Privacy policy

Last updated: October 27, 2026

SquadRetro is a service published by an individual as a personal project. This policy explains what data is collected, why, and how to exercise your rights over it.

1. Data controller

The publisher of the service (see the legal notice) is the controller of the data described here. Dedicated contact for privacy questions: contact@squadretro.app

2. Data collected

User account: name, email address and password (stored securely by Supabase Auth, never in plain text).

Retrospective content: the sticky notes, votes, groups, reactions, comments, action items and decisions that you or your team create in sessions, as well as the organizations, squads and invitations you manage. Inviting someone requires entering their email address: it is kept until the invitation is accepted or revoked.

Waiting list: if sign-ups are closed, the email address (and optional message) you enter to be notified when they reopen.

Audience measurement (public pages): the pages viewed and a few key interactions (for example leaving your email address for the beta), along with the technical information any browser sends when connecting to a website: device type, browser, referring page and IP address, from which our provider derives a country and which it then does not store. These measurements are not linked to your account or your identity, and do not make it possible to recognize you from one visit to the next. Page addresses are also cleaned before being sent: invitation tokens, session codes and email addresses that may appear in a URL are replaced with a generic pattern and never leave the service.

One caveat, and it matters: if you log in during the same visit, the audience measurements made just before are linked to your account — this is what makes it possible to know what led someone to sign up. A visit that does not end with a login remains entirely anonymous.

Product usage measurement: how retrospectives unfold — the fact that they take place, their configuration and a few volume counters — is sent to the same provider, from our database and from the application once you are logged in. This measurement is linked to your account: it is the only way to know whether the product is actually used, and not just visited. It therefore only concerns logged-in people; the link comes from your session, and nothing is written to your device for this purpose. The content of your retrospectives is never part of it: neither sticky notes, nor comments, nor the session title.

Cookies: only technical cookies, strictly necessary for the service to work (keeping your session via Supabase Auth), and a language preference cookie set only when you choose a language. No audience measurement or advertising cookie is used: the audience measurement described above works without cookies or local storage, that is, without writing anything to your device, which makes it impossible to link from one visit to the next.

3. Purposes

  • Creating and securing your account, authenticating you;
  • Running retrospectives in real time (display, synchronization, presence of participants);
  • Sending you the emails the service requires: sign-up confirmation, password reset, invitations;
  • Contacting you again if you join the waiting list;
  • Measuring site audience anonymously, as well as product usage linked to your account when you are logged in, to understand what is useful and improve it;
  • Answering requests you send by email.

4. Legal basis

Processing is based on the performance of the service you request by creating an account or joining the waiting list (article 6.1.b of the GDPR), and where applicable on your consent.

Audience measurement and product usage measurement are based on the legitimate interest in improving the service (article 6.1.f of the GDPR). Neither writes information to your device or reads any from it: the rules specific to trackers, which would require your consent, therefore do not apply. You may however object to these measurements at any time (see article 7).

5. Recipients and hosting

Your data is neither sold nor transferred to third parties for commercial purposes. It is entrusted, as technical processors, only to the providers necessary for the service to work:

  • Vercel — application hosting;
  • Supabase — database, authentication;
  • Resend — sending the service's emails (confirmation, forgotten password, invitations, waiting list); only the recipient's address and the content of the message are sent to it;
  • PostHog — audience measurement and product usage measurement.

Where your data lives. The database, your account and the content of your retrospectives are hosted in the European Union, in Ireland, as is the application's server-side processing. The two measurements described in article 2 run on PostHog's European infrastructure (PostHog Cloud EU).

Transfers outside the European Union. These providers are established outside the European Union: Vercel Inc. and Resend Inc. in the United States, Supabase Pte. Ltd. in Singapore. Even when your data is stored in Europe, access from these countries therefore cannot be ruled out, and our emails are routed through Resend's infrastructure. These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the provider's participation in the EU-U.S. Data Privacy Framework, under the terms set out in their data processing agreements.

6. Retention period

Account data and retrospective content are kept for as long as your account exists. Waiting list emails are kept until sign-ups reopen or until you ask for them to be deleted.

When you delete your account, your profile, your credentials and your memberships are deleted immediately and permanently, and your name disappears everywhere it appeared: on your sticky notes, your comments and the action items you owned, it is replaced with "Deleted member". However, the content you wrote in sessions remains in the retrospectives concerned, now anonymous. This is deliberate: the record of a session also belongs to the people who held it with you, and punching holes in it retroactively would make them lose track of collective decisions. If a specific piece of content is a problem for you, write to us.

Audience measurement and product usage measurement data is kept for one year. Since the latter is linked to an account, it is erased at our provider when you delete yours, with no action needed on your part.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and port your data, the right to object to processing based on legitimate interest — the two measurements described in article 2 —, the right to withdraw your consent where a processing relies on it, and the right to lodge a complaint with the CNIL (the French data protection authority).

You can delete your account at any time, directly from the Account page of the application (immediate and permanent deletion, under the terms described in article 6). For any other request about your data — including to object to these measurements or ask for their erasure —, write to contact@squadretro.app

8. Contact

For any question about this policy or your data: contact@squadretro.app