Privacy policy

Which personal data devbord processes, what for, for how long, and which rights you have.

Last updated: 12 October 2026

This policy explains which personal data devbord processes, why, for how long, who else is involved and which rights you have. It covers the website at devbord.com, the apps for iPhone, iPad, Mac and Windows, the browser extension and the API.

A shorter explanation of what we can and cannot see inside your workspace is at devbord.com/privacy.

1. Who is responsible

devbord is run by The Remedy Computers, Polderlaan 72 8370 Blankenberge, Belgium, registered under enterprise number 0644468691, VAT BE0644.468.691 and BrandForge, De Limburg Stirumstraat 33B 8370 Blankenberge, Belgium, registered under enterprise number 0719679721, VAT BE0719.679.721. For anything about your personal data, write to [CONTACT EMAIL].

We have two roles:

- **Controller** for the data we need to run devbord itself: your account, security logs, billing, the waitlist, support and the public website.
- **Processor** for the content of a workspace: cards, comments, chat, files, documents, time entries, error data and everything else members put in. The owner of the workspace decides what happens with that content and is its controller. If your data is in a workspace of your employer or client, ask them first.

2. What we process and why

Your account

- **What:** username, name, email address, password (stored only as a bcrypt hash), profile picture, language, appearance and notification preferences; if you turn it on, the secret of your two-step verification (encrypted) and your recovery codes.
- **If you sign in through another service** (Discord, GitHub, or your organisation's single sign-on): the identifier, name and email address that service passes on.
- **Why:** to give you access and keep your account secure.
- **Legal basis:** performing our contract with you.

Sessions and security

- **What:** for each sign-in and each device: time, IP address and browser or app type; a log of security events such as sign-ins, failed attempts, password changes and changes to two-step verification.
- **Why:** to keep you signed in, to show you your own devices and activity, and to detect and stop abuse.
- **Legal basis:** our legitimate interest in a secure service.

Workspace content

- **What:** everything you and other members add to a workspace, including files, chat messages, time entries, meeting notes and, when you fill it in, the location of a card. Your name and profile picture are shown to the other members next to what you do.
- **Why:** to provide the service to the workspace.
- **Legal basis:** we process this on behalf of the workspace owner, under our terms of service.

Payments

- **What:** the name of the workspace and its owner, plan, billing name and address, VAT number, invoices and payment status. Card and bank details are entered with our payment provider Stripe; we never see or store full card numbers.
- **Why:** to charge for paid plans, send invoices and meet tax and accounting rules.
- **Legal basis:** contract and legal obligation.

Email and notifications

- **What:** your email address for messages about your account (password reset, security notices, invitations) and for the notifications and summaries you have switched on; the push token of your device or browser if you allow push notifications.
- **Why:** to tell you what happens in your workspaces. You choose per kind of notification in your profile.
- **Legal basis:** contract; for push notifications, your consent through the permission you give on your device.

Waitlist

- **What:** your email address, your name if you give it, and your language.
- **Why:** only to invite you when there is room.
- **Legal basis:** your consent. You can ask us to remove you at any time.

Support

- **What:** what you send us when you ask for help.
- **Why:** to answer you.
- **Legal basis:** our legitimate interest in helping our users, or contract.

To look inside a workspace for support, we need the approval of an admin of that workspace. Access lasts at most 72 hours, can be revoked, and everything opened or changed is recorded in a log the workspace can read.

Visitors of the public website

- **What:** page views of the public pages (home, plans, documentation), counted with Umami. No cookies, no profiles, and no following across other sites. People who are signed in are not counted, and nothing you do inside the app is counted.
- **Why:** to know which pages are read.
- **Legal basis:** our legitimate interest in improving the website.

Data from your own apps and public pages

If a workspace uses error tracking, performance monitoring, bug reports, public forms, feedback boards, or email subscriptions on a status page or changelog, devbord receives data about that workspace's own users and visitors: for example an error report with a user identifier or IP address, a filled-in form, or the email address of a subscriber. Common secrets such as passwords and tokens are filtered out of error reports when they arrive. We process all of this on behalf of the workspace, which is responsible for informing those people.

3. Cookies and local storage

devbord uses no advertising or tracking cookies.

- **Session cookie** (`__Host-devbord_sid`): keeps you signed in. Necessary for the service.
- **Sign-in cookie** (`__Host-devbord_oauth`): exists only for the few minutes of a sign-in through another service.
- **Local storage in your browser:** preferences such as theme and language, and which announcement you closed. These stay on your device.

