Privacy policy

This policy explains how Roadmap & Capacity, available at www.thesupercraft.com (“the service”), handles personal data. The operator of the service is the data controller. For any question or request, write to admin@thesupercraft.com.

What we collect

• Account data: your name and email address. If you sign in with Google, also the Google account identifier and the name and email Google shares with us (scopes openid, email, profile). If you use a password, only a salted hash of it is stored, never the password itself.
• What you put in the service: initiatives, ideas, notes, boards, files, comments and other content you or your team create, and the history of changes.
• Technical data: a session cookie that keeps you signed in, the time of your last sign-in, and your network address, used briefly to limit repeated sign-in or sign-up attempts. Server logs record errors without the content of your work.
• Statistics: Vercel Web Analytics counts page visits without cookies. Google Analytics 4 is used only if you accept analytics cookies; it is set up without advertising features, and addresses of private or shared links are never sent. You can change this choice at any time in Settings.

Why, and on what basis

• To provide the service you asked for: your account, your workspace and its content (performance of a contract).
• To keep the service secure and working: sign-in protection, error diagnosis, backups (legitimate interest).
• To send emails the service needs, such as invitations, overdue reminders or updates you subscribed to (contract or legitimate interest; you can stop optional emails from the link in each message).
• Visit statistics with Google Analytics, only with your consent.

We do not sell personal data and do not use it for advertising. Google user data obtained through Google sign-in is used only to create and sign in to your account; it is not shared with third parties or used for any other purpose.

Who else handles the data

Service providers that process data on our behalf: Vercel (hosting and Web Analytics), Supabase (database and file storage), Google (sign-in and, with consent, Analytics) and the email delivery provider. Some of them may process data outside the European Economic Area under safeguards required by the GDPR, such as standard contractual clauses. People in your workspace see the content shared there, according to the visibility you choose.

How long

Account data and content are kept while the account or workspace exists. When an account is deleted, its personal data is removed or anonymised within 30 days, except what must be kept by law. Session cookies expire on their own; sign-in attempt counters are kept for minutes.

Your rights

You can ask to access, correct, delete or receive a copy of your data, to restrict or object to its processing, and to withdraw consent at any time (this does not affect what was done before). Write to admin@thesupercraft.com. You can also complain to a data protection authority; in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

Changes

If this policy changes, the new version is published here with its date.