directly under its own terms and privacy policy, charges your card, and handles sales tax and VAT. We never see or store your card number.

Service providers

We share personal information with a small set of providers only as needed to run the service, and only so they can perform that service for us:

Polar: payments, subscriptions, and tax as Merchant of Record.

Supabase: database hosting for accounts, subscriptions, and referrals, and storage for any feedback screenshot you send.

Upstash: rate-limiting.

Resend: sending sign-in code emails.

PostHog: privacy-first product analytics.

PayPal: paying out referral rewards to referrers who connect an account.

Overseas and international transfers

We are based in Australia, and some of our providers store and process data overseas, including in the United States and the European Union. This means your personal information may be disclosed to, and handled in, countries other than your own.

Before disclosing personal information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. For people in the EU, EEA, and UK, transfers outside those regions are made under appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, relied on by us and our providers.

Analytics and your choices

Our product analytics are privacy-first: we record what kind of action happened, not its content. You can opt out of analytics at any time in the app's preferences, which stops events from being sent.

On the website we use cookies and similar technologies that are necessary for the site to work, and, where you consent, for analytics. If you are in the EU, EEA, or UK we ask for your consent before setting non-essential cookies, and you can change your choice at any time.

Marketing emails

We only send commercial or promotional email where you have consented or where you would reasonably expect it as our customer, in line with the Australian Spam Act 2003. Every such message identifies us and includes an unsubscribe link, and you can opt out at any time. Service emails such as your sign-in code and billing notices are not marketing and are sent as part of providing the app.

Data retention

We keep account, subscription, and referral data for as long as your account exists and as needed for legal, tax, and accounting purposes. Sign-in codes are short-lived and become invalid after use or expiry. Feedback screenshots are kept only as long as needed to handle your message. When data is no longer needed we delete or de-identify it.

Security and data breaches

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, including encryption in transit and access controls. No method of storage or transmission is completely secure.

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and any other regulators where the law requires.

Your privacy rights

Wherever you live, you can ask us to access the personal information we hold about you, to correct it if it is wrong or out of date, or to delete your account and data. To make a request, email james@codejames.au. We will respond within the time required by the law that applies to you, and we may need to verify your identity first.

Australia: you have the right to access and correct your personal information under the Australian Privacy Principles. If you are not satisfied with how we handle a privacy issue, you can complain to us first, and then to the OAIC at oaic.gov.au.

EU, EEA, and UK: under the GDPR and UK GDPR you also have the right to restrict or object to certain processing, to data portability, and to withdraw consent at any time. You can lodge a complaint with your local data protection authority, which in the UK is the Information Commissioner's Office.

California: under the CCPA and CPRA you have the right to know what personal information we collect and how we use and disclose it, to delete it, to correct it, and to not be treated differently for exercising these rights. We do not sell or share your personal information, and we have not done so.

Children

TalkToBoard is not directed to children and is not intended for use by anyone under the age required to consent to data processing in their country. We do not knowingly collect personal information from children.

Changes

We may update this policy. Material changes will be reflected by updating the date at the top of this page, and where appropriate we will tell you in the app or by email.

Contact

Questions or requests about this policy, or to reach the person responsible for privacy at TRUFFFLE: james@codejames.au.