Privacy Policy

1. Who we are

BoardHydra (“BoardHydra”, “we”, “us”) is an online task-board service at boardhydra.com, operated by Christopher Hunsinger, a sole proprietor based in Pennsylvania, USA. We are responsible for the personal information described in this policy.

This policy covers the BoardHydra website, web app, emails and API. Our Terms of Service explain the rules for using BoardHydra.

2. What we collect

Information you give us

• Account details: your name, email address and password. We store your password only as a one-way Argon2id hash; we can't read it.
• Your boards and content: boards, lists, cards, descriptions, checklists, labels, dates, automations, locations you add to cards, and photos you upload.
• Photos: we re-encode every photo on our server, which strips its embedded metadata. If a photo has a location and capture time, your browser reads them before upload and we keep them with the photo so it can appear on the map. You can remove a photo at any time.
• Profile photo (optional): if you upload one, we crop it to a square and re-encode it, which strips its metadata. You can replace or remove it at any time.
• Reports: if you report a profile photo or a board photo, we keep your report (who you are, what you reported, the reason and any note) and a copy of the reported image until the report is settled.
• Teams and invitations: teams you create or join, your rank, and the email addresses of people you invite to a board or team.
• Survey answers (optional): if you answer the in-app survey, your role, team size, use case, how you heard about us, the tool you used before, and any comments.
• Messages to us: what you send through the contact form or by email, such as your name, email, company and message.

Information about purchases

When you buy a plan, API credits or a token pack, checkout is run by Stripe, and purchases are sold through Link (see section 4). We receive and keep your Stripe customer and subscription IDs, your plan, its status and renewal date, and what you bought. Stripe may also make your name, email and billing country or address available to us in our Stripe account. We never receive or store your full card number.

Information collected automatically

• Sign-in sessions: a session cookie keeps you signed in. We store a hash of it with its creation and expiry time.
• Security and anti-abuse signals: your browser gets a random device identifier cookie. We store only salted, one-way hashes of that identifier and of the IP addresses you sign in from, never the raw values, plus when we first and last saw them. We use these to stop abuse of free rewards and referrals and to protect accounts.
• Usage records: daily counts of your API requests, your token and API-credit history, and actions you take that earn tokens.
• Audit log: a record of security- and money-related events on your account, such as sign-ins and failed sign-in attempts (with the email address that was tried), password and profile changes, purchases, Shop buys, board and team changes, and reports. It never contains passwords or IP addresses.
• Performance metrics: server-wide numbers like response times, error counts and how many people are active. They aren't tied to you.
• Network data: like any website, our network provider processes your IP address and basic request information to deliver and protect the site.

We do not use third-party analytics, advertising pixels, or tracking cookies.

3. How we use it

• To provide BoardHydra: store and sync your boards, let you collaborate, run automations, show maps, and apply your plan's features and limits.
• To communicate with you: email confirmations, password resets, invitations, billing notices, and replies to your messages. We don't currently send marketing email. If we start, you'll be able to opt out.
• To keep BoardHydra safe: prevent fraud, spam and reward abuse, enforce our Terms, and investigate security issues.
• To support you: when you ask for help, or when an account or board needs fixing. See “Administrator access” below.
• To improve the product: using survey answers and aggregate usage, such as how many boards exist, never by reading your content for marketing.
• To meet legal obligations: for example, tax and accounting records, or responding to lawful requests.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We don't use your board content or photos to train AI models.

If you're in the European Economic Area or the UK, our legal bases are: performing our contract with you (running the service); our legitimate interests (security, abuse prevention, improving BoardHydra); your consent (the optional survey); and legal obligations.

Administrator access

Our administrator can view account and billing details and board and team information to provide support, fix problems, handle billing, and enforce our Terms. If an administrator needs to open a board to fix it, they join it with “support access”, which appears in that board's member list until they leave. Administrative changes are recorded in an internal audit log.

4. Who we share it with

We share personal information only with the service providers that help us run BoardHydra, only for that purpose:

• Stripe and Link (payments). Stripe runs checkout and payment processing. Purchases are sold through Link (“Sold through Link, LLC”), which is the merchant of record and handles payment, sales tax, receipts and billing support. Stripe and Link process your payment details under their own privacy policies; see stripe.com/privacy and link.com/privacy.
• Resend (email delivery), to send the emails described above.
• Cloudflare (network, security and email routing), to deliver the site and forward messages sent to our support addresses.
• HERE Technologies (address search). When you search for an address or ask for the address of a dropped pin, our server sends that search text or those coordinates to HERE. We don't send your name or email with it.
• Esri (map images). When you open the Map view, your browser loads map tiles directly from Esri's ArcGIS Online servers, so Esri receives your IP address and the map area being viewed.
• Google Fonts. Our pages load fonts from Google, so Google receives your IP address and browser information when a page loads.
• Have I Been Pwned. When you choose a password, we check it against known data breaches by sending only the first five characters of a hash of it. Your password itself never leaves our server.

