Privacy Policy
Effective Date: August 4, 2026 | Last Updated: August 4, 2026
At TrailBoard ("we", "us", "our"), operating at trailboard.app, protecting your personal data is a primary commitment. This Privacy Policy outlines how we collect, process, and protect your information when using the TrailBoard platform.
1. Information We Collect
- Account Information: Email address, username, password hash, and optional profile name. Outbound transactional emails are delivered via Resend, and inbound emails to
trailboard.appare routed via Cloudflare Email Forwarding. - Workspace Content: Products, roadmap cards (Now/Next/Later), strategic initiatives, tags, and collections.
- Cookieless Telemetry & Analytics: Aggregate client traffic analytics via Umami Cloud and server-side feature usage telemetry via PostHog Cloud EU. Neither service sets tracking cookies or performs cross-site profiling.
- Server & Network Logs: Cloud hosting logs maintained by Render and DNS/Edge security telemetry managed by Cloudflare.
2. Subprocessors and Service Providers
| Subprocessor | Function | Location | Data Processed |
|---|---|---|---|
| Render Inc. | Cloud Application Hosting | US / EU | Database, server access logs (IP address) |
| Dodo Payments Inc. | Merchant of Record (MoR) & Payments | Global | Billing details, credit card tokens, tax IDs |
| PostHog Inc. | Server-side Cookieless Analytics | EU | Anonymized feature usage events |
| Umami Software Inc. | Client-side Cookieless Web Analytics | EU | Aggregate traffic metrics, pageviews |
| Resend Inc. | Outbound Transactional Email | US / EU | Recipient email, reset tokens, email content |
| Cloudflare Inc. | DNS, Edge Security & Email Forwarding | Global | IP address, DNS logs, inbound email routing |
| Google Fonts | Font CDN | Global | IP address, User Agent |
3. Cookies and Storage
TrailBoard uses no advertising or third-party tracking cookies. We use only strictly necessary security session cookies (`sessionid` and `csrftoken`) to keep you logged in and protect against CSRF attacks (exempt from consent banner requirements under EU ePrivacy and UK PECR), and browser `localStorage` to save your Light/Dark visual theme choice.
4. Data Rights (GDPR / UK PECR / CCPA)
You have the right to access, rectify, export, or delete your personal data. You can delete your account at any time or request data exports by contacting [email protected].
5. Contact Us
For privacy inquiries or data protection requests, email us at [email protected].