Privacy Policy
The short version
Your retro's contents are encrypted in your browser before they ever leave it — the key never does. We cannot read your retros, we run no analytics, we record no sessions, and we make no backups of retro contents. Your data belongs to you; we will never sell it.
Who operates the service
Rocket Retros is operated by Taylor Brooks, sole proprietor. A limited liability company is being formed; when it exists, it becomes the operator and this page will say so.
What we keep
- Your account: the email address you signed in with (for receipts and support), which team rooms you've hosted — by an opaque id, and TTL-bounded to recent months — and your plan's state: the plan itself and, after a cancellation at period end, the paid period's end. For supporters, the account also names the two Stripe ids it was paid under (a customer id and a subscription id).
- In flight: the encrypted messages themselves, and the routing data a relay needs to move them (a room id, a hash, a connection id). The contents stay encrypted the whole way.
- Feedback you send: the report's text, the optional reply email, your IP address and browser user agent, and build context. Feedback reports are deleted after 7 days.
- Short-lived counters: operational log metrics, including the mail throttle's per-day counters, age out within about 48 hours.
What we never keep
Retro contents and keys (never ours), card or billing data (Stripe's), analytics or session recordings (none exist), and backups of retro contents (none exist).
Your browser keeps a working copy
The hosting tab stores the room's encrypted board and its identity in the browser's local storage until the session ends or you clear it. Your browser also holds your sign-in token for as long as the sliding session allows — active use renews it, an idle month, or ninety days in total, ends it.
Service providers
The service runs on Amazon Web Services (US East, us-east-1). Payments run through Stripe. Sign-in email is sent with Amazon SES. These providers process data on our instructions and keep records of their own under their own policies — card and charge records at Stripe are Stripe's.
Deleting your account, and the honest exceptions
Deleting your account removes the email address and the room records — your retros themselves live in your browser, not our database. For a supporter, deletion also ends the subscription, cancelled at Stripe to the end of the paid period; if Stripe was unreachable at delete time, the subscription may need cancelling from its receipt email. What deletion cannot reach: feedback reports already sent (they delete on their own 7-day schedule); if a sign-in mail hard-bounced, SES's bounce-suppression list may retain the address; the throttle counters (about 48 hours); and Stripe's own customer and billing records.
Your rights
Where local law gives you rights of access, correction or deletion over your personal data, email brooksin.it@gmail.com — the inventory above is deliberately short, so any request is easy to honor in full.
Children
The service isn't directed to children under 13, and we don't knowingly keep their personal data.
Changes to this policy
This policy may change; material changes are flagged at the top of this page.
Contact
Taylor Brooks — brooksin.it@gmail.com.