Privacy Policy

This policy explains what personal data Luminbrane Whiteboard ("Whiteboard") handles, why, and what you can do about it.

Who is responsible

• Luminbrane AB (org.nr 559523-4245), Slottsbacken 8, 111 30 Stockholm, Sweden. Email: [email protected].
• Your account, security and usage data: Luminbrane is the controller.
• What's on a board (notes, drawings, files, comments, logos): whoever adds it owns it, and the board's owners decide who sees it. For any personal data in that content, the user or organisation that puts it there is the controller, and Luminbrane is the processor that hosts it for them (see the Terms, section 11).

What we collect

• Account: your email address, a display name (taken from your email until you change it), your password if you set one (stored hashed only), your two-factor set-up, your display preferences and any decoration images you upload, and when you signed up and last signed in.
• Boards: what you and your board members add (notes, drawings, files, comments, board logos) together with who added or changed what, plus memberships and roles. We also keep a short change history (what changed, when and by whom, without the content) that keeps boards in sync.
• Invitations: the email addresses of people you invite, and who invited them.
• Mobile app: if you allow notifications in the Whiteboard app for iPhone or Android, the app's push token (an address for sending notifications to that device), the platform (iOS or Android) and the app version, and when the device was last seen. To send a notification we briefly keep a record of what happened (for example "someone assigned you a post-it on this board"), never the content.
• Security and technical data: IP addresses, browser and device details, and sign-in events. To stop abuse of sign-in, we also keep hashed (scrambled) copies of the IP address and email address for each sign-in attempt.
• Usage data: how Whiteboard is used, for example counts of boards, notes and files, which features are used, and errors.

Why we use it

• To run Whiteboard for you: accounts, boards, sharing, sync and emails such as sign-in codes and invitations. Legal basis: our agreement with you (GDPR art. 6(1)(b)).
• To send the notifications you chose in the mobile app (someone assigned you a post-it, commented on your file or invited you to a board). Legal basis: our agreement with you (art. 6(1)(b)).
• To keep Whiteboard and its users safe: bot checks, stopping abuse, investigating problems. Legal basis: legitimate interest (art. 6(1)(f)).
• Analytics and product improvement: to understand how Whiteboard is used, fix bugs and decide what to build next. We work with usage data and metadata, aggregated or de-identified where we can. We don't read the content of your boards for analytics, and we never sell your data or use it for advertising. Legal basis: legitimate interest (art. 6(1)(f)). You can object at any time (see "Your rights").
• To meet legal obligations, when the law requires it (art. 6(1)(c)).

Who can see it

• Board members see a board's content, its history and the other members' names and email addresses. What they can do depends on their role (viewer, editor or owner).
• Luminbrane: we don't look at your boards. People at Luminbrane access them only when you ask for support, when security requires it, or when the law requires it. Our admin view shows accounts and activity counts, not board content.
• Service providers (sub-processors) that help us run Whiteboard:
• Supabase: database, sign-in and file storage. Hosted in the EU (Stockholm, Sweden).
• Fly.io: application hosting. Servers in Stockholm, Sweden.
• Cloudflare: network, security and the Turnstile bot check. Global network.
• Resend: delivery of emails (sign-in codes and invitations). United States.
• Expo (650 Industries, Inc.): delivers push notifications to the mobile apps, and updates the apps. United States. Only if you use the mobile app.
• Apple (Apple Push Notification service): delivers notifications to iPhones and iPads. Only if you use the mobile app.
• Google (Firebase Cloud Messaging): delivers notifications to Android devices. Only if you use the mobile app.
• Push notifications say who did what on which board (for example "Anna assigned you a post-it on “Q4 plan”"). They never contain the text of a note or comment, or a file name.
• Some of these companies are based in the US, or may process data outside the EU/EEA. Where they do, the transfer is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
• We don't share your data with anyone else unless the law requires us to.

Cookies and browser storage

• wb-auth: a strictly necessary sign-in cookie. It's httpOnly, so scripts can't read it, and it lasts up to 30 days.
• Browser storage (localStorage): remembers things like your last tab, zoom, filter and pen settings on your device.
• Cloudflare may set security cookies to protect against bots and attacks.
• We use no advertising or tracking cookies, so there's no cookie banner.

How long we keep it

• Your account: until you delete it.
• Board content: until it's deleted, or until the board is deleted. A deleted tab is kept for 30 days, so we can restore it if you ask, and then it's removed for good with everything on it.
• Change history: 90 days.
• When you delete your account: we delete any board where you are the only member, with its files and logo. On shared boards, what you added stays with the board, because it belongs to the board, but it's no longer linked to your name or email. Your decoration images are deleted.
• Invitations: removed 30 days after they're accepted, cancelled or run out.
• Sign-in attempt records: deleted after a day.
• Mobile devices that get notifications: removed when you sign out of the app, and automatically when a device hasn't been seen for 90 days.
• Notification records: deleted after 7 days.
• Stored files: a nightly clean-up removes any file that nothing points to any more.
• Logs at our service providers: kept for a limited period under their own retention settings.
• Backups: run on our providers' schedules and expire automatically.

Your rights

You have the right to access, correct, delete, restrict, move (portability) and object to the processing of your personal data. Many of these you can do yourself:

• Download your data: Account → Your data.
• Change your name and settings: Account.
• Delete your account: Account → Delete account.
• Notifications: switch them off, or choose which kinds you get, in Account → Notifications, or turn them off in your phone's settings. You can also remove a device there.

For anything else, email [email protected] and we'll reply within a month. If your request is about content on someone else's board, the board's owners are the controller. Ask them first, and we'll help them handle it. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Security

• All traffic uses HTTPS.
• Each board is isolated at the database level, so only its members can reach it.
• Files are stored privately and shared through short-lived links.
• Passwords are hashed and checked against known breaches.
• Two-factor sign-in is available, and board owners can require it.
• No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

Children

Whiteboard isn't meant for anyone under 16.

Changes

If we change this policy in a way that matters, we'll tell you by email or in Whiteboard before the change applies. The date at the top shows the latest version.