Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (stored as a secure hash—we never store plain text passwords)
• Account preferences and settings

User-Generated Content

When you use our Service, we store:

• Tasks, projects, and boards you create
• Comments and activity logs
• Calendar events and schedules

Usage Data

With your consent (via our cookie consent banner), we may collect:

• Pages and features you visit
• Time spent on different sections
• Actions taken within the application
• Error logs and crash reports

Device Information

We automatically collect:

• Browser type and version
• Operating system
• IP address (for security and abuse prevention)
• Device identifiers

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Store and display your tasks, projects, and coding activity
• Improve the Service: Analyze usage patterns to improve features and user experience
• Communicate with You: Send service updates, security alerts, and support messages
• Ensure Security: Detect and prevent fraud, abuse, and security incidents
• Comply with Law: Meet legal obligations and respond to lawful requests

We do NOT sell your personal information to third parties. We do NOT use your data for advertising purposes. We do NOT share your coding activity data with employers or other users.

4. Legal Basis for Processing

We process your personal data based on:

• Contract Performance: Processing necessary to provide the Service you signed up for
• Legitimate Interests: Processing for security, fraud prevention, and service improvement
• Consent: Analytics and marketing communications (you can withdraw consent at any time)
• Legal Obligation: Processing required to comply with applicable laws

5. Data Storage and Security

Your data is stored securely using industry-standard practices:

• Database: Hosted on Supabase infrastructure in the United States (AWS us-west-2)
• Encryption at Rest: All data is encrypted using AES-256 encryption
• Encryption in Transit: All connections use TLS 1.2 or higher
• Access Controls: Role-based access controls limit who can access data
• Backups: Regular automated backups with point-in-time recovery
• Password Security: Passwords are hashed using bcrypt with appropriate work factors

6. Third-Party Services

We use the following third-party services to operate BuilderBox:

7. Data Retention

We retain your data for the following periods:

• Active Accounts: Data is retained for as long as your account is active
• Deleted Accounts: Account data is permanently deleted within 30 days of account deletion
• Coding Heartbeats: Raw heartbeat data is retained for 1 year, then aggregated or deleted
• Aggregated Statistics: Daily/weekly summaries may be retained indefinitely for your reference
• Backups: Backups containing your data may persist for up to 30 days after deletion
• Legal Requirements: Some data may be retained longer if required by law

8. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

GDPR Rights (EU/EEA/UK Residents)

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

CCPA Rights (California Residents)

• Right to Know: Know what personal information is collected and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of personal information (we don't sell data)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

To exercise any of these rights, please contact us at privacy@builderbox.app. We will respond to your request within 30 days.

9. Cookies and Local Storage

We use cookies and local storage for:

• Essential Cookies: Session management and authentication (required for the Service to function)
• Preference Cookies: Storing your theme, font size, and other settings
• Analytics (localStorage): PostHog analytics uses localStorage instead of cookies for a more privacy-friendly approach (only with your consent)

When you first visit BuilderBox, you'll see a cookie consent banner. Analytics tracking is only enabled if you click "Accept." You can change your preference at any time in Settings.

We use browser localStorage to store your preferences locally and for analytics (PostHog). PostHog data is only sent to our analytics service if you have consented. Your local preferences never leave your device unless you explicitly sync them to your account.

10. Children's Privacy

BuilderBox is not intended for children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@builderbox.app, and we will delete such information.

11. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers are located. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the US.

We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Data processing agreements with all third-party providers
• Technical and organizational security measures

12. Security Incident Response

In the event of a data breach that affects your personal information, we will:

• Notify affected users via email within 72 hours of becoming aware of the breach
• Describe the nature of the breach and types of data affected
• Explain the steps we're taking to address the breach
• Provide recommendations for protecting yourself
• Report to relevant supervisory authorities as required by law

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date at the top
• Sending an email to the address associated with your account (for material changes)

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: