Privacy Policy

Information we access

• Account information. You can create a kiriboard account with an email address and password, or by signing in with Google. We use your email address to identify your account. When you set a password, it is handled by our authentication provider (Supabase) and stored only as a salted hash — kiriboard never sees or stores your password in plain text. Connecting a Google account also shares your email address with us to identify the calendars you connect.
• Google Calendar data (read-only). With your consent (calendar.readonly scope), we read events from the calendars you choose to connect, so they can be displayed on your dashboard. kiriboard never creates, edits, or deletes your calendar events.
• Todoist tasks (when connected). If you connect a Todoist account, we read your tasks and projects to show what needs your attention, and — only when you tap to complete a task — mark that task complete on your behalf. kiriboard does not create, edit, or delete any other Todoist data.
• Settings you provide. Preferences such as your weather location, theme, and display options.

How we use information

We use the information solely to operate kiriboard for you: to display your connected calendars, tasks, and the weather for your chosen location on your own dashboard. We do not use your data for advertising, and we do not sell it.

Google user data — Limited Use

kiriboard's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer or sell Google user data, and we do not use it for serving advertisements or for any purpose other than providing the dashboard features you requested.

Storage and security

Calendar events and settings are stored in our database (hosted on Supabase) and are accessible only to your account. Account passwords are managed by Supabase Auth and stored only as salted hashes. OAuth tokens used to access Google and Todoist on your behalf are encrypted at rest (AES-256-GCM) and are never exposed to the browser. Your Todoist tasks are fetched live to display them and are not stored in our database. The application is hosted on Vercel. Access to your data is protected by row-level security scoped to your account.

Sharing

We do not sell or share your personal data. Data is processed only by the infrastructure and service providers required to run kiriboard, acting on our behalf: Google (calendar), Todoist (tasks), Supabase (database and authentication), Vercel (hosting), Open-Meteo (weather — receives the coordinates of the location you choose), and Plausible (privacy-friendly, cookieless analytics).

Retention and deletion

We retain your stored calendar data only for as long as the account stays connected. You can disconnect a Google account from within kiriboard at any time, which removes its stored tokens, calendars, and events. You can also revoke kiriboard's access from your Google Account permissions. Disconnecting Todoist likewise removes its stored token; you can also revoke access from your Todoist account's connected-apps settings. To delete your kiriboard account and all associated data, contact us at the address below.

Cookies, local storage, and analytics

kiriboard uses a cookie only to keep you signed in — it does not use tracking or advertising cookies. Your display preferences (theme, density, week layout, and temperature unit) are stored locally in your browser, not on our servers. We use Plausible Analytics, a privacy-friendly analytics service that uses no cookies and collects no personal information, to understand aggregate usage.

Changes

We may update this policy as kiriboard evolves. Material changes will be reflected by the “Last updated” date above.

Contact

Questions about this policy or your data? Email decastervincent@gmail.com.