Last updated: October 14, 2026
When you create an account, we collect your email address and display name. When you use CollabBoards, we collect the content you create (boards, cards, drawings, shapes), task fields you enter (status, assignee labels, due dates, courses, and checklists), and usage data such as timestamps and session information. Task assignee labels do not create account memberships or send notifications.
We use your information to provide and improve CollabBoards, process payments through Stripe, send transactional emails (account verification, password resets), and ensure the security of your account.
Your data is stored securely using Supabase (hosted on AWS) with row-level security policies. Payment information is processed and stored by Stripe — we never store your credit card details directly.
We do not sell your personal data. We use Supabase (database), Stripe (payments), and Vercel (hosting) to operate CollabBoards. Board content is also available to collaborators you authorize through the board’s sharing controls.
If a board owner connects an external AI tool, new invitations allow that tool to read the saved notes selected for assistant requests and submit suggestions. An editor reviews and applies selected changes. Older direct-access invitations retain permission to read the assigned board and add notes directly, as labeled in the AI panel. The tool’s handling of received content follows its provider’s policies. CollabBoards does not supply an embedded AI model. Invitations expire after 24 hours and can be revoked sooner; revocation stops future access but does not remove content the external tool has already received.
We store the agent’s name, reported activity and cursor, contribution labels, selected-note snapshots, request instructions, proposals, confirmed context-fetch timestamps, and approval history with the board. Approval records include the reviewer and before/after changes; they prevent duplicate application and make accepted changes attributable. This content, including task fields, is available only through the board’s authorization rules and is not sent to analytics or error monitoring. Invitation tokens are stored as hashes. These records remain after an agent disconnects and are removed when the board is deleted. Approval history is not a shared undo or recovery service.
You can request access to, correction of, or deletion of your personal data by contacting us. To request account deletion, choose Delete account from the account menu to open an email draft addressed to support@collabboards.com.
We use essential cookies for authentication and session management. Optional analytics stays off until you allow it. If you opt in, we store your choice in a cookie and, when you are signed in, in your account record. We send PostHog, hosted in the US, counts of visits to selected public pages, clicks on a few named links, verified signups, first boards created, and subscription, trial, and successful payment milestones. Internal records prevent repeat counts for those milestones. Each analytics event uses a random event ID without a shared person identity.
We do not send board content, form entries, full URLs, query strings, referrers, or account identifiers to PostHog. We do not use session replay, autocapture, person profiles, or advertising tracking. You can turn analytics off here at any time. Do Not Track or Global Privacy Control also keeps browser collection off and prompts us to revoke an earlier account choice. Because participation is optional and delivery can fail, these aggregate counts may understate activity.
Optional analytics is not active on this site right now.
With your optional analytics choice, we also report unexpected browser and page errors to PostHog. Reports use a fixed error description, sanitized code locations, a route pattern, the deployment commit, and the runtime. We do not include the original error message, customer content, request bodies, cookies, or authentication headers. Operational failures in machine-to-machine services such as payment webhooks and AI-tool endpoints are reported without a person identity. Private source maps of our application code help us locate bugs. Reports may be limited or lost during outages; browser or device crashes that stop JavaScript entirely cannot be reported this way.
For privacy-related inquiries, contact us at privacy@collabboards.com.