Privacy policy
RetroPop is a tool for team retrospectives. We collect only what it needs to work, we don't show ads and we never sell data. Last updated 3 November 2026.
Who is responsible
RetroPop is run by Jack P Design (Denmark), the data controller for this site. Questions or requests: privacy@retropop.app.
What we collect and why
- Your account: name, email, a hashed password (or your Google sign-in) and your settings, so you can sign in and keep your retros. Basis: the contract with you.
- Retro content: boards, notes, votes, comments, actions and chats with the Professor. Only people with the board link see a board. Basis: the contract with you.
- Guests: the name you type when you join a board. No account or email is needed.
- Payments: handled by Stripe. We keep your plan and Stripe's customer reference, never your card details.
- New sign-ups: when an account is created, the RetroPop team gets a short email with its name and email. Basis: legitimate interest (running the service).
- Visit statistics: anonymous counts of page views, where visitors come from and which buttons they use, measured with Umami. No cookies, no personal profile, and the IP address is not stored. Board and invite links are removed before anything is sent. Basis: legitimate interest (improving the site).
Cookies and local storage
We use only what is strictly necessary: a sign-in cookie for accounts (30 days), a session cookie for guests, and your browser's local storage for preferences such as theme and sound. No advertising or tracking cookies, so there is no cookie banner.
Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Fly.io | Hosting of the app and its database | Amsterdam, EU |
| OpenAI | Writes the Professor's replies, only when you chat with him. Requests are not stored by OpenAI for training (store: false). Names and emails are never sent. | USA |
| Stripe | Payments and invoices for the Pro plan | EU and USA |
| Resend | Sends emails such as password resets | USA |
| Sign-in with Google, only if you choose it | USA | |
| Umami | Anonymous, cookieless visit statistics | EU |
Transfers to the USA rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
Account data and retros are kept while your account exists. Delete a board at any time from your dashboard. To delete your account and everything in it, email us and we will do it within 30 days. Sign-in sessions expire after 30 days.
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it, by emailing privacy@retropop.app. You can also complain to your data protection authority.