We may also share information to comply with the law or a valid legal request, to protect the rights, safety or property of our users, the public or BoardHydra, or as part of a sale, merger or transfer of the BoardHydra business. In a transfer, this policy will continue to apply to your information unless you're told otherwise and given a choice.

5. What other BoardHydra users can see

• People on a board you're on can see your name, email address, profile photo, avatar frame and name style, and everything on that board, including cards, photos and their locations.
• People on a team you belong to can see your name, email address, profile photo and rank.
• If you report something, the person you reported isn't told it was you.
• If you invite someone, they receive an email with your name and the board or team name.
• When a board belongs to a team, the team owner and the people the team's ranks allow control it, even if you created it.
• Public boards: boards are private by default. If a board's owner makes it public, anyone with its link, including people without an account, can view its lists, cards, card descriptions, labels, dates and checklists. Public viewers don't see members' names or email addresses, photos, or card locations. The owner can make the board private again or reset the link at any time, and the old link then stops working.

Only share boards with people you trust with their contents, and don't put anything on a public board you wouldn't want anyone to read.

6. Cookies and local storage

We use only cookies that BoardHydra needs to work:

• Session cookie, to keep you signed in (up to 30 days).
• Device cookie, a random identifier used for security and anti-abuse, as described above.

The app also saves interface preferences, like your last board and view, in your browser's local storage. That data stays on your device. We don't use advertising or analytics cookies.

7. How long we keep it

• While your account exists, we keep your account details and content so the service works.
• Sign-in sessions expire after 30 days. Email confirmation links expire after 48 hours, and password reset links after 1 hour.
• When you delete your account, we delete your profile, the personal boards you own (with their photos), your sessions, API keys, token and credit history, and pending invitations you sent. Boards that belong to a team stay with that team, including content you added. Copies in our backups are overwritten within 30 days.
• Purchase records are kept as long as tax and accounting laws require. Stripe and Link keep their own records under their policies.
• Address search results are cached on our server for up to 24 hours.
• The audit log is kept for 1 year, for security and accountability. Performance metrics are kept for 14 days.
• Reports are kept after they're settled, but the saved copy of the reported image is deleted once a moderator removes the content or dismisses the report.
• Profile photos are deleted when you remove them, when a moderator removes them after a report, or when you delete your account.

8. Security

BoardHydra is served only over HTTPS. Passwords are hashed with Argon2id. Session, email and API tokens are stored only as hashes. Device and IP signals are stored as salted hashes, and uploaded photos are re-encoded to strip hidden metadata. No system is perfectly secure, so please use a strong, unique password. If you find a vulnerability, email [email protected].

9. Your choices and rights

• Access and correct: view and change your name, email and password on your Account page.
• Delete: delete your account from Account → Delete account, or ask us to.
• Copy: email us for a copy of your personal information. Your boards are also available through the BoardHydra API.
• Object or restrict: ask us to stop or limit certain uses of your information.
• Survey: it's optional, and you can ask us to delete your answers.

Depending on where you live, for example California, other US states with privacy laws, the EEA or the UK, you may have legal rights to access, correct, delete or port your personal information, and to object to or restrict its processing. We honor these requests for all users, wherever they live. Email [email protected] from the address on your account. We'll respond within 30 days and may need to confirm your identity first. We won't treat you differently for exercising your rights. If you're in the EEA or UK, you can also complain to your local data protection authority.

10. Children

BoardHydra isn't directed to children. You must be at least 13 to use it, or at least 16 in the EEA and UK. If you believe a child has given us personal information, email [email protected] and we'll delete it.

11. Where your data is stored

Our servers are in the United States. If you use BoardHydra from elsewhere, your information is transferred to and processed in the US, and by our service providers wherever they operate, with protections required by applicable law.

12. Changes to this policy

We'll update this page when our practices change and change the “Last updated” date above. For important changes, we'll also notify you by email or in the app before they take effect.

13. Contact us

Privacy questions or requests: [email protected]
Everything else: [email protected] or our contact form

BoardHydra · Christopher Hunsinger · Pennsylvania, USA