At Decknote we take your privacy seriously. This document explains what data we collect, what we use it for, and what control you have over it.
What data we collect
- Account data: your name and email address when you sign up. Your password is always stored encrypted (hashed).
- Content: the boards, lists, cards, comments and attachments you create in order to provide the service.
- Technical data: the minimum information needed to keep you securely signed in, and your time zone so the daily summary reaches you in the morning.
- Usage data: the pages you visit and basic information about your browser or device, through Google Analytics, so we can see how Decknote is used.
- Error reports: when something breaks, the technical details of the error (what failed, on which page and in which browser), so we can fix it.
- Notification token: if you use the Android app and allow notifications, a token from Firebase Cloud Messaging that lets us send them to your phone.
- Shopify orders: if you use Decknote from Shopify, the details of the orders the app turns into cards, including the buyer's name, contact and shipping details. They are erased when Shopify asks us to redact that customer.
How we use your data
We use your data only to operate the service: to authenticate you, show your boards, sync your team's changes in real time and send you notifications (for example, when you're assigned or mentioned). We do not sell your data to third parties.
AI agents and MCP connections
You can connect AI apps such as Claude, ChatGPT, Cursor or VS Code to your Decknote account through our MCP server, as explained in Connect AI agents. When you do:
- What it can do: the app acts on your behalf, with your own permissions. It can read the boards, cards, comments and attachments you can see, create and change them where you're an editor, and change your settings. Deleting for good, emailing other people and publishing a link ask for your confirmation first. It can't move money: upgrading only gives you a Stripe link that you pay yourself.
- How access works: you approve each app on a Decknote screen, and it receives OAuth tokens, never your password. We store tokens only as hashes. An access token expires after an hour; the refresh token lasts up to a year and is renewed when used. Disconnecting the app in Settings → Connected apps revokes them immediately. API tokens you create for scripts can be revoked in Settings the same way.
- What we keep: the app's name and return address, when it was connected and last used, and the changes it makes, which appear in each board's activity marked “via MCP” and are kept like any other activity. We don't log the content of its requests; if one fails, the technical error goes to our error reports, as above. Tokens are deleted when you disconnect the app or delete your account.
- What we don't collect: Decknote never receives your conversations with the AI app, only the requests the app sends to our server. What the app reads from Decknote becomes part of your conversation with it, and that provider (for example Anthropic, OpenAI, Cursor or Microsoft) handles it under its own privacy policy.
Providers
We rely on a few providers, and share with each only what it needs to do its job:
- an email provider, to send invitations and notifications;
- Stripe, to process Pro payments. Your card details go straight to Stripe; we never see or store them;
- Google Analytics, for the usage data above;
- Firebase Cloud Messaging, to deliver notifications to the Android app.
Error reports go to an error tracker we run ourselves.
Your rights
You can access, correct or delete your data at any time, without asking us: Settings → Your data downloads everything you have as a single file, and Settings → Danger zone deletes your account and its content immediately and permanently. If you would rather we do it, or you have any other request about your data, get in touch.
Deleting your account
You can delete your Decknote account yourself, on the web or in the Android app:
- Sign in and open Settings.
- In Danger zone, choose Delete my account.
- Confirm with your password.
This deletes, immediately and permanently, your account, the boards you own (for everyone you shared them with, too), and your cards, comments, attachments, notifications and API tokens, and cancels your Pro subscription if you have one. Nothing is kept on our side; if you ever paid, Stripe keeps its own payment records. If you can't sign in, email us from your account's address at the contact below and we'll delete it for you.
Contact
If you have questions about this policy, email us at sales@devcloudsoftware.com.