Privacy Policy

1. Who runs Standupless

Standupless is a personal project run by an individual software engineer, not a company. It is in active development. This policy has not been reviewed by a lawyer; it is an honest description of how the service handles data. Questions go to tyler@webbpulse.com.

2. What we collect

• Account details: your email address, an optional display name, whether your email is verified, and a hash of your password. If you add a passkey, a second factor or an API key, the public key, the encrypted second factor secret or a hash of the key is stored with your account.
• Sign in with a provider: if you sign in with Google or GitHub, we receive your email address and name from that provider and store a link between the two accounts.
• Workspace content: the workspaces, teams, issues, comments, projects, cycles, views, labels and share links you and your teammates create, and who created or changed them.
• Attachments: files you upload to an issue or comment.
• Operational logs: request logs, error reports and traces, which include IP addresses and account identifiers, used to keep the service running and secure.

We do not use analytics, advertising or tracking tools, and we do not sell or share your data for marketing.

3. The GitHub App

A workspace admin can install the Standupless GitHub App on a GitHub account or organization. It links pull requests and commits to issues. With it installed, Standupless receives events for pull requests, pushes and the installation itself, and can read issues, pull requests, repository metadata, branch names and commit messages in the repositories you choose. It stores the pull request number, title, state and author login for linked issues. It writes only its own pull request comment and its own check run, and asks for no organization or account permissions. The GitHub sign in used during installation only proves who you are; that token is revoked straight away. You can remove the app from GitHub at any time.

4. Where it lives and who else touches it

Standupless runs on Amazon Web Services in the US West (Oregon) region, us-west-2. Data is encrypted in transit and at rest. The services involved are:

• Amazon Web Services: hosting, the database, attachment storage in Amazon S3, and email through Amazon SES for verification, password reset, invitation and notification messages.
• GitHub: only when you connect the GitHub App or sign in with GitHub. Connected installations show their GitHub avatar, which your browser loads from GitHub.
• Google: only when you sign in with Google.
• Stripe: only when a workspace buys a paid plan. Standupless sends Stripe the workspace name and the buyer's email address, and Stripe takes the card details directly. Standupless never sees or stores card numbers; it keeps only the plan, the seat count and the Stripe customer and subscription ids.

No other third party receives your data.

5. Cookies and browser storage

Standupless shows no cookie banner because everything it stores in your browser is strictly necessary for the service or remembers a choice you made:

• One cookie, wp_refresh, keeps you signed in. It is HttpOnly, Secure, limited to the sign in endpoints, and removed when you sign out.
• Local storage remembers your light or dark theme and which teams you expanded in the sidebar.

There are no analytics, advertising or third party cookies, and fonts are served from Standupless itself.

6. How long we keep it

• Account and workspace data: until you or an admin delete it.
• Operational logs and traces: 7 days.
• Replaced or deleted versions of attachments: 7 days.
• Database backups: up to 35 days.

7. Deleting your data

• A workspace owner or admin can delete a team from its settings, which permanently removes its issues, comments, attachments, cycles, views and GitHub links.
• A workspace owner or admin can delete the whole workspace from its settings. It is permanently deleted 14 days later, with its teams, issues, comments, attachments, views, share links, API keys and GitHub connection, and any owner or admin can cancel until then.
• You can delete your account from your security settings. It is deleted as soon as you confirm: you are signed out everywhere, and your sign in methods, API keys, connected apps, profile, memberships and any workspace nobody else is in are removed straight away. Issues and comments you wrote stay in their workspaces and show as written by a deleted user.

You can also email tyler@webbpulse.com from the address on the account and we will do it for you. Deleted data leaves the backups as they age out.

8. Your rights

You can ask for a copy of your data, a correction, or deletion at any time, wherever you live. Email tyler@webbpulse.com and expect a reply within 30 days.

9. Children

Standupless is not meant for anyone under 16, and we do not knowingly collect data from them.

10. Security

If you find a security issue, please report it privately to tyler@webbpulse.com with enough detail to reproduce it, and give us a reasonable chance to fix it before sharing it. Please do not access other people's data or disrupt the service while testing.

11. Changes

When this policy changes, the effective date above changes with it. See also the Terms of Service.