Because only necessary cookies are used, there is no cookie banner.

4. Who else receives data

We do not sell personal data and do not share it for advertising. These parties process data for us, each only for its task:

| Party | Task | When |
|---|---|---|
| Hetzner Online GmbH, Germany | The servers devbord runs on, in Germany | Always |
| Stripe Payments Europe Ltd, Ireland | Payments and invoices | Only with a paid plan |
| OVH | Delivering email | When we send you email |
| Apple (push notification service) | Delivering push notifications to the iPhone and iPad app | Only if you allow notifications |
| The push service of your browser (Google, Mozilla or Apple) | Delivering push notifications in the browser | Only if you allow notifications |
| European Commission (VIES) | Checking a VAT number | Only when you enter one |
| OpenStreetMap | Map tiles and address search | Only in the map view and for card locations |

Services a workspace connects itself, such as GitHub, GitLab, Discord, Slack or Microsoft Teams, receive what is needed for that connection. They act under their own terms and privacy policies.

We hand over data to authorities only when the law obliges us to.

5. Data outside the EU

devbord's servers and database are in Germany. Some of the parties above are based in the United States or have parent companies there (Stripe, Apple, Google, and the services a workspace connects). Where personal data goes to a country outside the European Economic Area, this happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep data

| Data | Kept for |
|---|---|
| Account | Until you delete it. Deleting is immediate |
| Sessions | Ended after 3 days without use, and at the latest 90 days after signing in |
| Security log | 1 year |
| Workspace content | Until a member or admin deletes it, or the workspace is deleted |
| Error events | 90 days |
| Performance data | 30 days |
| Uptime history of monitors | 400 days |
| Notifications in your inbox | The most recent 500 |
| Password reset links and waitlist invitations | Until used or expired (invitations: 14 days) |
| Waitlist entries | Until you have been invited, or ask to be removed |
| Invoices and billing records | 7 years, as Belgian tax law requires |
| Backups | [BACKUP PERIOD], after which they are overwritten |

When you delete your account, your account and personal data are removed at once. A workspace in which you were the only member is deleted with it. What you wrote in workspaces you shared with others stays there, without your name.

7. Security

- All traffic is encrypted (HTTPS).
- Passwords are stored only as bcrypt hashes; nobody can read them back.
- Keys and tokens (two-step verification, Discord, GitHub, Stripe) are stored encrypted.
- Two-step verification is available to every account, and a workspace can require it.
- The software gives the site administrator no access to the content of a workspace without approval from one of its admins, and logs that access.
- The database is backed up on a schedule.

Whoever runs a server can technically read its database, and card content is not end-to-end encrypted: search, automation and notifications would not work otherwise. We say so openly on devbord.com/privacy.

8. Your rights

Under the GDPR you can:

- see which data we have about you and get a copy;
- have incorrect data corrected;
- have your data deleted;
- have the processing restricted, or object to processing based on our legitimate interest;
- receive your data in a format you can take elsewhere;
- withdraw a consent you gave.

Most of this you can do yourself:

- **Copy of your data:** Profile › Data and account › Download my data.
- **Correcting:** Profile.
- **Deleting:** Profile › Data and account › Delete account, or in the iPhone and iPad app Profile › Delete account.
- **Everything in a workspace:** an admin can export it under Workspace › Settings › Export everything.

For anything else, write to contact@devbord.com. We answer within one month. For data inside a workspace run by your organisation, we pass your request on to that organisation.

You can also complain to the data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be. You may also turn to the authority of the EU country where you live.

9. Children

devbord is meant for people who work in teams and is not directed at children. You must be at least 16 to create an account.

10. Changes

When we change this policy, we change the date at the top. For changes that matter, we tell you by email or in the app before they apply.

devbord · Pricing: one flat price per team · News · API documentation · Support: help and contact · Privacy: what we can and cannot see · Terms of service · Error tracking for dev teams, Sentry-compatible · Time tracking and invoicing for dev teams · Status pages with uptime monitoring and incidents · Changelog and release notes from done cards · A Trello alternative for dev teams · A Sentry alternative that keeps your SDKs · A Linear alternative with error and time tracking · A Jira alternative for small dev teams · An Asana alternative for software teams · A ClickUp alternative with error tracking and invoicing · A Toggl alternative with a board and invoicing · A Harvest alternative with a kanban board · A Statuspage alternative with monitoring built in