Privacy policy

Information we handle

Your account

When you register or sign in, we use your account identifier, email address, display name, sign-in provider and account timestamps. If your sign-in provider supplies a profile-photo URL, it may be stored with your profile. Sign in with Apple may provide a private-relay email address. Password authentication is handled by Firebase Authentication.

Your boards and audio

We store board titles, scene content, project metadata and audio you choose to record or upload so you can save your work and open it across supported devices. Recordings may contain your voice or other sounds you choose to capture. Microphone permission is requested when you record; you can use other editing tools without granting it.

Security and technical information

Our authentication and hosting providers process information such as IP addresses, request details, app or device attestation data and service logs to operate and protect the service. Boardra also uses rate-limit records based on hashed email addresses and requester IP addresses to prevent misuse of authentication emails and the contact form. Hashing does not necessarily make these records anonymous.

Support messages

If you contact us, we receive your name, reply email address and message. Contact submissions are stored privately in our database, and a notification containing those details is sent to our support inbox through SendGrid. Please do not include your password, sign-in codes or information you do not want us to receive.

Why we use it

• Provide account access and deliver requested verification, password-reset and sign-in messages.
• Save, synchronise and open your boards and audio.
• Respond to support, access, correction and deletion requests.
• Protect accounts, prevent abuse and investigate service problems.
• Meet applicable legal obligations.

The app does not include an advertising SDK, Firebase Analytics or Crashlytics. Technical information may still be processed by the service providers described below.

Service providers

We use the following services to deliver Boardra. They receive information needed for the functions described here.

• Google / Firebase: account authentication, cloud database and file storage, backend functions, app attestation and website hosting. See Firebase privacy and security information and Google’s privacy policy.
• Apple: Sign in with Apple when you choose it, and DeviceCheck app attestation on supported Apple builds. See Apple’s privacy policy.
• Twilio SendGrid: delivery of authentication emails and contact-form notifications, including email addresses and message content. See Twilio’s privacy notice.

Google also processes information when you choose Google sign-in. We may disclose information when required by law or where necessary to protect users and the service. Content you export or share yourself is handled by you and any service you choose to share it through.

Storage and retention

Account information and saved cloud boards are kept while your account is active and the information is needed to provide the service, unless you delete them. Local files and exported copies remain on your devices or wherever you choose to store them.

Deleting your account starts removal of your private cloud account data, boards and audio. If a cleanup step fails, the backend queues it for another attempt. The following retention settings apply to our Firebase project:

• Authentication and contact-form rate-limit records expire after two days. Contact-form database records expire after 90 days. Completed account-deletion records expire after seven days. Automatic expiry cleanup is asynchronous and may finish after those periods.
• Deleted cloud audio files may remain recoverable in the storage provider’s soft-delete system for seven days.
• Standard service logs are retained for 30 days. Google Cloud’s required audit logs are retained for 400 days.
• Pending deletion requests are retained until cleanup can complete. Support correspondence may be kept while needed to handle your request or meet applicable legal obligations.

Deleting your account does not immediately erase every technical log or provider recovery copy. Records subject to a legal obligation may need to be kept for the period that obligation requires.

Our primary cloud database, file storage and backend functions are located in the United States. Other provider services and website delivery may process information in other countries. We use access controls and encrypted network connections to protect information, but no service can guarantee absolute security.

Your choices and account deletion

You choose the content you create, upload, record or export. You can change microphone permission in your device settings and manage your boards in the app.

To request access to or correction of your information, ask about deletion, or raise a privacy concern, use our contact form. We may need to verify account ownership before responding. Depending on where you live, you may also have rights to obtain a copy of your information, object to or restrict processing, withdraw consent where processing relies on consent, or complain to your local privacy regulator.

This website

This marketing website has a contact form for support and privacy requests. It does not use analytics trackers or advertising cookies. Fonts, images and animation previews are served from our own site. Firebase App Hosting and Google Cloud process technical request information, which may include your IP address, browser details, requested URL and request time, to deliver and secure the website.

When you submit the contact form, we use your name, reply email and message to handle your request. Hashed request identifiers and short-lived counters help prevent spam. Contact messages are not publicly readable. The emailed copy of your message may be kept while needed to resolve your request or meet legal obligations. Following an external link takes you to a service with its own privacy practices.

Children and classroom use

Boardra provides tools for creating and presenting educational content. Please contact us before arranging accounts for children or uploading students’ personal information, so we can discuss the permissions and requirements that apply. If you believe a child’s information has been provided without appropriate permission, contact us to request its removal.

Contact and changes

We will revise the effective date above when this policy changes. If a change materially affects how we handle your information, we will provide an appropriate notice.

Privacy contact: send a message to 2SA.